xecuting program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x20000000000000, 0x0, 0xf5) 13:54:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000006a4"], 0x0, 0x0, 0x0}) 13:54:47 executing program 5: r0 = gettid() syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:54:47 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0xc000000000, 0x0, 0xf5) 13:54:47 executing program 1: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = syz_open_dev$vbi(&(0x7f0000000100)='/dev/vbi#\x00', 0x3, 0x2) ioctl$TIOCGPTPEER(r2, 0x5441, 0x1) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x2}, 0x1c) syz_emit_ethernet(0x3e, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaabb86dd606de0e0c99bd2f45a8000000000000000000000000000bbff02000000000000000000000000df010400000000089078"], &(0x7f0000000080)) r3 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x80000000, 0x311040) ioctl$TUNGETFEATURES(r3, 0x800454cf, &(0x7f0000000040)) unshare(0x40000600) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00') fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)={0x0, 0x0}) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000080)={0x0, r3, 0x9, 0x0, 0x7f, 0x89cc}) perf_event_open(&(0x7f0000000180)={0x5, 0x70, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x2, 0x6a, 0x0, 0x3ff, 0x6, 0x0, 0xff, 0x3, 0x80000001, 0x6, 0x100, 0x0, 0x4, 0x0, 0x0, 0x0, 0x2, 0x0, 0x9, 0x100000001, 0x7fffffff, 0x2, 0x7, 0x101, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x2000000000}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x5}, r4, 0x5, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/if_inet6\x00') preadv(r6, &(0x7f0000000040)=[{&(0x7f0000000080)=""/11, 0xb}, {&(0x7f0000000840)=""/232, 0xe8}], 0x2, 0x0) [ 507.530138] binder: 15077:15078 BC_CLEAR_DEATH_NOTIFICATION invalid ref 100663296 [ 507.575781] binder: BINDER_SET_CONTEXT_MGR already set [ 507.603178] binder: 15077:15078 ioctl 40046207 0 returned -16 [ 507.778434] IPVS: ftp: loaded support on port[0] = 21 13:54:51 executing program 4: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='ns\x00') fchdir(r0) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) write$evdev(r1, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TCSETSW(r0, 0x5403, &(0x7f0000000040)={0x1, 0x0, 0x7, 0x6, 0x7, 0x2, 0x0, 0xe631, 0x8000000ffffffff, 0x3, 0x5, 0xfffffffffffffff8}) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) 13:54:51 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x20000005, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r3, 0x84, 0x13, &(0x7f0000000340)={0x0}, &(0x7f0000000380)=0x8) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r4, 0x84, 0x77, &(0x7f00000003c0)=ANY=[@ANYRES32=r5, @ANYBLOB="03000400b40f00000904e7ff"], &(0x7f0000000440)=0x10) r6 = dup2(r2, r2) setsockopt$inet_mtu(r6, 0x0, 0xa, &(0x7f0000000300)=0x2, 0x4) connect(r3, &(0x7f0000000140)=@nfc={0x27, 0x0, 0x2, 0x7}, 0x80) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r3, 0x40106614, &(0x7f0000000080)={0x0, @aes256}) ioctl$KDGKBLED(r2, 0x4b64, &(0x7f0000000540)) write$binfmt_aout(r0, &(0x7f0000000280)=ANY=[], 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x2, 0x10}, &(0x7f0000000200)=0xc) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000280)={0x7fff, 0x1, 0xfffffffffffffffd, 0x1f52, r7}, &(0x7f00000002c0)=0x10) get_mempolicy(&(0x7f00000004c0), &(0x7f0000000500), 0x1, &(0x7f0000ffd000/0x1000)=nil, 0x1) getsockopt$inet_sctp_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f0000000400)={r8, 0x10000, 0x6, 0x83b, 0x401, 0x8}, &(0x7f0000000480)=0x14) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:54:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c40003f0000a4"], 0x0, 0x0, 0x0}) 13:54:51 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x14000000, 0x0, 0xf5) 13:54:51 executing program 1: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = syz_open_dev$vbi(&(0x7f0000000100)='/dev/vbi#\x00', 0x3, 0x2) ioctl$TIOCGPTPEER(r2, 0x5441, 0x1) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x2}, 0x1c) syz_emit_ethernet(0x3e, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaabb86dd606de0e0c99bd2f45a8000000000000000000000000000bbff02000000000000000000000000df010400000000089078"], &(0x7f0000000080)) r3 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x80000000, 0x311040) ioctl$TUNGETFEATURES(r3, 0x800454cf, &(0x7f0000000040)) unshare(0x40000600) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00') fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)={0x0, 0x0}) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000080)={0x0, r3, 0x9, 0x0, 0x7f, 0x89cc}) perf_event_open(&(0x7f0000000180)={0x5, 0x70, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x2, 0x6a, 0x0, 0x3ff, 0x6, 0x0, 0xff, 0x3, 0x80000001, 0x6, 0x100, 0x0, 0x4, 0x0, 0x0, 0x0, 0x2, 0x0, 0x9, 0x100000001, 0x7fffffff, 0x2, 0x7, 0x101, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x2000000000}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x5}, r4, 0x5, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/if_inet6\x00') preadv(r6, &(0x7f0000000040)=[{&(0x7f0000000080)=""/11, 0xb}, {&(0x7f0000000840)=""/232, 0xe8}], 0x2, 0x0) 13:54:51 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_buf(r1, 0x0, 0x0, &(0x7f0000000000)="d280b6103bccc60adfeebb41f6be9333cdc2666b8e0f96a5ecd119e0039b3545d40a8de590093e9d65a00187175f77cc160f11d40aa3f60024bd67edcbf43c3ef8c1682973421de2f3a4106001b31d6a9378fdc70f7e05dc1f7942ffa30ad9a69fca7c9e559fc22da6fa94336e52c6acf8e9b1ca13693fcce787ea13bfb2f3db099e4c488c9a5a1dadd10f74a2589ed4586a96a7d6e4ed9f6fcf5dc0d04a2791976a66bbd48906718ae1cae465b8f8e3a2cc6badb1213b6fc06c90909dc8652963368d5e28be7b0836a8f42ac2de5c7341779b75553b12e8dfca6a07c2574f110b572e37328f309416dee7e60eb3ddbf", 0xf0) r3 = syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, &(0x7f0000000140)={0x0, 0x1f, 0x30}, &(0x7f0000000180)=0xc) faccessat(r1, &(0x7f0000000280)='./file0\x00', 0x110, 0xa00) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r3, 0x84, 0x5, &(0x7f00000001c0)={r4, @in={{0x2, 0x4e23, @empty}}}, 0x84) [ 511.625424] binder: 15104:15105 BC_CLEAR_DEATH_NOTIFICATION invalid ref 16128 [ 511.643340] binder: BINDER_SET_CONTEXT_MGR already set 13:54:52 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) r4 = accept4$unix(r1, &(0x7f0000000140), &(0x7f0000000040)=0x6e, 0x0) write$binfmt_aout(r4, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) [ 511.699343] binder: 15104:15114 BC_CLEAR_DEATH_NOTIFICATION invalid ref 16128 [ 511.701559] binder: 15104:15105 ioctl 40046207 0 returned -16 13:54:52 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x5000000, 0x0, 0xf5) 13:54:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000740000a4"], 0x0, 0x0, 0x0}) [ 511.883090] IPVS: ftp: loaded support on port[0] = 21 13:54:52 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400fe7eb1a0e1fc13c7560527d9767e000000000000000065750ede825e28a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c733300937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900ed0300b7559414d07189c3003b2cbdae69c72000000000000000710e1b"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) [ 511.926834] binder: 15131:15132 BC_CLEAR_DEATH_NOTIFICATION invalid ref 29696 [ 511.968478] binder: BINDER_SET_CONTEXT_MGR already set [ 511.991899] binder: 15131:15132 ioctl 40046207 0 returned -16 13:54:52 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0xfcfdffff, 0x0, 0xf5) [ 512.027882] binder: 15131:15134 Acquire 1 refcount change on invalid ref 0 ret -22 [ 512.073157] binder: 15131:15134 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 13:54:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c406c000000a4"], 0x0, 0x0, 0x0}) [ 512.273126] binder: 15145:15146 BC_CLEAR_DEATH_NOTIFICATION invalid ref 108 [ 512.313763] binder: 15145:15147 BC_CLEAR_DEATH_NOTIFICATION invalid ref 108 13:54:56 executing program 4: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='ns\x00') fchdir(r0) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) write$evdev(r1, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) clone(0x6102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) 13:54:56 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./bus\x00', 0x220000, 0x40) setsockopt$inet_buf(r1, 0x0, 0x27, &(0x7f0000000380)="ca91bcca7c8d0856b5de41c5558a2aea07eab470466cf071a88e71", 0x1b) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x14) r3 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r2, 0x0, 0x81, &(0x7f00000001c0)={'broute\x00', 0x0, 0x4, 0x4a, [], 0x3, &(0x7f0000000040)=[{}, {}, {}], &(0x7f0000000140)=""/74}, &(0x7f0000000280)=0x78) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r4, r3) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f00000002c0)=ANY=[@ANYRESOCT=r3, @ANYRES64=r3, @ANYRESHEX=r4]], 0x8) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:54:56 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0xffffffffff600000, 0x0, 0xf5) 13:54:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000480000a4"], 0x0, 0x0, 0x0}) 13:54:56 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f0000000180)='s\xbdaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) lsetxattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)=@random={'trusted.', 'fd/3\x00'}, &(0x7f0000000100)='s%`\x86\xaa\xe5<\xcc\f\xe7\x94\xa5\x01\x00\x00\x00\x00\x00\x00ps\x00', 0x16, 0x1) setsockopt$RDS_CONG_MONITOR(r1, 0x114, 0x6, &(0x7f0000000000), 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TIOCNOTTY(r1, 0x5422) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:54:56 executing program 1: r0 = gettid() syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:54:56 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x0, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f00000001c0)={0x2b, 0x3, 0x0, {0x0, 0xa, 0x0, '/dev/ptmx\x00'}}, 0x2b) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r3 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r4, r3) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r3, 0x84, 0x15, &(0x7f0000000040)={0x4000008}, 0xffffffffffffff8c) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) signalfd(r2, &(0x7f0000000140)={0xd50}, 0x8) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) [ 516.408836] binder: 15164:15165 BC_CLEAR_DEATH_NOTIFICATION invalid ref 18432 [ 516.426386] binder: BINDER_SET_CONTEXT_MGR already set [ 516.431715] binder: 15164:15165 ioctl 40046207 0 returned -16 [ 516.433592] binder: 15164:15170 BC_CLEAR_DEATH_NOTIFICATION invalid ref 18432 13:54:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000070000a4"], 0x0, 0x0, 0x0}) 13:54:56 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x700000000000000, 0x0, 0xf5) [ 516.581618] binder: 15181:15182 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1792 [ 516.600149] binder: BINDER_SET_CONTEXT_MGR already set [ 516.619262] binder: 15181:15182 ioctl 40046207 0 returned -16 13:54:57 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x2, 0x0, 0x10007ff, 0x0, 0x0, 0x0, 0x100000001}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f0000000040)={&(0x7f0000ffb000/0x3000)=nil, 0x3000}, &(0x7f0000000140)=0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup3(r0, r3, 0x0) dup2(r4, r5) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r1, 0x4008240b, &(0x7f0000000180)={0x7, 0x70, 0x9, 0x3f, 0x5, 0x6, 0x0, 0x7ff, 0x0, 0xa, 0xfffffffffffffffa, 0xfffffffffffffffe, 0x5, 0xed22, 0x253f, 0x3, 0x6d, 0x2, 0x90c, 0x90e, 0xa6, 0x3, 0x0, 0xfffffffffffffffd, 0x4, 0x8, 0x5, 0xfffffffffffffc01, 0x6, 0x7fffffff, 0x1f, 0xbb, 0x353, 0x2, 0xffffffff, 0x1, 0x7fff, 0xff, 0x0, 0xfd, 0x0, @perf_config_ext={0x5, 0x2}, 0x804, 0x0, 0x6, 0x9, 0x9, 0x1000, 0x1}) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:54:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4068000000a4"], 0x0, 0x0, 0x0}) 13:54:57 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x1900008000000000, 0x0, 0xf5) [ 516.768493] binder: 15192:15193 BC_CLEAR_DEATH_NOTIFICATION invalid ref 104 [ 516.781057] binder: BINDER_SET_CONTEXT_MGR already set [ 516.786921] binder: 15192:15193 ioctl 40046207 0 returned -16 13:55:00 executing program 4: perf_event_open$cgroup(&(0x7f0000000480)={0x0, 0x70, 0x4, 0x3031, 0x3, 0xffff, 0x0, 0x8000, 0x100, 0x2, 0x5, 0x2, 0x26b, 0x5, 0xffff, 0x8, 0x1, 0x1, 0xff, 0x7, 0x3, 0x7, 0x6, 0x7, 0x8, 0x3, 0x5, 0x2, 0x2, 0x100000000, 0x100000001, 0x7, 0x9, 0x8a3, 0x4, 0x5b24, 0x3, 0x4, 0x0, 0x3, 0x0, @perf_bp={&(0x7f0000000440), 0x4}, 0x20, 0x7, 0x7, 0xf, 0x4, 0x3, 0x4}, 0xffffffffffffff9c, 0x1, 0xffffffffffffffff, 0x0) gettid() openat$vcs(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/vcs\x00', 0x11fff, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000540)='/proc/sys/net/ipv4/vs/sync_threshold\x00', 0x2, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000580)='/dev/dsp#\x00', 0x1, 0x2000) r1 = getpgrp(0xffffffffffffffff) perf_event_open(0x0, r1, 0x10000000012, r0, 0x8) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='ns\x00') fchdir(r2) r3 = syz_genetlink_get_family_id$net_dm(&(0x7f00000001c0)='NET_DM\x00') sendmsg$NET_DM_CMD_START(r2, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x14, r3, 0x2, 0x70bd2a, 0x25dfdbfd, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x0) r4 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x5, 0x2) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000300)='TIPCv2\x00') sendmsg$TIPC_NL_PEER_REMOVE(r2, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x58, r5, 0x808, 0x70bd2a, 0x25dfdbfb, {}, [@TIPC_NLA_NODE={0x18, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_LINK={0x2c, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}]}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x80}, 0x4000) write$evdev(r4, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$EVIOCGKEY(r4, 0x80404518, &(0x7f0000000100)=""/131) 13:55:00 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) fchmodat(r1, &(0x7f0000000040)='./bus\x00', 0x10) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c01000004000000000000000000876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2b21ea4ec987d035cb9f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003bf5fb6910502cbdae69c72000000000000000000000"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:55:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000010a4"], 0x0, 0x0, 0x0}) 13:55:00 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x200000000000000, 0x0, 0xf5) 13:55:00 executing program 1: r0 = gettid() syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:55:00 executing program 5: r0 = gettid() syz_open_procfs(r0, &(0x7f0000000000)='net/protocols\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') [ 520.110657] binder: 15211:15212 BC_CLEAR_DEATH_NOTIFICATION invalid ref 268435456 [ 520.147061] binder: BINDER_SET_CONTEXT_MGR already set 13:55:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000002a4"], 0x0, 0x0, 0x0}) [ 520.161753] binder: 15211:15212 ioctl 40046207 0 returned -16 13:55:00 executing program 4: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='ns\x00') fchdir(r0) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000000080), 0x4) io_setup(0xf6, &(0x7f0000000040)=0x0) io_pgetevents(r1, 0x7fffffff, 0x8, &(0x7f0000000100)=[{}, {}, {}, {}, {}, {}, {}, {}], &(0x7f0000000200)={0x77359400}, &(0x7f0000000280)={&(0x7f0000000240)={0x2}, 0x8}) r2 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) write$evdev(r2, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) mq_unlink(&(0x7f00000002c0)='ns\x00') clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) 13:55:00 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750cd4de7558f98937702d8f9523b12ed9091f5c7333bb937dee28d4b2921ea4f88486a91c82face4b26916a0dc38b518cdf620900edbb69b7559414d055dee36acf48456a57f590d945b81a003b2cbdae69c72000000000000000710e13000000000000000000000000"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) ioctl$TIOCGLCKTRMIOS(r3, 0x5456, &(0x7f0000000040)={0x580c6e7, 0x40, 0x7, 0x3, 0xd, 0x4, 0xfffffffffffff801, 0xfffffffffffff02f, 0x92d8, 0x7, 0x7f, 0x7}) 13:55:00 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0xfffffdfc, 0x0, 0xf5) [ 520.281909] binder: 15234:15236 BC_CLEAR_DEATH_NOTIFICATION invalid ref 33554432 [ 520.314095] binder: BINDER_SET_CONTEXT_MGR already set [ 520.328927] binder: 15234:15236 ioctl 40046207 0 returned -16 [ 520.344667] binder: 15234:15236 BC_CLEAR_DEATH_NOTIFICATION invalid ref 33554432 13:55:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000001a4"], 0x0, 0x0, 0x0}) 13:55:00 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b8cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e1300000000000000"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:55:00 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x4, 0x0, 0xf5) [ 520.505286] binder: 15251:15253 BC_CLEAR_DEATH_NOTIFICATION invalid ref 16777216 [ 520.529308] binder: BINDER_SET_CONTEXT_MGR already set [ 520.536257] binder: 15251:15253 ioctl 40046207 0 returned -16 13:55:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000020a4"], 0x0, 0x0, 0x0}) 13:55:00 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x4000, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f0000000140)={0x0}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f00000001c0)={r2, 0x94, &(0x7f0000000380)=[@in={0x2, 0x4e22, @rand_addr=0xac6}, @in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in6={0xa, 0x4e20, 0x6, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x10}}, @in={0x2, 0x4e22, @multicast1}, @in6={0xa, 0x4e20, 0x800, @mcast2, 0x6}, @in6={0xa, 0x4e21, 0x212b, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x4}]}, &(0x7f0000000200)=0x10) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r3 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r4, r3) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d097b6e700cd4de91a1f92ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0d8b518cdf620900edbb78b7559414d055deb0357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e130000000000000000"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) [ 520.642329] binder: 15262:15264 BC_CLEAR_DEATH_NOTIFICATION invalid ref 536870912 [ 520.670679] binder: BINDER_SET_CONTEXT_MGR already set 13:55:01 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0xc0000000, 0x0, 0xf5) [ 520.694393] binder: 15262:15264 ioctl 40046207 0 returned -16 13:55:01 executing program 1: r0 = gettid() syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:55:01 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') bind$alg(r1, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'authencesn(sha384-ssse3,ctr-des3_ede-asm)\x00'}, 0x58) exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:55:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c40007a0000a4"], 0x0, 0x0, 0x0}) [ 521.010126] binder: 15282:15283 BC_CLEAR_DEATH_NOTIFICATION invalid ref 31232 [ 521.023386] binder: BINDER_SET_CONTEXT_MGR already set [ 521.029151] binder: 15282:15283 ioctl 40046207 0 returned -16 13:55:04 executing program 4: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='ns\x00') fchdir(r0) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) write$evdev(r1, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vcs\x00', 0x20400003, 0x0) ioctl$TCSETAW(r2, 0x5407, &(0x7f0000000480)={0x3, 0x9, 0x40, 0x9, 0x6, 0x7, 0x3, 0xfff, 0x4aec, 0xfffffffffffffffe}) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r2, 0x84, 0x20, &(0x7f0000000740), &(0x7f0000000780)=0x4) r3 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x7, 0x5) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) r4 = getpid() sched_setscheduler(r4, 0x5, &(0x7f0000000000)) ioctl$LOOP_CHANGE_FD(r3, 0x127f, 0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x10, 0x1000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000000540), 0x0, 0x4000, 0x0, 0x0) r5 = getpgid(0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x2, 0xffffffffffffff29, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r5, 0x0, 0xffffffffffffffff, 0x0) r6 = openat$full(0xffffffffffffff9c, &(0x7f0000000440)='/dev/full\x00', 0x200242, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000000500)={0x0, 0x18, 0xfa00, {0x20003, &(0x7f0000000b00)={0xffffffffffffffff}, 0x13b, 0x6}}, 0x20) syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x36, 0x204000) write$RDMA_USER_CM_CMD_RESOLVE_IP(r6, &(0x7f0000000580)={0x3, 0x40, 0xfa00, {{0xa, 0x4e22, 0xb9d, @loopback}, {0xa, 0x4e24, 0x3, @local, 0x38}, r7, 0x7f}}, 0x48) r8 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r9 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000008c0)='/dev/ptmx\x00', 0x40000, 0x0) ioctl$TIOCSETD(r9, 0x5423, &(0x7f00000000c0)=0x3) r10 = memfd_create(&(0x7f0000000080)='vW\x87\xe1\xb1\x18\xfb\x00\x00\x00', 0x3) openat(r10, &(0x7f0000000280)='./file0\x00', 0x101000, 0x80) r11 = openat$ppp(0xffffffffffffff9c, &(0x7f00003dd000)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r11, 0x40047438, &(0x7f0000000180)=""/246) write$RDMA_USER_CM_CMD_CREATE_ID(r8, &(0x7f0000000100)={0x0, 0xfffffffffffffeaf, 0xfa00, {0xfffffffffffffffe, &(0x7f0000000240), 0x13f}}, 0xfffffe78) 13:55:04 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) set_mempolicy(0x8000, &(0x7f0000000040)=0x4dc, 0xffffffff) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:55:04 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0xffefffffff7f0000, 0x0, 0xf5) 13:55:04 executing program 1: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x100004000000000, 0x0, 0x0, 0xf5) 13:55:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000600a4"], 0x0, 0x0, 0x0}) 13:55:04 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getpeername$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000000c0)=0x14) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'vxcan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'ip6tnl0\x00', 0x0}) accept4$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000300)=0x14, 0x80000) getsockopt$inet6_mreq(r1, 0x29, 0x15, &(0x7f00000026c0)={@mcast1, 0x0}, &(0x7f0000002700)=0x14) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000002740)={{{@in=@empty, @in6=@ipv4={[], [], @local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@loopback}}, &(0x7f0000002840)=0xe8) accept$packet(r1, &(0x7f000000b600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f000000b640)=0x14) getpeername$packet(r1, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f000000b6c0)=0x14) getsockname$packet(r1, &(0x7f000000b700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f000000b740)=0x14) getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f0000010740)={@broadcast, @empty, 0x0}, &(0x7f0000010780)=0xc) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000010900)={{{@in=@empty, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@loopback}}, &(0x7f0000010a00)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000010a40)={{{@in=@broadcast, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@initdev}}, &(0x7f0000010b40)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000010bc0)={'team0\x00', 0x0}) recvmsg$kcm(r1, &(0x7f0000012100)={&(0x7f0000010c00)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x80, &(0x7f0000012000)=[{&(0x7f0000010c80)=""/248, 0xf8}, {&(0x7f0000010d80)=""/245, 0xf5}, {&(0x7f0000010e80)=""/4096, 0x1000}, {&(0x7f0000011e80)=""/198, 0xc6}, {&(0x7f0000011f80)=""/70, 0x46}], 0x5, &(0x7f0000012080)=""/126, 0x7e}, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000012140)={'team0\x00', 0x0}) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000121c0)={{{@in6=@dev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@loopback}}, &(0x7f00000122c0)=0xe8) recvmmsg(r1, &(0x7f0000015980)=[{{&(0x7f0000012300)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, 0x80, &(0x7f00000145c0)=[{&(0x7f0000012380)=""/4096, 0x1000}, {&(0x7f0000013380)=""/33, 0x21}, {&(0x7f00000133c0)=""/243, 0xf3}, {&(0x7f00000134c0)=""/251, 0xfb}, {&(0x7f00000135c0)=""/4096, 0x1000}], 0x5, &(0x7f0000014640)=""/4096, 0x1000}, 0x4}, {{&(0x7f0000015640)=@hci={0x1f, 0x0}, 0x80, &(0x7f0000015940)=[{&(0x7f00000156c0)=""/158, 0x9e}, {&(0x7f0000015780)=""/20, 0x14}, {&(0x7f00000157c0)=""/154, 0x9a}, {&(0x7f0000015880)=""/182, 0xb6}], 0x4}, 0x100000000}], 0x2, 0x40, &(0x7f0000015a00)={0x0, 0x1c9c380}) getsockname$packet(r1, &(0x7f0000015a40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000015a80)=0x14) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000015ac0)={'veth1_to_hsr\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000015b00)={'vcan0\x00', 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000015b40)={{{@in6=@mcast1, @in6=@ipv4={[], [], @dev}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@remote}}, &(0x7f0000015c40)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000015f80)={{{@in6=@ipv4={[], [], @loopback}, @in6=@ipv4={[], [], @multicast1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}}}, &(0x7f0000016080)=0xe8) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000160c0)={'vcan0\x00', 0x0}) getpeername$packet(r1, &(0x7f0000016100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000016140)=0x14) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000016180)={0x0, @local, @local}, &(0x7f00000161c0)=0xc) accept4(r1, &(0x7f0000016200)=@hci={0x1f, 0x0}, &(0x7f0000016280)=0x80, 0x80000) getsockopt$inet_mreqn(r1, 0x0, 0x24, &(0x7f00000162c0)={@broadcast, @remote, 0x0}, &(0x7f0000016300)=0xc) recvmsg$kcm(r1, &(0x7f0000017840)={&(0x7f0000016380)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f00000167c0)=[{&(0x7f0000016400)=""/101, 0x65}, {&(0x7f0000016480)=""/37, 0x25}, {&(0x7f00000164c0)=""/48, 0x30}, {&(0x7f0000016500)=""/232, 0xe8}, {&(0x7f0000016600)=""/171, 0xab}, {&(0x7f00000166c0)=""/185, 0xb9}, {&(0x7f0000016780)=""/28, 0x1c}], 0x7, &(0x7f0000016840)=""/4096, 0x1000}, 0x40000000) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000017880)={{{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@mcast1}}, &(0x7f0000017980)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000179c0)={{{@in6=@dev, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@local}}, &(0x7f0000017ac0)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000017d80)={{{@in6=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6}}, &(0x7f0000017e80)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000017ec0)={{{@in=@multicast2, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@remote}}, &(0x7f0000017fc0)=0xe8) sendmsg$TEAM_CMD_NOOP(r1, &(0x7f0000018c80)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000018c40)={&(0x7f0000001740)=ANY=[@ANYBLOB="180c0000", @ANYRES16=r2, @ANYBLOB="000329bd7000ffdbdf250000000008000100", @ANYRES32=r3, @ANYBLOB="0402020040000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e000000080004002000000008000600", @ANYRES32=r4, @ANYBLOB="40000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000080003000300000008000400", @ANYRES32=r5, @ANYBLOB="08000700000000004c000100240001006c625f74785f6d6574686f64000000000000000000000000000000000000000008000300050000001c000400686173685f746f5f706f72745f6d617070696e670000000044000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b000000140004000800200200000000010002350200000038000100240001006e6f746966795f70656572735f696e74657276616c0000000000000000000000080003000300000008000400080000003c000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b0000000c0004000700da07040000003c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000008000300060000000400040008000600", @ANYRES32=r6, @ANYBLOB="40000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000080003000300000008000400", @ANYRES32=r7, @ANYBLOB="080007000000000008000100", @ANYRES32=r8, @ANYBLOB="780002003c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000008000300060000000400040008000600", @ANYRES32=r9, @ANYBLOB="3800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r10, @ANYBLOB="08000100", @ANYRES32=r11, @ANYBLOB="180102003c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r12, @ANYBLOB="3800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r13, @ANYBLOB="54000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b00000024000400faffae01000000000000ff81010100008c00ae020100000002000081bd0000004c000100240001006c625f74785f6d6574686f64000000000000000000000000000000000000000008000300050000001c000400686173685f746f5f706f72745f6d617070696e670000000008000100", @ANYRES32=r14, @ANYBLOB="6001020038000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000080003000300000008000400a30000003c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r15, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f636f756e740000000000000000000000000000080003000300000008000400e300000038000100240001006e6f746966795f70656572735f636f756e7400000000000000000000000000000800030003000000080004000200000040000100240001006c625f706f72745f737461747300000000000000000000000000000000000000080003000b000000080004000010000008000600", @ANYRES32=r16, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f636f756e740000000000000000000000000000080003000300000008000400d021000008000100", @ANYRES32=r17, @ANYBLOB="2401020038000100240001006e6f746966795f70656572735f696e74657276616c00000000000000000000000800030003000000080004000200000040000100240001006c625f686173685f737461747300000000000000000000000000000000000000080003000b00000008000400f7ffffff080007000000000038000100240001006e6f746966795f70656572735f636f756e7400000000000000000000000000000800030003000000080004000900000038000100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000800030003000000080004000700000038000100240001006e6f746966795f70656572735f696e74657276616c00000000000000000000000800030003000000080004000600000008000100", @ANYRES32=r18, @ANYBLOB="8400020040000100240001006d6f64650000000000000000000000000000000000000000000000000000000008000300050000001000040062726f61646361737400000040000100240001006c625f706f72745f737461747300000000000000000000000000000000000000080003000b000000080004000600000008000600", @ANYRES32=r19, @ANYBLOB="08000100", @ANYRES32=r20, @ANYBLOB="f001020040000100240001006c625f706f72745f737461747300000000000000000000000000000000000000080003000b00000008000400052f000008000600", @ANYRES32=r21, @ANYBLOB="3c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r22, @ANYBLOB="38000100240001006c625f73746174735f726566726573685f696e74657276616c00000000000000080003000300000008000400f7ef00003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r23, @ANYBLOB="40000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e000000080004002000000008000600", @ANYRES32=r24, @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c656400000000000000c75f2d57893cc478f5aa0c632700000000000008000300060000000400040008000600", @ANYRES32=r25, @ANYBLOB="40000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e000000080004000900000008000600", @ANYRES32=r26, @ANYBLOB="40000100240001006c625f706f72745f737461747300000000000000000000000000000000000000080003000b00000008000400fdffffff08000600", @ANYRES32=r27, @ANYBLOB="08000100", @ANYRES32=r28, @ANYBLOB="ac00020038000100240001006e6f746966795f70656572735f696e74657276616c00000000000000000000000800030003000000080004000400000038000100240001006d636173745f72656a6f696e5f636f756e740000000000000000000000000000480003000300000008000400b11d000038000100240001006d636173745e72656a6f696e5f696e74657276616c00000000000000000000000800030003000000080004000500000008e1efccfd7ade1e272e5d2457f3ae5d79b28597022d9ad7753f9913457759f9c0ab43e0a9df47c5d518c77b94138bc8247f9439b82a7f4e2fbc29d7f7bf709348d2bea7f9b17e9ad8047bab5c56ead7fa022fa52b660c606921da4c5f6b8a85887f47d352e45066eeccd6062aec3be13a2593ea31c2fdfb3efeec95e4f7db6cbd6805ddd0e75d7918a87ecce73b27ecda66686f02b5e461ca0f69d4a8e6937f9745dd9722d14230c16bf2a5100e4f10f3b61c3604b36980de3738366a1bd3f33ab5aa1605f03633d8842c262da5fbe40c50", @ANYRES32=r29, @ANYBLOB="0400020008000100", @ANYRES32=r30, @ANYBLOB="7802020044000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b00000014000400020005ab00000100080039030300000040000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e000000080004000300000008000600", @ANYRES32=r31, @ANYBLOB="40000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000080003000300000008000400", @ANYRES32=r32, @ANYBLOB="0800070000000000400001002400010071756575655f69640000000000000000000000000000000000000000000000000800030003000000080004000700000008000600", @ANYRES32=r33, @ANYBLOB="38000100240001006e6f746966795f70656572735f636f756e7400000000000000000000000000000800030003000000080004000000008044000100240001006d6f6465000000000000000000000000000000000000000000000000000000000800030005000000140004006163746976656261636b75700000000038000100240001006e6f746966795f70656572735f636f756e7400000000000000000000000000000800030003000000080004000900000044000100240001006d6f6465000000000000000000000000000000000000000000000000000000000800030005000000140004006163746976656261636b757000000000400001002400010071756575655f69640000000000000000000000000000000000000000000000000800030003000000080004000800000008000600", @ANYRES32=r34, @ANYBLOB="38000100240001006e6f746966795f70656572735f696e74657276616c000000000000000000000008000300030000000800040071060000"], 0xc18}, 0x1, 0x0, 0x0, 0x20000800}, 0x40000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r35, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') [ 524.193105] binder: 15303:15305 BC_CLEAR_DEATH_NOTIFICATION invalid ref 393216 [ 524.218823] binder: BINDER_SET_CONTEXT_MGR already set 13:55:04 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r3, 0x84, 0x13, &(0x7f0000000040)={0x0}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r3, 0x84, 0x77, &(0x7f0000000180)={r4, 0xf9f1, 0x1, [0x1c]}, 0xa) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) [ 524.261624] binder: 15303:15305 ioctl 40046207 0 returned -16 13:55:04 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x100008000000000, 0x0, 0xf5) 13:55:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000100000a4"], 0x0, 0x0, 0x0}) 13:55:04 executing program 1: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='ns\x00') r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000180)='./control\x00', 0x0) mmap(&(0x7f0000010000/0x2000)=nil, 0x2000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='oom_score\x00') getpgrp(0xffffffffffffffff) signalfd(r2, 0x0, 0x0) readv(r1, &(0x7f0000000680)=[{&(0x7f00000002c0)=""/101, 0x65}, {&(0x7f00000005c0)=""/173, 0xad}, {&(0x7f0000000080)=""/38, 0x26}, {&(0x7f0000000400)=""/88, 0x58}, {&(0x7f00000008c0)=""/240, 0xf0}, {&(0x7f0000000140)=""/18, 0x12}], 0x6) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000480)) unshare(0x60000) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(&(0x7f000000a000), &(0x7f0000000180)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, &(0x7f000000a000)) chdir(&(0x7f0000000000)='./file0\x00') r3 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r3, 0x208200) r4 = open(&(0x7f0000000780)='./bus\x00', 0x2f, 0x0) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r4, 0x84, 0x77, &(0x7f0000000340)={0x0, 0x0, 0x1, [0x0]}, 0xa) ftruncate(r1, 0xfffffffffffffffd) creat(&(0x7f00000001c0)='./bus\x00', 0x0) statx(0xffffffffffffffff, &(0x7f00000003c0)='./control/file0\x00', 0x0, 0x0, 0x0) fchmod(r3, 0x28) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) r5 = creat(0x0, 0x0) write$sndseq(r5, &(0x7f0000011fd2), 0x0) unlink(&(0x7f0000000200)='./control/file0\x00') ioctl$EVIOCSABS0(r5, 0x401845c0, &(0x7f0000000100)={0x0, 0x2, 0x0, 0x7fffffff, 0x0, 0x9}) unlinkat(r3, &(0x7f0000000280)='./bus\x00', 0x0) fchdir(r0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) 13:55:04 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r4, r2) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000200)={0x0}, &(0x7f0000000180)=0xc) fcntl$setownex(r3, 0xf, &(0x7f00000001c0)={0x0, r5}) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) [ 524.446869] binder: 15326:15327 BC_CLEAR_DEATH_NOTIFICATION invalid ref 4096 [ 524.502675] binder: BINDER_SET_CONTEXT_MGR already set [ 524.532181] binder: 15326:15327 ioctl 40046207 0 returned -16 13:55:04 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x20710000000000, 0x0, 0xf5) [ 524.644786] audit: type=1804 audit(1546178105.001:38): pid=15331 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor1" name="/newroot/380/file0/bus" dev="ramfs" ino=75036 res=1 13:55:06 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x1, 0x1, 0x7ff, 0x2000000, 0x0, 0x0, 0x100000001}) r1 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x100000000, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r1, 0x40045542, &(0x7f0000000200)=0x2) creat(&(0x7f0000000240)='./bus\x00', 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="92a0a7a6c98c0100006ac4990247383504f2ffffff000100000065750ede825e45a9500aaf3e339af75e3af0955881d50f3d09876e700cd4de91a1f989377036e09523b16ed90a205c7333bb937deea9a381d4e8d8be86ba28d4b2921ea4e21686a91c0900edbbc729101420bd1ebaca357df02d2eed24a7c27189c3003b"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:55:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000030000a4"], 0x0, 0x0, 0x0}) 13:55:06 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x80000008, 0x0, 0xf5) 13:55:06 executing program 5: r0 = gettid() r1 = syz_open_dev$media(&(0x7f0000000140)='/dev/media#\x00', 0x9, 0x40) ioctl$KVM_RUN(r1, 0xae80, 0x0) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000180)={0x0}) ioctl$DRM_IOCTL_RM_CTX(r1, 0xc0086421, &(0x7f00000001c0)={r2, 0x3}) r3 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) write$nbd(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="6744669801000000030000000800000000000000906f8a6492e1e90b111ea44dbf00739717fdb5ca6f9eab2d77964b51b53073b605f66a4d1b0428304e2952f1c7a4a4c1413cbd84d26471d5e4"], 0x4d) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$DRM_IOCTL_AGP_ALLOC(r3, 0xc0206434, &(0x7f0000000080)={0x2, 0x0, 0x10001, 0x98cc}) ioctl$DRM_IOCTL_AGP_BIND(r3, 0x40106436, &(0x7f00000000c0)={r4, 0x9}) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:55:06 executing program 4: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000140)) fcntl$getown(r0, 0x9) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000200)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000240)=0x0) r2 = syz_open_procfs(r1, &(0x7f00000001c0)='net/arp\x00') fchdir(r2) r3 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) write$evdev(r3, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) read$FUSE(r2, &(0x7f0000000280), 0x1000) ioctl$TIOCLINUX4(r2, 0x541c, &(0x7f0000000080)) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) 13:55:06 executing program 1: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='ns\x00') r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000180)='./control\x00', 0x0) mmap(&(0x7f0000010000/0x2000)=nil, 0x2000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='oom_score\x00') getpgrp(0xffffffffffffffff) signalfd(r2, 0x0, 0x0) readv(r1, &(0x7f0000000680)=[{&(0x7f00000002c0)=""/101, 0x65}, {&(0x7f00000005c0)=""/173, 0xad}, {&(0x7f0000000080)=""/38, 0x26}, {&(0x7f0000000400)=""/88, 0x58}, {&(0x7f00000008c0)=""/240, 0xf0}, {&(0x7f0000000140)=""/18, 0x12}], 0x6) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000480)) unshare(0x60000) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(&(0x7f000000a000), &(0x7f0000000180)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, &(0x7f000000a000)) chdir(&(0x7f0000000000)='./file0\x00') r3 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r3, 0x208200) r4 = open(&(0x7f0000000780)='./bus\x00', 0x2f, 0x0) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r4, 0x84, 0x77, &(0x7f0000000340)={0x0, 0x0, 0x1, [0x0]}, 0xa) ftruncate(r1, 0xfffffffffffffffd) creat(&(0x7f00000001c0)='./bus\x00', 0x0) statx(0xffffffffffffffff, &(0x7f00000003c0)='./control/file0\x00', 0x0, 0x0, 0x0) fchmod(r3, 0x28) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) r5 = creat(0x0, 0x0) write$sndseq(r5, &(0x7f0000011fd2), 0x0) unlink(&(0x7f0000000200)='./control/file0\x00') ioctl$EVIOCSABS0(r5, 0x401845c0, &(0x7f0000000100)={0x0, 0x2, 0x0, 0x7fffffff, 0x0, 0x9}) unlinkat(r3, &(0x7f0000000280)='./bus\x00', 0x0) fchdir(r0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) [ 526.497925] binder: 15353:15362 BC_CLEAR_DEATH_NOTIFICATION invalid ref 768 13:55:06 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0x2, 0x0, 0x2000000000000, 0x40, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000380)=@security={'security\x00', 0xe, 0x4, 0x410, 0x228, 0x130, 0x228, 0x0, 0x0, 0x378, 0x378, 0x378, 0x378, 0x378, 0x4, &(0x7f0000000040), {[{{@ip={@multicast2, @empty, 0xff000000, 0xffffffff, 'team0\x00', 'veth0_to_team\x00', {0xff}, {}, 0x0, 0x2}, 0x0, 0xf0, 0x130, 0x0, {}, [@common=@ah={0x30, 'ah\x00', 0x0, {0x2, 0x2}}, @common=@icmp={0x28, 'icmp\x00', 0x0, {0x1f, 0x80000000, 0x4, 0x1}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x7, 0xfffffffffffffff7, 0x367}}}, {{@ip={@broadcast, @empty, 0xffffff00, 0xff, 'lapb0\x00', 'netdevsim0\x00', {}, {}, 0x2e, 0x2, 0x48}, 0x0, 0x98, 0xf8}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast, 0xffffffff80000000, 0x6, [0xb, 0x3b, 0x3b, 0xb, 0xd, 0x25, 0x2e, 0x3f, 0x3f, 0x7, 0x14, 0x37, 0x29, 0x9, 0x3e], 0x0, 0xfffffffffffffffe, 0x93fb}}}, {{@uncond, 0x0, 0xf0, 0x150, 0x0, {}, [@common=@ah={0x30, 'ah\x00', 0x0, {0xe8, 0x7f}}, @common=@ttl={0x28, 'ttl\x00', 0x0, {0x3, 0x6}}]}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@multicast1, [0xff000000, 0xff, 0xff000000, 0xff], 0x4e21, 0x4e22, 0x4e22, 0x4e22, 0x14f1, 0xffffffff, 0x1, 0x8, 0x8}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x470) write(r0, &(0x7f0000000180)="f20e67ca01729084d4d7afc0eba3352c1c7821bb98d3ee1c66de80e45b56b007dcb0b61b5efcfc929b415e47840531977606bcf0df91a2baca6df62b5b9ca4d77e75297265c6434e3a97560f4927e5e69da60a7736c53d1513ecf50e923d1ee32b98b835df74a03400f7153cf736c0b8bce1eeafe30cb8de26851ec7ef18f1b7139798dbc121c6dd91", 0x89) write$binfmt_aout(r0, &(0x7f0000000800)=ANY=[@ANYBLOB="92a0a7a6c98c010000040000000000fe109a37a6eeca97825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e138c1d81df7257892fd78f2f85027f8340c46d782694d2d5ef363e82398c3f45c56bbad21e17750383e3c38a78c154766fb88f3153ef87fb7919685881e512b30cc2ada7fa1d447f270346a809d0ae38a73f0d0fad9855a95f1a1fb3de125bdd28ce33651b41fb9068ad8e38a339aeedb636c4980bb53543719d2299b651c1d36e36a12544f581bef634e8478c97769984487281bed9672593eb4169f52818ebe6824b4c5ae12dc8e39c752a9189983de77c0cd7ddfccb2dcedb54a75003f0c4ef135670685d416547c7fbe4ebe88b9eb1ab0bbaf58b00dfb40979cbaee42296f54463b1ef9b039d86921eb2109879823715f45786301d570465e06adc9f55a028d175ff0500000000000000666f2d284e51c5563baeb11abd297fb03402cc49dac8ed85cd2bbfd7759c493efe1de546224ddb7bde5ef848c40800000000"], 0x7e) getsockopt$netlink(r3, 0x10e, 0x3, &(0x7f0000000140)=""/38, &(0x7f0000000280)=0x26) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) [ 526.541885] binder: 15353:15369 BC_CLEAR_DEATH_NOTIFICATION invalid ref 768 [ 526.545145] binder: BINDER_SET_CONTEXT_MGR already set [ 526.595360] audit: type=1804 audit(1546178106.951:39): pid=15356 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor1" name="/newroot/381/file0/bus" dev="ramfs" ino=75083 res=1 [ 526.626056] binder: 15353:15362 ioctl 40046207 0 returned -16 13:55:07 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x40000001, 0x0, 0xf5) 13:55:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000002000a4"], 0x0, 0x0, 0x0}) 13:55:07 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r1, 0x84, 0x70, &(0x7f0000000140)={0x0, @in={{0x2, 0x4e22, @loopback}}, [0xfffffffffffffff7, 0x3, 0x4, 0x1fffe, 0x1ff, 0x3, 0x8, 0x8, 0x800, 0xfffffffffffffff9, 0x7f, 0x8754, 0x9, 0x5, 0x232b]}, &(0x7f0000000040)=0x100) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r2, 0x84, 0x66, &(0x7f0000000280)={r3, 0x3}, &(0x7f00000002c0)=0x8) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r4, r2) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) [ 526.801956] binder: 15378:15381 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2097152 [ 526.860023] binder: BINDER_SET_CONTEXT_MGR already set [ 526.906975] binder: 15378:15381 ioctl 40046207 0 returned -16 13:55:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000500a4"], 0x0, 0x0, 0x0}) 13:55:07 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0xa00000000000000, 0x0, 0xf5) 13:55:07 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r3, r2) stat(&(0x7f0000000140)='./bus\x00', &(0x7f0000000180)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r1, 0x80045700, &(0x7f0000000040)) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e130000000000000000000000"], 0x7e) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000200)={0x0, r1, 0x400, 0x80000001, 0x401, 0x8}) fsetxattr$trusted_overlay_opaque(r1, &(0x7f0000000280)='trusted.overlay.opaque\x00', &(0x7f00000002c0)='y\x00', 0x2, 0x1) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) [ 527.069000] binder: 15390:15391 BC_CLEAR_DEATH_NOTIFICATION invalid ref 327680 [ 527.126695] binder: BINDER_SET_CONTEXT_MGR already set [ 527.147273] binder: 15390:15391 ioctl 40046207 0 returned -16 13:55:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c40004c0000a4"], 0x0, 0x0, 0x0}) 13:55:07 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000140)='./bus\x00', 0x14) r1 = gettid() syz_open_procfs(r1, &(0x7f00000001c0)='net/fib_triestat\x00') ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x4, 0x9, 0x8, 0x3, 0x1a, 0x3, 0x4, 0x8, 0x8, 0x1}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket$unix(0x1, 0x400040000000001, 0x0) bind$unix(r4, &(0x7f0000003000)=@abs={0x1}, 0x8) listen(r4, 0x0) connect(r3, &(0x7f0000985ff8)=@un=@abs={0x1}, 0x8) r5 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/unix\x00') sendfile(r3, r5, 0x0, 0x800000bf) r6 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r7, r6) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8916, &(0x7f0000000180)={'veth1\x00', {0x2, 0x4e22, @remote}}) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) [ 527.309625] binder: 15401:15403 BC_CLEAR_DEATH_NOTIFICATION invalid ref 19456 13:55:07 executing program 5: r0 = socket$inet6_dccp(0xa, 0x6, 0x0) r1 = accept(0xffffffffffffffff, &(0x7f0000000000)=@alg, &(0x7f0000000080)=0x80) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f00000000c0)={0x0, r1, 0x80000001, 0x20, 0x7, 0x666}) syz_open_dev$usb(&(0x7f0000000140)='/dev/bus/usb/00#/00#\x00', 0x755a, 0x0) r2 = gettid() syz_open_procfs(r2, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') [ 527.366449] binder: BINDER_SET_CONTEXT_MGR already set [ 527.391485] binder: 15401:15403 ioctl 40046207 0 returned -16 13:55:10 executing program 4: perf_event_open$cgroup(&(0x7f0000000180)={0x3, 0x70, 0x5, 0x101, 0xaa, 0x20, 0x0, 0x1f, 0x0, 0x1, 0x9, 0x401, 0x8, 0x8, 0x1, 0x2, 0x809e, 0x0, 0x5, 0x6, 0x4, 0x89c, 0x5, 0xb7, 0x2, 0x4, 0x3, 0x2, 0xec, 0x8, 0x200, 0x4, 0x2, 0x9, 0x83e, 0x800, 0x101, 0x2, 0x0, 0x1, 0x7, @perf_config_ext={0x0, 0x6}, 0x5120, 0x80000000000000, 0x4, 0x1, 0x39, 0x2, 0x4}, 0xffffffffffffff9c, 0xa, 0xffffffffffffff9c, 0x6) r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vfio/vfio\x00', 0x14b000, 0x0) r1 = perf_event_open(0x0, 0x0, 0x0, r0, 0x1) r2 = dup(r1) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) write$evdev(r2, &(0x7f0000000100)=[{{0x77359400}, 0x3fe1b02fbfd7adc9, 0x7, 0x8}, {{r3, r4/1000+10000}, 0x15, 0xfffffffffffffff8, 0x7f}, {{}, 0x3, 0x8001, 0x93e}], 0x48) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='ns\x00') fchdir(r5) getsockopt$inet6_mtu(r2, 0x29, 0x17, &(0x7f0000000240), &(0x7f0000000280)=0x4) r6 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) write$evdev(r6, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) 13:55:10 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0xd00, 0x0, 0xf5) 13:55:10 executing program 1: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='ns\x00') fchdir(r0) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) write$evdev(r1, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vcs\x00', 0x20400003, 0x0) ioctl$TCSETAW(r2, 0x5407, &(0x7f0000000480)={0x3, 0x9, 0x40, 0x9, 0x6, 0x7, 0x3, 0xfff, 0x4aec, 0xfffffffffffffffe}) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r2, 0x84, 0x20, &(0x7f0000000740), &(0x7f0000000780)=0x4) r3 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x7, 0x5) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) r4 = getpid() sched_setscheduler(r4, 0x5, &(0x7f0000000000)) ioctl$LOOP_CHANGE_FD(r3, 0x127f, 0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x10, 0x1000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000000540), 0x0, 0x4000, 0x0, 0x0) r5 = getpgid(0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x2, 0xffffffffffffff29, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r5, 0x0, 0xffffffffffffffff, 0x0) r6 = openat$full(0xffffffffffffff9c, &(0x7f0000000440)='/dev/full\x00', 0x200242, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000000500)={0x0, 0x18, 0xfa00, {0x20003, &(0x7f0000000b00)={0xffffffffffffffff}, 0x13b, 0x6}}, 0x20) syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x36, 0x204000) write$RDMA_USER_CM_CMD_RESOLVE_IP(r6, &(0x7f0000000580)={0x3, 0x40, 0xfa00, {{0xa, 0x4e22, 0xb9d, @loopback}, {0xa, 0x4e24, 0x3, @local, 0x38}, r7, 0x7f}}, 0x48) r8 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r9 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000008c0)='/dev/ptmx\x00', 0x40000, 0x0) ioctl$TIOCSETD(r9, 0x5423, &(0x7f00000000c0)=0x3) r10 = memfd_create(&(0x7f0000000080)='vW\x87\xe1\xb1\x18\xfb\x00\x00\x00', 0x3) openat(r10, &(0x7f0000000280)='./file0\x00', 0x101000, 0x80) r11 = openat$ppp(0xffffffffffffff9c, &(0x7f00003dd000)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r11, 0x40047438, &(0x7f0000000180)=""/246) write$RDMA_USER_CM_CMD_CREATE_ID(r8, &(0x7f0000000100)={0x0, 0xfffffffffffffeaf, 0xfa00, {0xfffffffffffffffe, &(0x7f0000000240), 0x13f}}, 0xfffffe78) 13:55:10 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f99f37702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:55:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000060000a4"], 0x0, 0x0, 0x0}) 13:55:10 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) bind$rds(r1, &(0x7f0000000000)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xb}}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') [ 530.490598] binder: 15428:15433 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1536 [ 530.520919] binder: BINDER_SET_CONTEXT_MGR already set 13:55:10 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) write$P9_RLOCK(r1, &(0x7f0000000040)={0x8, 0x35, 0x1, 0x3}, 0x8) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) ioctl$KDGKBDIACR(r4, 0x4b4a, &(0x7f0000000140)=""/214) [ 530.535906] binder: 15428:15433 ioctl 40046207 0 returned -16 13:55:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c400000a400a4"], 0x0, 0x0, 0x0}) 13:55:11 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0xfffffdfd, 0x0, 0xf5) [ 530.675027] binder: 15452:15454 BC_CLEAR_DEATH_NOTIFICATION invalid ref 10747904 [ 530.717324] binder: BINDER_SET_CONTEXT_MGR already set [ 530.730670] binder: 15452:15454 ioctl 40046207 0 returned -16 13:55:11 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0xfff}) openat$dsp(0xffffffffffffff9c, &(0x7f0000000280)='/dev/dsp\x00', 0x40, 0x0) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r3, r2) ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, &(0x7f0000000040)={0xdb, 0x0, 0x200, 0xb73a, "090063e555244153aca461f2d69debed0e63ee556d1a879af18fb6cc4ba64cc7"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write(r0, &(0x7f0000000200)="4456da0c654435d8000000d941", 0x223) write$binfmt_aout(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a11c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdaeb9ace1312b23fb49dc324efa69c72000000000000000710e13"], 0x7e) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000440)={{{@in=@multicast2, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in6}}, &(0x7f0000000540)=0xe8) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x1, 0x4, &(0x7f00000002c0)=@raw=[@jmp={0x5, 0x0, 0x5, 0xf, 0xa, 0x80, 0xffffffffffffffff}, @alu={0x4, 0x101, 0x7, 0x1, 0x6, 0x10e, 0xffffffffffffffff}, @alu={0x7, 0x7, 0x9, 0x3, 0xb, 0xfffffffffffffff6, 0xffffffffffffffff}, @jmp={0x5, 0x10001, 0x7, 0x0, 0xf, 0x20, 0xfffffffffffffff0}], &(0x7f0000000300)='syzkaller\x00', 0x9, 0x24, &(0x7f0000000340)=""/36, 0x41000, 0x1, [], r4, 0x1}, 0x48) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:55:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000700a4"], 0x0, 0x0, 0x0}) 13:55:11 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x100004000000000, 0x0, 0xf5) [ 530.860378] binder: 15465:15466 BC_CLEAR_DEATH_NOTIFICATION invalid ref 458752 [ 530.892888] binder: BINDER_SET_CONTEXT_MGR already set [ 530.901575] binder: 15465:15466 ioctl 40046207 0 returned -16 13:55:11 executing program 4: syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x1, 0x80) fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000100)={0x0, 0x0}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000140)='/dev/btrfs-control\x00', 0x8c000, 0x0) perf_event_open(0x0, r0, 0x0, r1, 0x3) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='ns\x00') fchdir(r2) r3 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) write$evdev(r3, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) 13:55:11 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) 13:55:13 executing program 1: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='ns\x00') fchdir(r0) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) write$evdev(r1, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vcs\x00', 0x20400003, 0x0) ioctl$TCSETAW(r2, 0x5407, &(0x7f0000000480)={0x3, 0x9, 0x40, 0x9, 0x6, 0x7, 0x3, 0xfff, 0x4aec, 0xfffffffffffffffe}) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r2, 0x84, 0x20, &(0x7f0000000740), &(0x7f0000000780)=0x4) r3 = syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x7, 0x5) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) r4 = getpid() sched_setscheduler(r4, 0x5, &(0x7f0000000000)) ioctl$LOOP_CHANGE_FD(r3, 0x127f, 0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x10, 0x1000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000000540), 0x0, 0x4000, 0x0, 0x0) r5 = getpgid(0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x2, 0xffffffffffffff29, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r5, 0x0, 0xffffffffffffffff, 0x0) r6 = openat$full(0xffffffffffffff9c, &(0x7f0000000440)='/dev/full\x00', 0x200242, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000000500)={0x0, 0x18, 0xfa00, {0x20003, &(0x7f0000000b00)={0xffffffffffffffff}, 0x13b, 0x6}}, 0x20) syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x36, 0x204000) write$RDMA_USER_CM_CMD_RESOLVE_IP(r6, &(0x7f0000000580)={0x3, 0x40, 0xfa00, {{0xa, 0x4e22, 0xb9d, @loopback}, {0xa, 0x4e24, 0x3, @local, 0x38}, r7, 0x7f}}, 0x48) r8 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r9 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000008c0)='/dev/ptmx\x00', 0x40000, 0x0) ioctl$TIOCSETD(r9, 0x5423, &(0x7f00000000c0)=0x3) r10 = memfd_create(&(0x7f0000000080)='vW\x87\xe1\xb1\x18\xfb\x00\x00\x00', 0x3) openat(r10, &(0x7f0000000280)='./file0\x00', 0x101000, 0x80) r11 = openat$ppp(0xffffffffffffff9c, &(0x7f00003dd000)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r11, 0x40047438, &(0x7f0000000180)=""/246) write$RDMA_USER_CM_CMD_CREATE_ID(r8, &(0x7f0000000100)={0x0, 0xfffffffffffffeaf, 0xfa00, {0xfffffffffffffffe, &(0x7f0000000240), 0x13f}}, 0xfffffe78) 13:55:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000070000a4"], 0x0, 0x0, 0x0}) 13:55:13 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x600000000000000, 0x0, 0xf5) 13:55:13 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:55:13 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x2080, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e138faaf3408a098c0516be35e7d921a1b8bef54628482bf773437a554533aa20a63a7b593478cbc8758fa047"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:55:13 executing program 4: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='ns\x00') syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0xcb4a, 0x1c000) fchdir(r0) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) write$evdev(r1, &(0x7f0000000100)=[{{0x77359400}, 0x0, 0xfffffffffffffffd, 0x4da}, {{}, 0xfffffffffffffffd}], 0x30) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) [ 532.706684] binder: 15495:15509 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1792 [ 532.737663] binder: BINDER_SET_CONTEXT_MGR already set 13:55:13 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0d0800000000000000edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000140)=0x14) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, &(0x7f0000000180)={@ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x24}}, r4}, 0x14) [ 532.761216] binder: 15495:15509 ioctl 40046207 0 returned -16 13:55:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000020000a4"], 0x0, 0x0, 0x0}) 13:55:13 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x10000c0, 0x0, 0xf5) 13:55:13 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) read(r0, &(0x7f0000000140)=""/120, 0x78) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:55:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000006800a4"], 0x0, 0x0, 0x0}) [ 532.932186] binder: 15526:15528 BC_CLEAR_DEATH_NOTIFICATION invalid ref 512 [ 532.950567] binder: BINDER_SET_CONTEXT_MGR already set [ 532.968532] binder: 15526:15528 ioctl 40046207 0 returned -16 [ 533.073096] binder: 15536:15537 BC_CLEAR_DEATH_NOTIFICATION invalid ref 6815744 [ 533.088494] binder: BINDER_SET_CONTEXT_MGR already set 13:55:13 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0xb000000, 0x0, 0xf5) [ 533.116505] binder: 15536:15537 ioctl 40046207 0 returned -16 13:55:15 executing program 1: r0 = creat(&(0x7f0000000180)='./bus\x00', 0x0) io_setup(0x3, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x377140be6b5ef4c7}]) utimes(&(0x7f0000000000)='./bus\x00', 0x0) creat(&(0x7f0000000100)='./bus\x00', 0x40) 13:55:15 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000040)={0x0, 0x9}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000180)=@assoc_id=r2, &(0x7f00000001c0)=0x4) r3 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r4, r3) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:55:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000003f00a4"], 0x0, 0x0, 0x0}) 13:55:15 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x200000, 0x0, 0xf5) 13:55:15 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000080)='NET_DM\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x0, 0x1, 0xf000, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:55:15 executing program 4: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='ns\x00') close(r0) fchdir(r1) r2 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) write$evdev(r2, &(0x7f0000057fa0)=[{{}, 0x0, 0x0, 0x4}, {}], 0x30) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000000140)=@sack_info={0x0, 0xffffffffffffffff, 0x1f}, &(0x7f0000000180)=0xc) socket$bt_bnep(0x1f, 0x3, 0x4) getsockopt$inet_sctp_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f00000001c0)=@assoc_value={r3, 0x1}, &(0x7f0000000200)=0x8) ioctl$sock_inet_sctp_SIOCINQ(r1, 0x541b, &(0x7f0000000100)) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000040)) [ 534.817736] binder: 15560:15561 BC_CLEAR_DEATH_NOTIFICATION invalid ref 4128768 [ 534.863375] binder: BINDER_SET_CONTEXT_MGR already set 13:55:15 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$VIDIOC_ENUMINPUT(r1, 0xc050561a, &(0x7f0000000140)={0x100000000, "e52f0c86e83326fd8dd08daa7c69b1c9054082c106a55b5babe9cc736b127913", 0x3, 0x4, 0x4, 0x400, 0x200, 0xa}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2928486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13000000faf06d22c181b94512c0fadc794cd7095019df790847e11a27fd9c992d861a0c80baf8226a19abfe3665e322049d141a877cf4d059651a174132420d0ffba795e0cf6a5b7e41db479399a435"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) [ 534.885015] binder: 15560:15561 ioctl 40046207 0 returned -16 [ 534.914291] binder: 15560:15561 BC_CLEAR_DEATH_NOTIFICATION invalid ref 4128768 13:55:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000680000a4"], 0x0, 0x0, 0x0}) 13:55:15 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0xffff8000, 0x0, 0xf5) 13:55:15 executing program 4: perf_event_open(0x0, 0x0, 0x800009, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='\'\t\xce\'Y') readv(r0, &(0x7f0000001700)=[{&(0x7f0000000280)=""/225, 0xe1}, {&(0x7f0000000380)=""/183, 0xb7}, {&(0x7f0000000440)=""/128, 0x80}, {&(0x7f00000004c0)=""/4096, 0x1000}, {&(0x7f00000014c0)=""/186, 0xba}, {&(0x7f0000001580)=""/183, 0xb7}, {&(0x7f0000001640)=""/175, 0xaf}], 0x7) fchdir(r0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000001780)=ANY=[@ANYBLOB="7f454c4605000700b20c00000000000002000300000001000000000000000000400000000000000004000000000000007389ffff01003800010006000900070007000000fe000000050000000000000000020000000000000500000000000000010000000000000008000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ede9b6aa0000000000000000000000000000000000000000000000"], 0x978) write$evdev(r0, &(0x7f0000057fa0), 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r0, 0xc0605345, &(0x7f0000000200)={0x7fff, 0x2, {0x2, 0x0, 0x6473, 0x2, 0x2}}) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() r1 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffc000/0x3000)=nil) shmctl$IPC_STAT(r1, 0x2, &(0x7f0000000100)=""/240) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) [ 535.046034] binder: 15580:15581 BC_CLEAR_DEATH_NOTIFICATION invalid ref 26624 [ 535.074673] binder: BINDER_SET_CONTEXT_MGR already set 13:55:15 executing program 4: perf_event_open(0x0, 0x0, 0xfffffffffffffffd, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='ns\x00') fchdir(r0) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) write$evdev(r1, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000040)=[0x27e, 0x8]) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) 13:55:15 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) setxattr$security_evm(&(0x7f0000000040)='./bus\x00', &(0x7f0000000140)='security.evm\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB="0414664d298a5e3521173c"], 0x4, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) [ 535.113937] binder: 15580:15581 ioctl 40046207 0 returned -16 13:55:16 executing program 1: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r0, &(0x7f0000000480)=ANY=[], 0x2e7) sendfile(r0, r0, &(0x7f0000000480), 0xa198) 13:55:16 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x1400, 0x0, 0xf5) 13:55:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000740000a4"], 0x0, 0x0, 0x0}) 13:55:16 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:55:16 executing program 5: r0 = gettid() syz_open_procfs(r0, &(0x7f0000000000)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') [ 535.677552] binder: 15607:15609 BC_CLEAR_DEATH_NOTIFICATION invalid ref 29696 [ 535.748207] binder: BINDER_SET_CONTEXT_MGR already set 13:55:16 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r1, 0x541b, &(0x7f0000000040)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) dup2(r1, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r2, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae6dc72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:55:16 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$ndb(&(0x7f0000000140)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_CLEAR_SOCK(r1, 0x1278) [ 535.793409] binder: 15607:15609 ioctl 40046207 0 returned -16 [ 535.806039] binder: 15607:15616 BC_CLEAR_DEATH_NOTIFICATION invalid ref 29696 13:55:16 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x50, 0x0, 0xf5) 13:55:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000050000a4"], 0x0, 0x0, 0x0}) 13:55:16 executing program 3: r0 = dup(0xffffffffffffff9c) ioctl$RTC_EPOCH_SET(r0, 0x4008700e, 0x3e) open_by_handle_at(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="9a"], 0x100) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x350f6a7eebb06e6c, 0x0) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r4 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x4000, 0x0) ioctl$VIDIOC_QUERYCTRL(r4, 0xc0445624, &(0x7f0000000140)={0x0, 0x3, "a9007d3bd7cd8e5013065c555266b9f30b8e94029774b1cd3b2b1b9b7702ee28", 0x0, 0x6, 0x3f, 0x9, 0x100}) write(r1, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r1, 0x5407, &(0x7f00000000c0)) [ 535.976587] binder: 15634:15635 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1280 [ 535.994042] binder: BINDER_SET_CONTEXT_MGR already set [ 536.017325] binder: 15634:15635 ioctl 40046207 0 returned -16 [ 536.042681] cgroup: fork rejected by pids controller in /syz4 13:55:17 executing program 4: r0 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x4, 0x200) perf_event_open(0x0, 0x0, 0x0, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000140)='autogroup\x00') fchdir(r1) r2 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000340)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x68, r3, 0x0, 0x70bd29, 0x25dfdbfd, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x400, @link='broadcast-link\x00'}}}, ["", "", "", "", "", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x40010}, 0x841) write$evdev(r2, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r0, 0x0, 0x6, &(0x7f00000000c0)='\xc9self\x00', 0xffffffffffffffff}, 0x30) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r1, 0xc1105517, &(0x7f00000001c0)={{0x7, 0x4, 0x2, 0x8, 'syz1\x00', 0x4c996538}, 0x4, 0x10, 0x1200000000, r4, 0x3, 0xe00000000000, 'syz1\x00', &(0x7f0000000180)=['/dev/audio#\x00', 'autogroup\x00', '\x00'], 0x17, [], [0x3000000000, 0x2, 0x101, 0x1ff]}) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) 13:55:17 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0xd, 0x4, &(0x7f0000000040)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x201a7fa6, 0x7, 0x1, 0x78}]}, &(0x7f0000000000)='syzkaller\x00', 0x1, 0xfb, &(0x7f0000002880)=""/251}, 0x48) 13:55:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000300a4"], 0x0, 0x0, 0x0}) 13:55:17 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TIOCMBIC(r0, 0x5417, &(0x7f0000000040)=0x1) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:55:17 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x940000000000, 0x0, 0xf5) 13:55:17 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_open_procfs(r0, &(0x7f0000000040)='setgroups\x00') getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000000)={0x0, @local}, &(0x7f0000000080)=0xc) [ 537.386265] binder: 15660:15661 BC_CLEAR_DEATH_NOTIFICATION invalid ref 196608 [ 537.409774] binder: BINDER_SET_CONTEXT_MGR already set 13:55:17 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0x12, 0x0, &(0x7f0000000200)) 13:55:17 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702daf9523b12ed9096ee8ab5f76ffba6328d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e17"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) [ 537.458689] binder: 15660:15673 BC_CLEAR_DEATH_NOTIFICATION invalid ref 196608 [ 537.465678] binder: 15660:15661 ioctl 40046207 0 returned -16 13:55:17 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f023c123f3188a070") remap_file_pages(&(0x7f0000301000/0x4000)=nil, 0x4000, 0xa, 0x0, 0x0) 13:55:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000a40000a4"], 0x0, 0x0, 0x0}) 13:55:17 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x1000000000000, 0x0, 0xf5) 13:55:18 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbd0700000000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) [ 537.690559] binder: 15685:15691 BC_CLEAR_DEATH_NOTIFICATION invalid ref 41984 [ 537.732778] binder: BINDER_SET_CONTEXT_MGR already set [ 537.762781] binder: 15685:15691 ioctl 40046207 0 returned -16 [ 538.284863] protocol 88fb is buggy, dev hsr_slave_0 [ 538.290033] protocol 88fb is buggy, dev hsr_slave_1 [ 538.684864] protocol 88fb is buggy, dev hsr_slave_0 [ 538.684882] protocol 88fb is buggy, dev hsr_slave_0 [ 538.689992] protocol 88fb is buggy, dev hsr_slave_1 [ 538.695039] protocol 88fb is buggy, dev hsr_slave_1 [ 538.700089] protocol 88fb is buggy, dev hsr_slave_0 [ 538.705147] protocol 88fb is buggy, dev hsr_slave_0 [ 538.710060] protocol 88fb is buggy, dev hsr_slave_1 [ 538.715090] protocol 88fb is buggy, dev hsr_slave_1 13:55:21 executing program 4: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='ns\x00') fchdir(r0) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) write$evdev(r1, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f0000000100)={0x0, @in={{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}, [0x5, 0x8001, 0x6733, 0x0, 0xc4d5, 0x4d1, 0x3f, 0x6, 0x2, 0x8001, 0x9, 0x20, 0x0, 0x4, 0x8]}, &(0x7f0000000040)=0x100) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000200)={r2, 0x100000001, 0x4, 0x10001, 0x40, 0x24000000}, &(0x7f0000000240)=0x14) pwritev(r0, &(0x7f0000001340)=[{&(0x7f0000000280)="675a9821bba74a3fefe09b292bf265466130948e7390f070edfe31d3a470141a2ecaa79729ce46ade593228691c471da808c207edfb650d2698a55bf53862c3d2aeac8174d5b5ff3b4193323dee3d9d2cb1d03c03898e948f2c3f68eee3812dc2332abb10547ee9564a11702dc1bac39483d4fed54e4c5fd16c08a0a46ae02b5d8fb", 0x82}, {&(0x7f0000000340)="cda644df241f83771fd16984467d869f9697e9083bdfbd7bbf76bf5559e051df530220604d73bddaca209320cc96f677b0ad5a7191a28877bd1c9889aaf2d2cbd26a9bdff8f21f224d1cf1d8b1b5e57d4e31e24ec8145e949662188a092284d9494d8e4e4163ff24aeae52cc12222c7059001a9582ba4506ec9a145dd66e9593bfadc505329a2a984e5a93f5341a4bb4cabec85db06440e96d13d4492a62c868fecda98cd7b65963e556541210944856f659190a62268ae597ad9c56609a479a2e90929d5f7012dcbed0bffdfa70d730155d95498db69608e4cebfeaf19157e8bc6a728963722a9bb50ad3c51237a8e7b751e7c39a2b7908d55e1dd3e35850d20b647edfe142e206437f017dc103f353556da8e8d191964acea3efa45039f478cb167961714a9a00652cfd1df0a746b1f6515c1c8a36ef6d1c6fabb18dd494734fa2f39c1fbc24faf19be62cd5bec58a6b580eec14edcea1491fbba9ffa6852b75558ff3ccb4bba6f3635e0bc9cf645902ba5fd9e0bea2d1feb024653861ccbe91134c3817b68c643b7b83bbf2b26dada4d16f98252eaae8c04beaf19c3208f5ee90c3025d95139ca214b6c7a8e79ab6fd989f198f5b1f47f14df67736e56d5fd1de4470593d5163ab71ccdf530f6c05faf7bd3ec7abc9c075403819961c2c7e7a554d75e5b6e2886d2b2ff07e7f04e8d92d5771bb36179bb0d0389e6da961772e64367ae621bc3e7aafdfa9f462380723ddcd0934a095693380a9eb46d9504eb34821c11bf4707a23a16e0ca810728d6214083c580038d31242502fc9a1ac8d9f8cb6fd338d120a1a56b7e8007b2979394db9b3262a02d3fda773e273a0f29330af38320b9765ed72b2a3012785451cc25f5ecad28a307a1db3b8b8eb1aafb75c231aac4c9d986cf292d0f0fc2ed87d6ceb85dedba02d4a81d4052daec57d3f173fb1678a4551f805b2249ba782b05726d1de8c16bc29aaffbb9ebfea2cc0e3038ce7e07c8f80cdf64319099a6355c760ec74c72b9f433efebfcfa24ee8a22cb2bffdefd8f243181a08356c34e2d0f63c43b3feda259f509b4274595247e803b582ba2e281499fcf104e24833b50058d1486f98a0700753ec17063f443bfc6797b67b2d79477d533af27da45b1d0966ac4892ae78b1fc5548e38b5f9d00f82ef7d59d6baf839ceedde6076367718964df864f5028ad96e76937299b41514e35ddb82c9bf609304653fe2435e566f44700d89809c4a1e234906257f43b1bfe11333bc1cf146d8a95a71ad0a85f31cca508b83fa4e23c0bb5dc9d435ec590a228205f88a59a009b1fe56700daeb744fe998262bc55559e69a18c05b24412dad26acb6c4ab40d2631d0d5ec6688f4e86c39d6366c79f1f617e7e1aa9526b6622e6daad258b7eb8047fba817bc155bb9647fe2258231e83da036404fad29f3dd7bf86ff451093eec2426551091c41edfde59c559c4a8a475c8b49e87c192da015d23615b9c8d5f2d3b2c5b8f6594fb140f75e54f542d84307f294720c14c1879c84bbf9bd77655b396a8078d309dfa2e8d15c4f4658a2c61e4cbf1585750dc8e9b8c916013572e4eb109748e11efd7a587212abc2613c8b7264c6fde96b0e35b5a790229ab3fe351c06d5ff6e0004ada960263b7819d04d419dd8f74a994a0bbf6b32bfb57332f547250b938644d9ef09db75da13aecf9dd398c65949747bdd078099d159365dba46594dbcc283aa874a70850b809735704d81d0c616b1833e05e3e7b710b365388c53104e0aa58043e48ed2608b002cac028553bfaf2a87d3fbae86af8ae368707cdfb5889fa1545094fe90658c5ccdbc98c1fd0311f44901d10172833519da0a1552cf63f2167c836775bfaadde4671930d272945b4442f2ddf3b75c44ce341b5b21fbcadf40f6917ed8c86ef7989d04abd5acf5d22650c7a59e54167e6e6d3cc30f51a25db82a0e20ba0038afa1a57938d8279d882559fae1f0298dd83ca8b9dfac5744a24589189c61ef22d11264fb8a65ea605f0c01fddca135c3a7279c6c3c1e84df5bb10bd3709ef2820fde21c8dcb15d352fc8952724e694a17509b800e32797eb8e2eda6f25085931db1dd83fefd7bba5b0fe9ea9997dac46da9504c006f49ca06e75e34fe40e9b275cf3ef70ed68f154add035226b04ed5a052500c7cce7ec549a9b9ed7bc94d4b275df3c4f0a95a011ade1cf027641b45511cc2e31daa51fc36ca142d0c56e65d84ad4383b89936c78b55d7d9f694222e4365c9c6c99eb54ee55b000d939dc150f7f63520f1fbf26f59c7f7ecd5105d80e7f8a865f471027b61213144ead41f3f06008b6c9c80df8cdbb8b5940e057d0b9008593792bfd901ef7d8d699f240451ed0b180afac731f635863cd259d575bad9a366e9e650bddbd6a3eaeeace38f07c1c4aeebab8fb340954687af58b39b5f3b782c30dd973f93e532d42ee9a37915603b1942a64aa2480579d648f16b52af3e4d953f445c4d72aa5b4ab4809bfb82460abe3455edeece63ab981a2bb17cd519a8ee83796f9fc789886c03ffee1df0109d4c3d460924036c81578a55756652de9d29a83a95851639458691972fb4c34ed473d7cb2aa6c3675efe048b3ad26758baf0cc48f9ae2771d36a0612d3ca2ade462099ff1ecaa0318dd84fb87c08b9ff3e8d4cfefd548c697f0cf13cbe26b646a4d471e21441438aa5b14e5501fc529093a13cb1c9870eae3380ec1b59f02ae9e689fc44c9e91ec6239cab48da99c8aed05cddbd1a73dffa44ff54cfd66c65345373b19731200afe4ba055488234f6eeb8a87b1ca099e92c17f769baf8c7164945dfbfbe501118263ad2724dfc3c56a92ab6b73d7bbeec7c6e0b600f106d8fc0649d5dd592f243736a6b287e93f83604cfc171f64e3be4798468cf141ad99dd2fbc57c5e8f32f2b402eaee4269283540ac1d4a6fbf77ecf65a2859eadb187414bc111895b65fd0161330102961e4227caf10843704e4bdbab583ec5574fd482687b20fa2c80ee8f4853580c661b96a8d3e52ad587dd41459eb7b4408f5c72007f2f38de648fe7f6a766f3455480377d30997e22c4400880daed2cda54b5f70ffe42769c5e8910264760d87803d884390a3bd538b0a08ce79c62120490a3b91bee3f15ec9bf89cd97e221c4651d67445decc96832a9ac812c2f909b3967c13b077a1534fbfc2d65a1d1bc057f3804572e928d727f9751f085a3a471a6525e1961b125b17e7f71f472a930554584db3723374e73ae936ed8e75e59180c0d9bc9faa3ab7d01b98ec12b0123b182af6a0515ff2c93138e2328358831c481cb7e986059eec39502078d56dc9329c53d8a46c1a9eb6574d328fa3b50c7b0bc14f43a2d2ad3766215d3486942dfbf9dc25a16f1150b3b6f428f88716089357ed451c9f7c96b98a67c814095b175d0c96f5895bd319b3e136b5f37b4e107f6541a1b424c46d1530cc30767e6fba36df877a2a83bf0b06053640012e5ce8c205b4a685699c13dac6255ba3a5c5205e9ac41b43ac03c20f04c2e4be33ca4d35e828bd3ade9326eab7c73ed3736ed7de59d25ba51deb8a6c70e730adba922cdc75f7f52ee4db88ed23c58b61824225eed4c301afcf9ce8ee2dbf24f6c39620df03ba1ea0f9aa6e8e5b4ce9e6d2497b3919a41048a72931ec82d9b92aae9226aeeaa49c5a35af5beeae324a65963080a8fc0ce1227c327012c4f53fe73eb524ca24a22cd4abb6f07c0f877269c64a6794644b44af8f9feacd9c49dfa5cdcc211e3ca77602d02b69159caa235439b5c4edb9ea71992661513db582e69779ace0b50bbd1e36d51de4a30e4734b654af4f13168483c97f16ccb1867e180b22d6ae7f8d2f5cfd92fee005338525cf4982b5f528204a4e594ec6e861a466a0425d7a61eef6371cc2dc3ca17394a9db669abe938a68603a6b781148aff8d0bfad619ab2330eca6ba35f6126cbf9f856f41a6ba4df4d7b2f391fb0c19dc45273fee554297e777d1d9e0fb1d58a255cfe74e6b36631d92f647fc541f1b8f515fba8cc522fcf96b7c0bf487d81ab44b01348c9527da16bea0e445e8682e8235252c0d0779a0d21ed783d8f8d88fabb148612d2bb782271569f07209e2a65467501dfabdbe8553e07e35aca56bae83536f255df073a493248c762c3f49a4e7fdda6acbcd20d0971d3f79fc54d8b8ed5fabc0543de7c09e3628b5174d33cf141d7d76c602a5ad466c8259c2c4e33d3e4b39ea04fd1a85cb2d0cb0fe2b197f95b7eace552150ce36e3deacbf00851502ab86ffb5aba86f8e38092efdc8f1dd828872529771a24d42c1d85fed98d4115e06f4e2f68977a39ad384d2bae65665d0bfb27b3dddd705886d3e4cb4cf976e6f867f8391f43efed9aba2921601eb6976fe48fc9c21b9b8fef140ef7a5b0f9b9f7c988697faaac012a3bd4ab49b5ed68dbf16aa674a5c8749799ceeacd4caa477485d494e5be4c5e0ed1bd14267ebb471eb1d81d32b2be334112504976aef9774f2c484b5be4f48d6586ae0d8bb7d893a260e5857c8ef2dee58d7d76bdb2a2cc98e473d72d65cf19eb93502910d81180cebd3871290e031f36b80e4141f1e3c464ab9d21d4f58fa5191557c486faeb7db289806ac16e0d4fd2b5a1f678f84e421db0b762aa3fcef65408644b1d2ebdd337c2311bdc10c544171956b0d4809d640cdedcd4798a30a857f59c9ccb8b14c02dec9124dde824a996abca4c0bb498ec82db45a969d20591a3d52d3292355b1a4c99aa55b38132e624b67d055d02914a414a4a2a8755a604ef29808608ed60f189b777e90431debacc95df340c7080e76132e68511188516f0c7d2ed9a8eea6e9ae884bae90e3dc4db2c6fccc5fb08e0a31d26bed099e39862a591168a6867ef8c4bd5149d8ab48a442646f78a0c621d44b5a8afd8fa305dc9f3d1dcfd409ac61eeba4434fc772f00763d1dfb798d2cd9455d00b2ca2307476d5bf2edf6b572939658a49fcbd4aceadfd70221b40e220b4a5df6072fbb74097991864eb1246cd1fc35c7434b8493fca4ba82999a8bd93cef3c775fa581aa9a7a26aca831171de3be34b3dffd45f97707d91c9eaff5ef874cb8ce1f68644d67a61baadfea2aef46a2ec197bf75b674ce8ea01e3ae48685d3bc9404103a791566b7a659947bdabad26674c144ab2ad22275285a144a024061d8e6df807e6b8bf319c08e9a73cd8ce388e6c46282710cead4921fe71174e2d69321a3fed9fbd77e044dd0ea7b9378c533e6e8d96c29d3ac709c36c783215fb914b555bf4a8cdec619d190ac78753e0faf5c1c55a16fc7f798dd9f28a7880f4bf37f89029b2581c1c577f75e72e0f17e6c7203bdebd57287c61f36ddd9e2a65681b0e62ef14ab0555c0afbd9f4d48580992b5bee64da9ccd1510d6178ddfdeb1929b8ad903d234d31a75b802ab288b510664f183fe785061b6e4acbb66d5d589d9041f328f7a78adc84218c3d57c1181f4364e4f04d5168c1b5832a54ce4cba522906cd78e6c0a7c32d9bd4cf8b8bd4705d87115d57e902ebc677bd932dfe698af3aed4c755481c8be11f4e5280b302df3fdc3c7a5280136bd66cc43325f506728324f97681315e117062555432bc17c80e9d42430bf208efc0aabd27cc6d4c20f5d6e3e7f7119fd2df6a5242775ab1630feb9869d045874a64dde002d60d771f5356d35dbb75f8fc986782d121522f7cfad69973f6001ad31913df36753840fa42b439da183381719dca99e44c86ff12c964e71e27c8ed69b5395083b12183a284803561fc2a4909f", 0x1000}], 0x2, 0x0) ioctl$FITRIM(r1, 0xc0185879, &(0x7f0000001380)={0x1000, 0x5, 0x3}) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000013c0)) 13:55:21 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:21 executing program 3: ioctl$TCSETA(0xffffffffffffffff, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) r2 = semget(0x3, 0x2, 0x0) semctl$GETPID(r2, 0x0, 0xb, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) write(0xffffffffffffffff, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(0xffffffffffffffff, 0x5407, &(0x7f00000000c0)) 13:55:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000004800a4"], 0x0, 0x0, 0x0}) 13:55:21 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x1000000, 0x0, 0xf5) 13:55:21 executing program 5: r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-control\x00', 0x800, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000180)={0xffffffffffffffff}, 0x13f, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000200)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000140)=0x1, r1, 0x0, 0x1, 0x4}}, 0x20) r2 = gettid() r3 = syz_open_procfs(r2, &(0x7f00000003c0)='smaps\x00') ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x0}]}) ioctl$DRM_IOCTL_SET_SAREA_CTX(r3, 0x4010641c, &(0x7f0000000080)={r4, &(0x7f0000000400)=""/4096}) exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sync_file_range(r5, 0x6, 0x8, 0x7) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000280)={0x10, 0x30, 0xfa00, {&(0x7f0000000240), 0x1, {0xa, 0x4e22, 0x2, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x81}, r1}}, 0x38) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') [ 541.038905] binder: 15710:15712 BC_CLEAR_DEATH_NOTIFICATION invalid ref 4718592 [ 541.076068] binder: BINDER_SET_CONTEXT_MGR already set 13:55:21 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:21 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x1) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) [ 541.100846] binder: 15710:15712 ioctl 40046207 0 returned -16 13:55:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000006c00a4"], 0x0, 0x0, 0x0}) 13:55:21 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x4000000000, 0x0, 0xf5) 13:55:21 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:21 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000180)={&(0x7f0000000000), 0x6f0, &(0x7f0000000140)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0xc, 0x2, [@IFLA_BOND_UPDELAY={0x8, 0x3, 0xf0ffffffffffff}]}}}]}, 0x3c}}, 0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/full\x00', 0x10000, 0x0) ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) lsetxattr$trusted_overlay_redirect(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='trusted.overlay.redirect\x00', &(0x7f00000000c0)='./file0\x00', 0x8, 0x1) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r3 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r4, r3) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r2, 0x84, 0x10, &(0x7f0000000200)=@sack_info={0x0, 0x28000000, 0x1}, &(0x7f0000000280)=0xc) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r3, 0x84, 0x71, &(0x7f00000002c0)={r5, 0xb832}, 0x8) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) [ 541.310326] binder: 15741:15743 BC_CLEAR_DEATH_NOTIFICATION invalid ref 7077888 [ 541.414444] (unnamed net_device) (uninitialized): option miimon: invalid value (18446744073709551615) [ 541.447601] (unnamed net_device) (uninitialized): option miimon: allowed values 0 - 2147483647 [ 541.577017] (unnamed net_device) (uninitialized): option miimon: invalid value (18446744073709551615) [ 541.598861] (unnamed net_device) (uninitialized): option miimon: allowed values 0 - 2147483647 13:55:23 executing program 4: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='ns\x00') fchdir(r0) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) write$evdev(r1, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000100)={r2}) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) 13:55:23 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:23 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x5, 0x0, 0xf5) 13:55:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000006000a4"], 0x0, 0x0, 0x0}) 13:55:23 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000040)=0x0) sched_setscheduler(r3, 0x1, &(0x7f0000000140)=0x40) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:55:23 executing program 5: r0 = gettid() syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x9, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') [ 543.069172] binder: 15765:15766 BC_CLEAR_DEATH_NOTIFICATION invalid ref 6291456 [ 543.104123] binder: BINDER_SET_CONTEXT_MGR already set 13:55:23 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$inet6(0xa, 0x1, 0x0) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) [ 543.120420] binder: 15765:15766 ioctl 40046207 0 returned -16 13:55:23 executing program 3: rt_sigsuspend(&(0x7f0000000280)={0x9}, 0x8) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x10000, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x4, 0xfffffffffffffffd}) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f0000000380)={0x0, 0x1f, 0x9, 0x7, 0x2, 0x724}, &(0x7f00000003c0)=0x14) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000a00)=@assoc_value={0x0}, &(0x7f0000000a40)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000a80)={0x0, @in6={{0xa, 0x4e23, 0x39, @dev={0xfe, 0x80, [], 0x21}, 0x2b}}, 0x2, 0x4, 0x1, 0x0, 0x10}, &(0x7f0000000b40)=0x98) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r1, 0x84, 0x70, &(0x7f00000022c0)={0x0, @in6={{0xa, 0x4e23, 0x5, @ipv4={[], [], @local}, 0x101}}, [0x8, 0xa6, 0x4, 0x5, 0x8, 0x20, 0x40, 0x8, 0x45, 0x0, 0x5, 0x0, 0x2, 0x0, 0x800]}, &(0x7f00000023c0)=0x100) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f0000002400)={0x4, [0x0, 0x0, 0x0, 0x0]}, &(0x7f0000002440)=0x14) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000002480)={0x0, 0x80000000}, &(0x7f00000024c0)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f0000004ec0)={0x0, 0x8}, &(0x7f0000004f00)=0x8) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f0000004f40)={0x0, @in={{0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, &(0x7f0000005000)=0x84) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000005040)={0x0, 0xb6, "7a3457ab2ae307e9afeea8c9884700476e07047f44f58056b81bedc6e328eeef1579c0f70c1eb22bc45cfcf08343d1e140731cf7bb425d935f7418f983c0e6c3f465a4a1a8589ba42dc9068f62b15f174b7b03eab14ac7c273f7cb9d787334882e633b3822e18a3816f0b26785ee7a8d082fc5316b2e6a2fef2408334de1b4500beb20ec4b0cc154dcc35f3ca186eb5dd7c6192bb6f160c728b416b1f5788b038c8cc8e499638f56167be3fa6aa4829dd0ca42ddd905"}, &(0x7f0000005100)=0xbe) sendmmsg$inet_sctp(r4, &(0x7f0000005380)=[{&(0x7f0000000040)=@in6={0xa, 0x4e24, 0xfffffffffffffff9, @local, 0x6}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000000140)="0f8cbb6a846b72c325871df5ae97cfed82f4c949b1bf09725f4527b920237d219a676af69f583409fa99b9be83c8ab52df9cdd15071ab0746f26112b86ae62e38c9b71677326b1834dbb57e5db7f8a7e7f8234a6e3651e8c2c12759e40020a18c6da9d03bae01c3b6948fa0ae22020bb13bff4eafe6c093ab06768e9330e83733d0c016fa2de4b599e690d310edb5621f3a6e5e3fe91951ea0fcd1dee42f74447f539642740627dc9eea873a8de8f1d18f87248171b4c68ffc8603cd36c55749924c61254370c39245b2d92483", 0xcd}, {&(0x7f0000000280)}], 0x2, &(0x7f0000000400)=[@authinfo={0x18, 0x84, 0x6, {0x6}}, @init={0x18, 0x84, 0x0, {0x2, 0x3dc4, 0x1, 0x8}}, @init={0x18, 0x84, 0x0, {0xa358, 0x4, 0x3, 0x8000}}, @sndrcv={0x30, 0x84, 0x1, {0x3ac, 0xfffffffffffffffb, 0x1, 0x401, 0x4e4, 0x1, 0x8, 0x5, r5}}, @prinfo={0x18, 0x84, 0x5, {0x30, 0x6}}, @prinfo={0x18, 0x84, 0x5, {0x0, 0x5}}, @authinfo={0x18}], 0xc0, 0x40}, {&(0x7f00000004c0)=@in6={0xa, 0x4e22, 0x6, @remote, 0x6}, 0x1c, &(0x7f0000000980)=[{&(0x7f0000000500)="6afe3fb72e0bdaf89bcdd08f6c86acaad54b2b78b85ea22749dff32019886560a1a182538dad532a399b0a8f13ce3332fe194a0395a1c9d9bd6d8f2ab6e71c56ba012559ef80f9ece9323a97fa8d7b86370fc40605c2a13daef176e8065f447eaae4525c5760f61de29b118967396b620f9a8ea3b839e1ceab9e31ddaecc9cbb0451791114e0263cd012e20fce54d6f0a2", 0x91}, {&(0x7f00000005c0)="1f763efa93729b07e2aa422e15c1ea6217bfb37efbcd322387025153df903665a638a5b8d7fd5fe4e02b9e47e0ecda1a0f40904aa5df531edab52721b41e306640d927537ca10da6a6f6e54477a689cb7b3216495c4ae3ce940bbb17644c5704817534735767d243f321587dc859e1fdc692a59e80f378ef21764d0af34e8adb29957f00aa1f1b8be652622b3454cbaeac5e410745d6", 0x96}, {&(0x7f0000000680)="b7c9676aba675cf191673347740452891db15352b92d09f87f9f36e2f81ef6939f1a2bda2e3e315b5f22d73843d0a3a42c9c57dd59036aece8c033d3cd9172b9e54373f2ef64a6f39ad4fc45be39fb11a2c65353e12a16c73aaa96953a9ab7e17c0261134ee4c672392496ff625895e8f3d8515c3b461c92a6b08ff1e672e4aa3c23ae8930283c0c01d03e3a00925258c67a8776fa3f", 0x96}, {&(0x7f0000000740)="ad36d04c1df7ecbd3b77595e4ad444897aa7c8dbf2bbe7d2fc82e40a3abdf635de141204e3be2c6af2ac297562ada6e8c3f50116a48a3954e9d79eeaab987ea39fffab73cf52e02524798c9d84b136dd5f6348121bef6349559d2bcdd3f97e119f5ce8c9a81dc293fa1b310c06b41336b2198bce425ea08a9ef42307d0e6f20bb5c50bf1ad66283f3ab755b3a2a9a77d4f1e3fac0869bdef30842919e56d3d3557bea508d23d2a51d672a308d1bbc88e100a13c7eeabfb1f45e5157442f15346c50e974f4d4cca44d4c56c9ee5bfb8911367032465519e", 0xd7}, {&(0x7f0000000840)="6238a7d4466c260ec939fa5223647a0f6120424bde34e35e8067cf7844eebbcd93db8d809c021fb2d94b8afa8bc3288a21049df83a61a559d5012acbc3887840c9d36f5eb56bc64bb9abebc00fbec29e7dcea05934352f7286ad0cc6686e99086e14d77a6c5967bec334392c8d8ba8c968d54f52d0245b77fd0b58af7e7f6d046666b793f2c72805429c31f5a58a6a0abb5b3413d3a6641bfef5704e14a7d771c2bad781e72a7f0f636e9cd76a5ba203407b0c525b277f0c2cde34a188", 0xbd}, {&(0x7f0000000900)="1137", 0x2}, {&(0x7f0000000940)="4c1ccf11b79c29df0afa24d3b4f50e02bc3601dec194b98f8c7d0bc66fb67e190a9655e01fce8463c586b09f7cd13483bb7a0d839ba2d76a7b98267f", 0x3c}], 0x7, &(0x7f0000000b80)=[@sndinfo={0x20, 0x84, 0x2, {0x8, 0x202, 0x3, 0xcd, r6}}, @dstaddrv4={0x18, 0x84, 0x7, @remote}, @init={0x18, 0x84, 0x0, {0x80000001, 0x4, 0x2, 0x7ff}}, @authinfo={0x18, 0x84, 0x6, {0x2}}, @sndinfo={0x20, 0x84, 0x2, {0x1f, 0xa, 0x5, 0x9f, r7}}, @dstaddrv4={0x18, 0x84, 0x7, @loopback}, @authinfo={0x18, 0x84, 0x6, {0x1}}, @dstaddrv4={0x18, 0x84, 0x7, @loopback}], 0xd0, 0x8000}, {&(0x7f0000000c80)=@in={0x2, 0x4e20, @local}, 0x10, &(0x7f0000002240)=[{&(0x7f0000000cc0)="6aaa20812508f9d62c543341edeb138bf5fa262b80fb3115c6acfa49a095e8e7469baf65e22da7ff7235a726f1a6ad731fa2191eca87df574c89a8ae17cd24cab4cc232123237e6f0f01b9aab87063c440388186fe3102ca17a433eeda22434f5b8d7606a2688ad8e9213d52c6d10fa8398a28ea6724d707f055325f5f3a", 0x7e}, {&(0x7f0000000d40)="44a97b7e1abdd5a8a36d772200e9d5c7e08096b4bf5f11e07017831b500bd3f5464cfa60fac1570919844cc43681df4ebee8caffa86464372ef7713f1d0eca67e44344892871d6a5be59b0fdc616ede59bef72ed494f12551b92342360a01131cfd7302eeee5c7cce5fabf99d10ff067e4b7299bccf567d78b3f8a1db54f4c60782540242ca81c0a520ec216bd9fd4d8d169e3b65f348661d41d9b163d3ee4af51722336d8abaf9433b160af5729dbaf6fa1f20113234c8adc3f638125b9811984bd17143bd6f3fe24fa6a69ef4f0bf534db8790bffae9cab105fa25c4c2bfecbf45ad6533d28a4bd4a644268b8b809b775d88be3e916ae3e3451006bbe01265708c06abfbdd66936d60f9cf16b8395d5399899a4c9f209a2f530cf4f4346c9042ed03315697c98d7997961dc32e492bbd3cac1c7bf3b31032c670ee2f39b548921c3964dc47e325f48560d6ca4c4369cf9b6f5663b2cf5e076b17a87f46315fe4ff608535e5eb656c98fd803ec4d3f6280a6ba1e7f92d8eb671896d32b3a7ca69a9653bdc9fa94fe7a91a4d09e8503024997e39b6e2aba82775475967a11b10717328393df1278e75f2e143ed0c67620a7d353e3a1c186a8afa1411ea5447471e5f8226582cebed972b54599a510134d4faddf9c7d78ff95325e18fd16db9b515b500908a96263dfef3f2e63950b8ba12eac5a997489837451d46d90f72d11c4bdd40b5653e03a08b0a37b7b42fffb47e8f578d8a522af03b1c77c6f3e16c068175bdac19bbae2254d90b7d57b874a411c9eb343321ae6ec06771b861128ad7a2c3df14a754dcd44e858d41fdd77340707c835e3ce337395753e59af51d0987124a198a14395a72cc7f8e1791540e11df7ab420e547c65c7defb34e8b12ba1942236a65633f0347120336bfef120265b334a80ea041d7d84759e9375cd35034736923a7ab8d876902d8720d705487b600e361718850464321a91541e4ff3e363a3bac242301e9fe644a93e621dabc2bff48fb4e1cc004762d22480aa9e6b17a59141f0aa2e4e2e208163b9f2fa5468b1ef96b5fc511f8fb5b99092f241d00092c36219d5547ddcce8a6cc9e02ea2240bd3dde53d9b2c9e0e0ee8b5d703649847196a392637d514eeba6856615fed6a1e109067da7038660274effd03f17a433e9bf2e1f07bd6c8215048dfc43e1ae01352a821da61238c01a5f8c48210f3ce3cc77287f3ba277a5995022fc532f7b5d219ce5662935d389c6d873824bfee450fee2ab0ab7afd43ff3130c777cd53e7756ef40e6581650360d82f265f9a55b9482ec9985558466cb5ea72fb3839f3d20d0e3c087597aec8fd51980f154a1b36bb66169965674b5b3db1e2a5406b7f56641a5dc931e508fa070eeb8c69ac8a525d46583d8eec610ec20477052f3f917d614d74ed6ec4d8c09574f6fa2404ab6b7ff4732a951eca06ded3cdcf73c8b800b8762755bba6eb167c6fcb7b7f3493141a03f643780c4a0600b344825ae726b1d7e4f906b6af377a574cc3557d4cfb3ec56e2999113ce4184531a353821f8d1b71eaf68c5679ff4b2a05cde9c6f15fdf9de75e0e75ca9b2c3ca5216417821c3bb722405b2d26593b3c1111715ddc035fdd3de49ff21d7572863d156cb3bbfa2f619ea17df2c651d94a765cc6d8907ade03b3504e73b35ea9ebb9ac4ef3c6de5cc11064ad5688dbdbe1f434225d18d27506be96dd4c0b4ecb80e6330114662b392e66b814edd1dd032a28f6db667c1d13789ab0b3fd32198a2a4a6ada8d89c2e585a7d73241ac59e57450a7ecc25432d8b3f377ff96374b78ee2ca5ddff7c801b69a60b8bbf99830c117037ec0f67ac2ba463486985da46c15b25ae3d892af7431899b8d80f7853bcd83543ef10c60ecc4329e59324f4cd67fbbaf6c64fc1a5bd2e6c2425ea20bc99c1e5d4a59562101fdee3f4dbe0c446cdd586dfae1869256bb36bdc9b99a258992b256b08677c2a5355116b6683024b47e5947782d14b4611707d95bf002a8377f7663a296e2e0f28cb547091e9d98e832993462104f3708e20bbd52aaf973f505fd48e3e6ff7850b24339868677e033570f423f96554deb48ec51509609943eb39182e57b0f2ab2b175927538feb25cc446af07ea8ca5392727c99264562357a525960ba74d3430b045f302c9a88191fdfe75bd026c6264fd6e00bed9744f048ca862bcb181aa33b81804f70f2fae4b0be042588478ebe1035f23c8a4e9ed45dd036b207da137d549970d747b4608715c14f3a631ea2436009c81744680db562ecf2b52adafb3d15a19196b934b4379b7d9fb5486e5d62c895f639b072cbdac33da1024ee2ab8d3f6fa9af44a7e3a8695c6fa7b5ff9e2e02485e181215ca8ca284b8f9e4dfcc8a0b8f9a16b6ebf432c8b9aab9cc38eb398113b1e0d71be924a888e78d1d2264d30e758eba5af53ac36c05813895c08c333c3d648ec58ec0b94f56827581d568a4bbe263650716e61bca284e74e213bb221cc9b8c71a19e1b470329131d90f13986745c2bb1cd9941c21340ea854814330041b790c86b57663fb040419b8f9093b2d0e7dcd47f8d610813f0d8740214343d19239952d52c00e0ed9b4ef8bf4549236baf6b639bc6818fe983b114f919cf9030c70b328e41e55fb76693c0cc7518af76381b7bd8bb376a38f82d0a4975b16a6cbbd2d4642b7b0590bb57bb4b01a79072bde6fcf8ac99d35f8dbde9b69e9fea5d92881beccfba0709ea05eb88bfe5a713c3de14d16e322885d7b8f49b67579a877a3b000d7a88e04ae8e405f2e490b1875088dc1ab52a6fa3f5895958647c0867a521a53fd4dd3ee816089a011eaef885d98db11c7da089ee3ce0546cd1b8a1529882265319a6e13205277d30012e3fd614a5aa0e3a874ee1388b236cc8fa1c9232afd5ab408f46c05c24d085c165e5437b3d17404c8abd4ff380d7f0dd7bdc9f213773de13cb149995d554832cc6e5b2ab99d2508789c4279ca23884657e704b3441cfb9bf1e27b57f8f59612d4a80d623c9d4da10d2e25e2d24962d2fda161e76f6f5ef28bfc4129bb4de8bf4a9698270b2e204137787e5d213dc3437e2abf096858be6e6f176d7cbae3a8bee74e9816b070461f440161cfd9137d5acf5e64394372594adc560f8b12a65a44e39b2b4a0e6ce4b51f340b9453d6aebc8101911ebec9008d8625d4ab41a78841038730301996c237a5a7305e2916893e4ffd37e665baf0dc547c8d57ddb2e513472709af303f1e69646317bdea1ea0be4993f7bf5211668a1850fdd590a5e4abaf9e2757dd75e2957774f9fd3e580d948f528bc8c6796034be07f26764b9d2e7a283a03d571a9e140cf6e9880e4f78f364e93813f1d3b716ccf8ded3ab93329beecf3cc76e60e69fa8131689f05d76d952d8c3766eb352c415083239fc8b426c1e2aafdfa4a76825030d3b4eb0fb6f3c032c38d1cc3880e04f4642333cbd2227d5a4e5a5bf921516876daf989dfa8545a7fa4b08c9d96454753f87db0bd5daded5b6c1e5f0f10e1cb18fe5925bc74db55b9a66d87754bfac75684fb1101896c935983d7f8e7e53da2acc2eb079ed11624fb95068b1c863bdd82645d0bce1a27788b12965c7a2d1d40eecda08d727695a8cff9ebd6f3116b6f77911a5fe493cf9b96219004d23ccb9311290566b262c2c6c260879722173207955f65a86ee79f87417a024a3d8413a3d5cebc07cab76fe61c7ad285fcc4c388210273c0fe15f8be7625a726ea2c75f8bab0c5795e26fc23db7e257c4c914ff941428e8c708a99d27b7107747d2c81b7ff9f77a477b891a29d82cb356e29894e64c9698a3f93e3b9a5e46e27ee141098c81b01c66c5037a1eea6829b2bb2e06f902b5a89e241d69fda55c87a6178a6182ab225a146eb8d88037ae21555fe38a18f2a990d04486884bf3b161f69795e714f3c570fee36c04f3e49195c83cecb2e18838d9a4229bf8b0d7c000d907e7a7bf49e61ee42a3c61d5fcfa6ce820fdae2a1e67ecaf316c5cf5a8499d1a53f625faf30d758cacf5ce0b5a70c7c94db142ef15bdd20df3673fa3ac662210346928d7a9a42f71001cb9e5bbfe15ef94b495b6cab4b97351bece156b76ed677e25b09ba9de115aa09fa92fdf11ac83d52cdfb089709d0d7a8e0f50550fbfdda75e9c648e016740c49d38efb37fe6e0a817861362516c242a532b9dca1583dde506959bcfd4a4d81cfc9314c27248c626080df25b656bbf9950f2394bb1c69aa95ac62a1f8cb5f614fd6032b12bbb3af8db9f69c4e51ed566dac6f3201742d8bd74f69744416a8c4f7089a474c57daa8787d52d6727022e210b31b9d99a5127ed4364109120c6c4297833e2fbd099da4d6c6ce74714e1f4cf09122897d2fb5df63daf2e1fb0b3a3ece6b7e75c70b0f1c9f06b9e4ab42d9e13762b5638da0f361d27dc1f0dd637bf1f65a6e9040527ea73e2314f1d8a61012377a57b0f11c5c8b168c37280c39be0ecbc4bbda418d61e7e352d29ad4fcc6a97aa590b38df5ec0509e6df240efebb329a6fa3568de71e150c7d7e26ae88845babd11408fd813bf21e244d2ff32ce17ab18b4f34af275402a1d88b5b30bd48627a8d3f56f44e0eb8d7583b8feb2fb4e2f6b9eaa2ba3768fbf98eeea42f843be9fa225175328739e03044b89513f2c9a5e70f4af1fe36e2561426b333ddce563ca8b1ad7fb67346eeb810466dd838dc731ab1a2c12035d0c55e44c66d639befae18365e93f7376a164aeef0809913950ad978959c6b9284b418046a1d7a090f82a7522bba8ce775887a1155f53bba300fa186a1ff7ce923c12c0095447d77a6a4b08167eb914ee2fd21ba18b252c7e9b4d855d92656c09f6b65f92e1ea7d72cd4d49a1f3f741232a14a430103722cc795055a5b38c0098ac71a37d83a012edef2a695a969b8aeeb64a899f71968a6998526492cd4ea5b7b873c7990f97b8a61fd6692e206a2859e375eab92283d4568525c0d8b3171bc8b6186d361d398bb075dc3ebbf3b9eb811dee4bfd7cebaa39084bc881d8973a191ba58917bddabd6346fd8a0ebeb493c1533c06de2b17d2b4f2606d9fed5a442d6a66f9736fcc4943272823e465dde8adf6672c1e5be38c2fd3e851c62714fabe6f8cf408b3fd2866902b749ab9611981d5c038179af3423cd078a429978126690ee06cce8c8665e9c40c2bd243aa48f67f8f86e0aa751eaba3e28efb025f42ff2b8c3f02e89017214d946fbde57560c9f034658db2929e216fb405310e74b832fd2a80327ad454b0efef8bbbde8d8b36a5c44db28b59e7d20d44c1426eabc37552988bc8bd0bf79b8d0007efa1df146e6921474a29d3239992cc1216d2393046d81893046672503eee2f8edc018265dc2944765f76fd254eda2cc66424c23bcce1e5b62e586573efe3c55d1911b0baf94b0dfa6c16e0a8d50e5fa27d59b129e3fb70b4bc9126fc68dc9b34630f223b2fbaeffab27212c7876282b6ce001944685d9f46066154373acf761d69294f8898c173c88d69f319b2c5111013baacdf4ef3282b7b5567d8a6075b838c250ec585548ff4d3ac00042d1b7f2657e456f7554c63cbedb6d434099d2748683a85d5e453da7b470c89d977ded52db984aeadac1b707b17656323964be4d6b0d9ccfc00ca9e3fef96368765aaf8599bb3ad2fb75975dda20a62c4421d055b4ffb7399e3577e4a16fde98a82e9126daa451de90b24c8c429249745f0d6dc7e160e236c6a5b8c48b34b893ec99f43c53258122b125dccc1fa0f99eb046933776d0fbfa0e", 0x1000}, {&(0x7f0000001d40)="537c4e2cf0c4258682a67c778637d12a6f9f3cf96c8ab678dd2e7721b0d69d639e740658d718ead63e77a1afaf138281607fc0dc34d53914eaa87ebaa6256999cc2f20b8d3f869807f6006368a44e4a8b8668275660a04f2fdec84e6e327afa064683282ccb0664fb60e6692c2fec4e03549fe5533b553f539c25ccf4fdbc688227d1430407f1eefd6f8d2544456147d32f3424e07993437fe72a9e30837c4398160aa790040ef00e7e320025fae1376ccc65fc205b71d6d", 0xb8}, {&(0x7f0000001e00)}, {&(0x7f0000001e40)="6e0567827191e6824ac006daf3e62c57f867122a7150ac82758c0531fb5d7d93f8a4676cbc2b8b5a4ec1d7c8ac6665984dbcec387a04a2eb91b0fa3cfe348c0e6ab7f4d53f76be8592a85d618c334f38aa3343243cc8e5c1c5a4809f97c25e194b45cc0dd17692984bd8e600c27b8f3260cea9059a0a46ba10d797579eff71445be878d05114cad6a2a05737cb3b88c480cc7e52865fb7104e3b129b6bb5cb3a238b6927700fc54c052cc799fe23259b33fb6977d7f9109664ac80a832188e70fe6f07567677cb5be0c0d53a57a35428cf27ee37c088dd38e0f5816bf05ce05b939d54d125de7b58ab3572a8409ed23ab97ceed8", 0xf4}, {&(0x7f0000001f40)="76f928c337cf7857a7ad60b18dc7a294bca982ebef43d51f01302de1d5c6b22ab9f7d143ae37522b69feadd7dbc808cd99d550254f1cd61f359ba91abd9ff59049a8b9cf73986c730f7c4bb64fa0f05e51702b6b350efaaa246b45d79a0183988fda47a8159b2b68c61c4ba221bce5f776e7a049d27e2875aaa58ed815813184005f2d39c937882047f6eb02629986a33bf764fd18794f244e117b88716e025a5e0e19705231d95cff7cd449cd7f7724dd97d0e18e12f2ed9c64932aa620dc997cc4e25a3ebaaff9c3fed17070d0af11fa6da3232157e12c10", 0xd9}, {&(0x7f0000002040)="c733ab4d0570cb6853f4fdc9bec19c560ef0948146b9605587a27aa0c5044c03d6468be9804aa821f78f24c682db1ee5215aaae540c6af3629ca91771c88e3aab0e2fa57e7b1e34448bf92b0e58952abf605063148a8cec916037ca840e731a11a29cfa101d1d3c3ce32240de46e1c0ac5379f367f498f9cef76f71b868648121512a6a87bbf1bffcbff48ee1929d3c7492be806e24fe0219bfbc782602e2f76137268686c03edd24430fbbc6d4f0cfa94410c8bd2c137f5e5309d206e03e3247c663b7234ebf2a0fb4d065e8f060550c7e82d87ed076c7bfd8581110632c0f885966439ea8118707951700b39e2", 0xee}, {&(0x7f0000002140)="1cb275e554abe31dba49e15a91a8d70a7b166a22d205fac120c92687f86a2e40dbfe81f0a5c703348e7dc14a8a40eedc6ea8a5cf82cbfbc13d6db5c4506e7373e50cd7efac1141201ab5c0f97e4596bd1a6a4049ec465868425802758c8f392028ad5638a8861d9bec13bb800c778a6b7ee33f123d2a3ab972e3d83cdd3b02c6f8a5284c37437c046d055fc6605cf4e7f911162fa80cc76b67ce9fc9e637d5d9b8a66252fdaa0a43a01e491e460ba88dfb56a2feb3938f59ee2731800e050a3e1b40023dbd283cee1a4f3057176ac9998ad156338b90aa8d51a3ac9cbab933c56dc58de35f5727aef5f82ac9d4dea0514b80bc6235af811628ee482e", 0xfc}], 0x8, &(0x7f0000002500)=[@init={0x18, 0x84, 0x0, {0x1, 0x2c, 0x9, 0x80}}, @sndinfo={0x20, 0x84, 0x2, {0x6, 0x8000, 0x7, 0x1, r8}}, @init={0x18, 0x84, 0x0, {0x101, 0x100000001, 0x0, 0x24400000000000}}, @sndinfo={0x20, 0x84, 0x2, {0x4, 0x8002, 0x200, 0x3d2f, r9}}, @sndinfo={0x20, 0x84, 0x2, {0x7, 0x200, 0x7, 0xde, r10}}, @init={0x18, 0x84, 0x0, {0x7, 0x0, 0x3, 0xffffffffffff4771}}, @init={0x18, 0x84, 0x0, {0xaee2, 0x9, 0x1}}, @prinfo={0x18, 0x84, 0x5, {0x0, 0x8}}, @dstaddrv6={0x20, 0x84, 0x8, @dev={0xfe, 0x80, [], 0x1e}}, @authinfo={0x18, 0x84, 0x6, {0x5}}], 0x110, 0x20000080}, {&(0x7f0000002640)=@in={0x2, 0x4e23, @broadcast}, 0x10, &(0x7f0000002780)=[{&(0x7f0000002680)="ac7ebf63ec4af8783046c564dc48b6240a45b16e0a68a2f9317cd74e38b3e8d1897970f5615e02bb326b4d65588d0745688f5bff5cbd0b3ff422a5cfabc36d54ef4ae9d8f94afb54f7552ad1d284377955c2e92d067f7a0298b9d2283d22374678eaff5477b6e5b110652b48369953dedfdd91d1114afb5d8091d33fdc7507361c76aed34554b47518d9360a79168e85647471ee94fb690929124ff1f9ac8a93e7ef2436106abaa687ebcd683ef709a2c3454102586045292322dc51179fd2b039a40f2c5d7c680704951f11b7074a4b2a691ab64bd5875cdb5985ecfe", 0xdd}], 0x1, &(0x7f00000027c0)=[@dstaddrv4={0x18, 0x84, 0x7, @multicast2}, @dstaddrv4={0x18, 0x84, 0x7, @local}], 0x30}, {&(0x7f0000002800)=@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000028c0)=[{&(0x7f0000002840)="59137e9a3c8dff4d4484e1cbc531aeae08d23efe7f7399702ba7911ba6d1f99a7769bdd1cae5d68ab49e73128a", 0x2d}, {&(0x7f0000002880)}], 0x2, 0x0, 0x0, 0x10}, {&(0x7f0000002900)=@in={0x2, 0x4e20, @multicast1}, 0x10, &(0x7f0000003c80)=[{&(0x7f0000002940)="540c991d30cb7a9387a8e16f0f1e7b081a540330755e8fa477ddc7a3dad43349693ba8f8f535e06fc51e80154c8be891e653f328f20d537d8518f14c4874657794af0dee74d0765d7fbbcbb26f27e46b30208a", 0x53}, {&(0x7f00000029c0)}, {&(0x7f0000002a00)="ffa8ffd2519bae98fcabd3d979b89b07632cd0d8e31c91c7da4be2a152727b9779e19d81ead278144914744a61f3bd50c0271e94496586d00c28de0c9c9c15c1d7f22338feb95d519db92a6d0588969caa25af2685d71b31729747d01e349b957985e512b7a2cca576fad64523a9dee7a7946fb05efb79e7dc75ab0c6c36e9992b8dbc64e259e9dda8042deef7194a5f436ea67fdc6289902f6b461eafe6be8ea20c8dfcd33cd853a3aee54a2bfe6aca8d2bdaf48247f27246bb98348a6f4d2005b0367feccaf9c77e414e29ed8fd569dbba0f59ffde79fbd846109aee665d47145633fd1e146101dcb5522bae40becaeb717f538edcf5d2930ccb", 0xfb}, {&(0x7f0000002b00)="98034e678f20c4162e54081ad4577b5d53f2ccd12c374ba65d98c5032b4ddc12716e30a04f081e5b07911c5102c85263d7a6e0b07bf05fcab009e65a5e6fa7e18590909d9c26cb65dc34a3527c9282b5764ccb5109b2bd632ecf4031b593772e9ae58ea4d23aba6dc7406782010277a62069fdb77ceeb57ae70ea7cf5a1c6e46cbbb39bf34426098a0881439f2131471cb08abe29406af0cc30393f4dab54ad372cf4c42745d16a0aaeef333b9354f2e1ef77556a009d195a07e8d4daac3eec043f1f7e73f588ebfd4f1c08a3f7a0050a1fcce0d83747e6c3e9338a9e8df449360cf045324cc2ac9c34f858ce484ac79b52c80e95f045a01e3f2a9d4978ccaada986a85be0278fe130016cb13d9673474c41e4be76ad9bcc308357388f33e620d431b970ab016b940f9940bdf8602e4cd890ee45eddaf0af425a854444101bcfe8f0982cf9ef56d75e6017d4ce2fe50561405c420dc30b3695fdbeff79e2904ab075f5cb235a4d6cfb2b7b130b2f4b1236fd125e7cb5564b35a18b49235474f23e994a9b3967c12d8f31221b19bc102b978ce258537da8e668adb1f2468eb02932a3fbce1a93c00d5e60bdbe61df3de06f1df5fb68fa3531d11c853b04d86aeac3977c5b6858ac9e3a17796492cd6dcda8ea8567979d5408a7b1676b97acb0e9e9cd898a7265cd674ae6986698e0f98ff3a43eaad3002fb459f3bbccab946a6b0758380ee63341325487a18f1fc38a357737b2824f636e825477bd05e6c805c16851f21a3d63789594aec4a5617cc2bc8ab0ecc9c9abdfe58fe7df5158e6c68c93ece722420cee52b11f10d76ff250d99ad462188087cc4ba9f26de2ce82f37e08b0a7eb62d1da398b9e179356f53fe43d7c4722036e00ab04c12ea661e742bd80669e61679b115edd51f28e1176b74c981e4ac58b99317237758c818bc19d95bc282a7e7f1fe3851a0cff2d85c9432676fef40581d8f6efdd9e927352d80ed7c6fdc2c7352268fc71399f863d7b7e8a53c14ff94a1dd294ace2e6d38000143888e2aab9a9f735f490bbeb597fab1d7cf295af1e912272916bdeda721be2b46c5e3fe6b208e9a1d9a24d267502fac389627daed918b7c8e2b0e1d44b520e84cd266e1ef1dbde2243741401fc7fe718a7bd365f758fbcd0b728cc58ad85a610238b8e031096f474a3351574c4d5045f7cb913d547279d0dd1455bf4a7633aa0fa60422f433f1068fd4d16a4ab7942ca40c0ed6e1e99fe9e0abde3d6a6c73d151316f7ecf3236e031044457e26068f331a4e6fac8c3b584b54b96295369e2c45a03c304b43b4e2708fd24f4a5bb071c6ffd6186a37428a567982d90b790f1613f39c6bca175fce44f11a58b19da39eeb44d5d85c3e7c8c6e9d9dfd83c2dbb16dbd249e5c88600b4b62c5cffe0090902cabc56b3afe3752de9da142ad31e82fd54f20ed64cab1512fd0f1299c3c5258c32389543a4ead3d1b73f627882a4d6ce58720dfd91731c45602f929456719bfdb2db8acd6b68f2fe6c9f4db8099a830d1027447c1d1db5d241a9dc032f08e7e3503c7c939d711c5a9ce96f0e22059406f67d4f122bc7a68cf6259e6eb136bee6f183212c57fa7ae92bc740a1b8b737e033292b208ac82129332b98189382389f99fc402c0b69e035492f82496d60ccd1cc7063692ef982aaafc73c9390529ef06e0759f49cbca802d1a82403218dda4f0ceaf7d03cd091cc4e117996c626e4ffa5170e38dcd86607949b348ff1385e55b6bab7439c4da8eeb4bee908b943992fd06db6f64e822917e82d8525089c12e26e8d3f0eab91d1ad7f9a9a16f32fa2b554b4e14f2e5a3a7400d6f849dee1460308a214c1b707115398dac95aec5a5ccf739486fd82334045803e5e0fdc6672df8640f62667fadc4237785e035ff44c5acc397246552f34dee90f878334dd342ea9342ae7c41c0b29e4b1bbc65e41b1cc9d2e583cb3a74424a7f442d323d21f0bb96875103a15dc9f206d175069a728c25c169f227976852c9bcfe122f0ede33ad842dc71356ab13a689a86de86cdb6c49d5dadc7db98ca5fcef5867719d40c9ea6622a4e288db337e7b3027ebab5ba7e5b0bc1d9c9dcca72781c4ee3f349f846311485dd6b13c8971be8f316f06a2b900aadb5700751c25e2a4ad84c72ac17f323a3726b218ca922151d222ad01fb872dfc003e282c43739459d2b51a7f480e1ef2b7182c52b4e8995b652022408cffa406627e8a97fddfb3d78a2f58897713891cd7a4f8382e80661ed3e3e08d5794d9becf4a609ed28c62c5b932111d2e1a15cdb1fbee16a4231ee0b995b485a5976674e87dfd297edc269572a4e7b25100a3e9b1be9afcfeca4544a989944cfdfd1d74435d0793d04393e7e2510fafcb448e99082ac303f58d6c677d3003bd8d1337754e679e241c54e13d798b8d41ac4bd31ec7fc98f7215b0855d6437bdc8bafe11c79e82389376ef0f2854bb25f2a5fda7762c4c91eaf5fd9e1034d2662be98232714081375b4901c6ae225087cd3bf8007e16d4699a0c622566de78af01ac85fa7d980f27d99f8ada491043b8ba5eb56dc7a040c31490755acf33f1789cf435f8fd545e6b2b32d314ca46533a726e86b4f7a9c426426e82aa16716c4911c751a648b3b8c1acaac023e70246da1bb7d7cadafba047eb9a9850c6629650c49846664e1a4e191bee5308d655783c9e6d62187c003ee6e3fb869d32a21698d7f4939eb5989e1cf0057ce2a24a650fc79f6622dd7a9ddb557f4ba19c718505375780726bd6d7db751e41d65dfb07ed7ff78a77a24caa85fd7bb9ffdfade6fa95d751db8a192370c3a6cdb4c8308819dcd4646686e7d8981532975c1688ce624eb4f2043698a5c3270791cd8f4325c05966b1d51ef275fbf885b19c4d7ca91e4e81d945be35e26d23f9cb57abede84cab9042e824cbb09cdb11773ddcb7caf96338a9b12fa16a2d8d970891a9a3273b70d3255a8ecacf6223b24ecc07e136bd660269347a77b125e8a088dd8262e4186104faf518b3e5457adebfdd5611e256929e8797decd7e647f24d0357c281a9ad1b68761d7c0df79579574096ae879710c98adc84054b9bec4df28ff40283abe1a00865119052c2104f6775a10e0433a79053b532783847af41bab9744bd9357e6d8b45b922ac8422db6fc4d7fa9436236e65ec8ff821f4263bfe5012a1e191c1a9015fcf773c8e35d77fb084d618547f9aebbb89c575105ac4e7105712773bb1687ae9286e2d8d51bfdde09908f7efe918cde16cb88e4c7b146998924f650c3e30bc3b5c587c56482e47f28bbe39bb0f7a9b20a76a7045403ca10af8297ddcdaf50d02fdd7c4345138b2528c67c1953150315969b10021aab3578fcee6878f3f96e12d74b4ed15b224ac5efabfb01f5b4e6ff789d27dbcee4f5a8f8fd99ca9cb5480c5f382f8082f4f47f9f797d90b78f17bf74c6262c0aac3aba4e5fce22ebef834da572148b0c1d57894f70ac714c756ba6df14d1d6d8cbd52a5e6c67ca5ef240d0064ec7cb60159c7c6209db0e67f03d4ef265e033e42080cfc292e7e5d1cfa90edad92e78f34dfa5d17a340b6e100be3edb958580c8f8ca6aad42a2615ce76fd199233a22b674f7f00d87062cbb12970a1a795ece5de35dc43c04986cfef62c047053760ed2436b4679271bf0e6ab34e75ddee8f8990b4099376943fd68856c0048e25f4f1986ab162728410a2c72916506c8733f6a5cb548a46bec4c62b9d6d83489010bfa905cc1c6699786c785c2b3d11d3dbc0544fda271cd8447ad95f7cf14444db4b6d06c2375a0c8933dc56f093c00a24d1e1a0d862942a0a9019aa4723e3f95985fbcfaf6c23f868b98fe58b7b82d333a63ac96250bb254c4d2517050cf82fa2741a78bb270704ebe5cfd89e8aed3bd2c3a94e5c1e88a2465e01e77af16b345598b89a49a3abb1c58e26a7d714f3f82dd3dd276e99d4fddfec0f1970f57e0b1a695bf60248b9d85ecda5212b2f91ca7b526c2209f34bb1a5e1393c6f2ac354190fc04dfab33d5480aa3e554f4f40262b87292286c609740381b86b131dec197cc46110658e698ee9bf7174114aca04354eb67f7a0974eac0c10b42133ebf9a1585b683aced933eaeaedff97ed93bd6dd8cd3139e5f6ccca6b69c349887958e2923ef9b4266e5559454f47480245cb5891c870f11bb61d8e86329e959ee6a843e760a94f265c955bf3ce04a04b0d4e31a0338535e7e52ab88a74f7113ff306fe8e6cbe7285c106b44a79b950e8ede75eb91c375084a01a4aeb73a4f9d910ce6440213f14854b662adbf507cdec754cef4005c633f2e9f8ddf84865b822f363ba9efa955bc65a49b12a742ca8661429b78a726ae9ce90e357e4df2b322901c0d817cab33e82990fc9724e50d2b9589c7925c17cc4a24e1bcb19ca5ce42fce227b56066cef301fb15e3148c9b59cc7545250b5107bb39b890a3b7356e8da47d6c2f9d9d35805279d7b571eb7ce3bbd4ac7ff3bb93c66c371a0e9d10a04183109cc401c3887b31d12cda106aeaaa75752417bad8f82fb8fa252c1daab5780f4a50a7228638718340717aaf8d3f3ac5769e7be4415e1f39238e1cebd94ecd4d41e5a3c409056fc518cb1701047bae24d30b303d36a60e443554e61d07188653d3bac0599886ad63578ad78a0e2ae25e9c31b726a2ec53dc7ec1f3c66a97a0c1c0ad54f0d00bd0622707476f6912d7040269e2e3b80ba6778bf0e937be48d67f91e50f9320e2d6a3eefa1a4d25903d0fcbeed02acb075271cbd75b990b5fff97cade604bf6606ff5d5a74ad8447ce336f510fa9388d568c8ffda01f22dfd90d7d890af8102544f7412175d49d9609d1e6ef9be9cbfa629cb041fb8eead5aa6a60feebb3f41b64604c0b7c44cf25ff081a93c24ee244a4f85a5d4ad937c7d08968ff2e978cb3d879846e4e49d91bcff43137f9f5da20141e66e003386f1a17efa5f8b233267ed4cb277d13cfce5572809241e7277d8a764db91be81b4359c0243b3fd2f1fd9780cf39acaa8db92873de3085dd64768a9410e3b3fee017367184ce2daa7c2bb95511d323dfdd4116e4775a4dbb18c432f8a220dafaf96e07c120774eb50aecae168b6e3cf9885cccdd7b5f57c76d308282dd7479cb1549cc3224af610f1e41b135c09d47996ab16ea265366bfdfbcae358f0f83b52cd133c6ab19729effa3e8443a0c63128244bcb45fd3725038d6309e3d5daa90644ffcfcf0b92bf0756ad0a8d0bac89c449efbd9f02f6ea24ad20c8cdb28c07254691b355cd2a95f9d8abd184c4a9a88e83a2ed54a7ddcb5fd3b8086763f28ea9b190b1e617daf431c3d932254babd23721e02d55c53a6df7edec52d5a84cc856f4d9c26da39a5e92035ff53d836076cceec9fdf117768cab7071808300718c7e753910b978734af7f5c80da2d817fb6ef7b40ae2d8eea5ebfe921dace75ab4f29d723dfbc885a489fbb92b2f4a2ee25b0b3118ea1e513a4298654d8259e0bcaed9f9d5321ab6fb5d60e5ab58b84611f26bf7f7f21be7cad3794d06ff0dacac73f0042b6abe601baafb0c77f98b617ca2495e30bcaae835582b8af8ebcc5fc4d49418d9333f0b982e458b806422c57c5de8ae03a0cbca8fc1a407223199c91233550fdfa70bb0eceed41337c81b0d00a4a98e6ff6b51e3a3f2255f25e04b259c7b1638bfad220e8b37008fcffb895686337579a93dd0766ee0dce3bcee58d976112079a97c6b41611ec0950c311a3c91d261ac8ca88476cad7447f4ed87e0ab5ff4b6aa776a169", 0x1000}, {&(0x7f0000003b00)="459fa177ebfc647910904eab06d30c215dc1c09b82b23ce11cbfa88d190e9026d76d8c4647e84b0f2f4be8e0a7ccbf7862f68e86606fd9e65014d254e242c402fe61ccc068b4a58027db36290845fd3eb79bc3c7c350209a2797cb04992470f229228c2218c89b516f8a2b50c2b247f2df51a1a666c6610412f6133f99d4034c991845", 0x83}, {&(0x7f0000003bc0)="d2160f6448286d2f56ec81e5dd8ac8091a7b4e028502cd9ae03654ce2cee1528cf4b3a244ed67aee8a9c76c28b0566fcdc7e5f9119def0e347db6a9a31445ea7e038cb979320734761679ecd2da51abbd630716a6368c0ecd8b084b476b6f41e140cf96ad9ea0e8c342b4c7034f28d90fbed97095f51e31354945dcb987307f3f02e20b4255356678dc30abcdfca6187167098710e", 0x95}], 0x6, 0x0, 0x0, 0x20000000}, {&(0x7f0000003d00)=@in={0x2, 0x4e21, @empty}, 0x10, &(0x7f0000004e80)=[{&(0x7f0000003d40)="98ed555431f259ccb635e8350a858ecac802becc3b2c96f32f5c79c6618b3a1f9a4add0a2f68e5875008368bbe626bd988a27e18e51d437eb2cb61495425b662580d91ccf898377241a0bf302c138698616dd9a5d4f490cb17797393b3db26e3c25a5725bfb6516a83346f6a300fb8de433eb0a20d693fa9efc999fa6fc101b0042eb1a544a8f7b554291202e50b4f91299e521b0f79a2d08b92c08a2a3f9c33729cf76a26602e91a7e86dcbfe884ca2579f1a6de0f9856af846b66a7d270c64db2d4ad39e5008da2a6e12076a25e7b9fbcd67a7ce2105fcd829e1ec025a43f5d639b4b93e17bd0f820a28eeced634de8d671c930545365095fc8f19d541846dcefff45c320a56f4cf154be832e454b08a588261854c2eeb9e18e275de8efb58a10d810ca5ba374bf37ac6203d03f58c621d8f7daba654e2ecca18c7da69693ee5aa0040d880a0f6bb93e821f1e13fc5f37fe4ff593fdf1fbd50cf0a190dbb5257dad0d0335b5400a5fec9876508be69a8c459b8f2801f0510045c4ba15a18fddc82f64c66d42d8fca8af030c6745a2520f658d43167c0bf51a6999c2e36cd02d81c7ea4bdb5df68318fa4b69d69d97036bf360fafc6f6c363bef8d21427f57cf84420ff4a6ac18f847494b9f07ff4a645128118ff8c6530a976a8365541a0d64397442a32d38701d957887305e14b263db1a34feb827565efbad5c081ee497b40f406eac1aa5ff227c56dfa7c3d0271467f84a8d2e8ff7409dc0fb5c11cf2e0e4b6a5f29678d9bee68cafebd530720fad366a4da518c12b3c229b7b4690595d1926284c5c7508dbf85c628ad6d8588d4f86eeb1bc573e95c8fa4a6133404dd8b248d316f1b30b9655a686d98fa8d7835416a60cfcc94e845c1fc42b139f2759b485cf8921d708700e47901aad0c33a0a05a9adb6aa953e05b2bd345567dd7b333b1c3516c69d9025f10d6c5b0b4ce2f70b1c152994d81f7e2a4235892c44d9ccb8ee5f5c6003179f8d32828e1cc0639baa9e62d698a14b1581d6e047bf22ff8d4f6b7c5c1f641ba5abb788e41a4d2ca7496b254a4d5a3129499e1b3b2a214bdc3341bc9af1a141d4d5d86d448ce91a11b5a62e7e347155839de30ea2188a2dd9e915222f8dac329e31ce379dba9d5eeae4c5d73139b74b1e8c878b2461826484862efa86563274335641069517a6ee6c536ba2d9193c69dd8887537cc5a46278d43e220bc134c0eaa13e37c4687f0d83034aa59621f9eaaae371b65688b017890d6234bc6341542fe233f012e092c8a7744027a3075b9f43a270f6a84174a184ba09b735b0aa00e74434cc5269642ca3218b01c904b8997532f1befd26b0726094182f5aded4d27f5ac2b8860512df5602447d776e506417d541eca82f9cae2bbb1f54c029619de3b494e3579d6184fef2dcae92c81b69360f358a6c40fa6abe6f33b7009843ed5a238507e1c8b134b7cf944cb90a5de78dc452f9afc3e4a8ae53b59ad52a5d699cccd97206a162fe7ef1faa52ae5e0b6c9f8b5238bb7b801986f37790479b9d4e08713b7e93913f63faebb2db2bdbc817fe0b2592579bf5aedbcb217cd8f085ed634582f274cecc8ca611ecb509bb8855eab9c9a5993968d58ed62741d13bde84365d22f095da9aaeaffa24c863885f51649a9e8692886646b09f905ff03851b2509cb1e543dca4999f395258ca9a9f6908bea58005746ef513062ea1cf9ce2de3dda08aa97aaef5c3caf4d7fbefc72a946bad83f2887aae27a30ae68af7e5614890d6fccd6b59a6a3d568c5ff65576750a0e8ea5b350894b01b27e3753058416a436b9095b923e165da845d4bd8b7b2079c590e3426927ded962ee0acbc11fd64b056e116602770533cc69c33766562fb73bd21312990f03dea7e46b49f0186628181994dd8e45f5b038471b65ebae31e7ea24ed20a84e029815b561f53ff9157584df6d60e93d10093eb204c3ed49becb9430a47b17ab6a1df833e590cce46b71ce33a54f6f271721ec493bdc46edc64caf106909bc23e2119fa38a2c8bcb95b67404f000006f2b7d6bcc21f2b6d62a3ac6d47d40890331dd815a0e6b16a84a7dec3beb08f64d9f2abd6090c06d469015593f703599227f3360fa14b3d43e71cc86bc0748541121267dabdede6972903b9878f3e321cee50bd8c9e86a9763eab957d3b53bf61abc64b1cf0f82dc9cd745bf268c7562b94757df9df3c20ab271cda54ef134705e8803203964f0d2039d2b6acff00b31e533b628196c595144917905704ce92ae9fe31a89111ed0084785981bedea483392ce8eca9519fa3c0506a3868417933f3cbfbdde04507d3b7d55ba41fdbacaa73224c62eb04a99a86158c63b59abaaafe9b89c74be2439c3984f7c406ee20cf89ad0a997c90d67a94f637872da3fa481f1dcdc37ace65f4a2caa0db065c8cf6af4bf79ee7a41277a43a6fbdb9484c0c16a942c93664c9f46c92044791d52470cbdc7551fe31cc9ff27cee384ad54bd047d17a57295e9c1326a20b6b0c4e8fae9bc2c0b6dc9b16301bc32ded7dbccf88bb6d1f5d3194820a006ca95ed7d829aaeb2dc392539fab64bbdab14d6abe3664bff6f7a55e5cef34b4f92ba6e47778df52d9b9b189e8e246e78cab9a37a5a6a59c2389438810c2d0c64f9f07aa249c7276eab1b0dfe417711628af138a1a70e29a97d52dc166dc1bc43a16fa1babaaa112cc2deae7ac0727aa03dbcab686dd24b0a6efb626226b00c93d505f76c834c9aedc436e3295d25b02629c1059e47d66c43ae652b4e17c84ac7ce05c754d4b484bb8328325700e5f0a174f7f496645c907b989a9a2aa925b366fcea0613460f87634a276aec730ae5fde6137ece0444b87edc8be8cdb78ba653f2bfea153916eb259711de255e968a8dc170f5b0d4ffeda182d8dd7ce52ed5a5589016bbe46d2b998ef796c9cab2b557e58e449dfcf774915eb2323140cf1f5d133f1bea05759e3f256f2b911312ea5817fe8ad2ccc8a017857648f685255d72325238d1ac7748ba7fc532cf3a726bb7fa673bce61ab62fda9c81bf62c1b4485be7d69fff7c2a2af276732183718f8c92df65eb501c092915ed674fd87e0bc4d66eaabac1b7c35766cf08227f74b0914243c1ab5ff31ec8e085d4801f9556d45ce35beffd68b693ad268fa353853cd516b4499dee813e14479513c82d44c63565bc6e5af511b8ec531c74ae4c451870c2d3833b1bdf5e93fffbed58f1636a3256a367260dafcef99286444f63560db19dc759a19c9cb18b801debec48498c3248b81d6be703ff49d1b61432ea46f727ca12434ab7ca5c7cfc6125de369118be59c5eab96e509b53be67e955f0b3ff6ee30a7dc709709f2b5d4a7f50562557d0b1ec8c363ddb674cc22e3300a5986d180410a3e05da382e2aa042de8aefda89264de7e4be69005e4f26def206ac77c8efaa95295d5643b202198d5cf10b82588b838c4dc642f6ee3e2c67750321f66977070a550616653e6e1aa5818e5503aff314aeee547d26908799065b99791ab7f846f6d7560e0024e68dbe8f5806f4976eb11d0f44890930b42317dbfd055eeca102f72f5381ac15edb0a4297194d0f56c121494b6fe48e3ad66e2e822b4d65cccf67fd4ca3747409dfe43b26cbe7028991fa3ca7ede5e86abd03435bfba753a482c70284b0b00ab8d37b59bfc4457c66f56a7478aaaf41901e7310ec0fe4f0f71f91b1cafeb9d8891b7df4c5cdaa193e9ae1acd1597823f99c7b2cd43abecd34e7c04899863cb57f794f06015392f3c3a2067b6126305c1ad12470ca94da5226eb49285e1b5dd91bcf1691042c5cbd4ec2ec67f2ed2e482d761452e7013f5ea708a0e5f1a8ee30e73a4756dfa287f689bd94fec017d5f2fae234d64bc00b0cbaa5a407d4fffe0144a5fa4fc77a4cda06665b0e6df28a0af5c4dbfc6b670ffbdc5651fd201152b9a9f9a980563edb19c539baea33acfc71282de32dc20bcadf519a82cda83f8dac6ec0abee4e188222c1af2a57fbb45a07212f6e878fab08bc193edb982b282cf92f00d0cc70a0c2dcb961f122f896689d5ed4472aa604ddb63f3979a58f570843408c0ccb02507917479a87b7be7accb36a1060cd571bdb5bb705f383486e0b03a3168768741ec7f115ec052c2f9d858687368e82f0484ababdd6e650332c82ac597cf702a65bac98acebd60396aeb6b19882b96b81b72ccba05840b471628d59a578f565a80c580f0f9495d723cc0f3bf2166d47fc780fa0fb9a60745c6399b89cff0f1c8548689d719923f0ee6504e3f3b2951bb98ff7dbd5b0b8f0e4d12daa2c8e9aab0d248d98b3141b2d625080369c7070fab375a4738a36de0b4b9a00e252d285fc121246c9109c8867157aa89626fe256486dfc301a7301d9fb7dbb7a870fc186408fef57fa82b0fd0e0bbbc383b607e909cc58f8cece9d4e65b1258c7786816de44f31334776183c51574e5431aafba8ff74fb546e6af98d35b32efd5924f4b86983f1e65edb1429b702d5675c1a759e3631c726c73dcee89dce0a83e59028f4e4636c4b1af284a5efbe26d13cbcc8ce4118b4ca3b83d9ca001508740cc16767f392cd06a658204120de98586f521a4ca9f66d98cf7cfdc2f5d5f828fb5421d6f9b8f6bd2430115c29a8cc0b489c170d9b15f9b8e89bac1810b4b3f20b20a439948164c459dc117abde12195b2040e081ac4c8234a154fa0cd551806770e4c6509c3a6c2e301e349e23218cfbc487a8d1bc1d1e016eb4a35d66137ced3c214deddfd2baca68023f8b9141e6ac6d4cf883cb17fad1d6f92830e133756531e5e1d4ce78df54c5a7d40793578381f45c96d8ea0ed265cef92e2b04a3215303c59d09a7797276f610069387b63a100501d7db32a1fc38a3c8496ec49c2685769273ca8325f82bcd65ffe720457e0612a02c365224ed03eb29cedab50326ae9fd8988e348ba3943e3ff45b1bce03f2502de3ce9b1487877059054c8019ec299d7d8919e96758ee79fcfb0ccce3e509c544c40eb7e54929a9295249ee1d39193080c417345df8477a5fbd5730c2fcd7a36c75c55074e1ed9ede76890e6b6cbfd316a6888d055c91c9362b1dd9e58c737ede2bc2c8acdb67c891929102bcda29fad4a42e1a24bb8f9a92a591c26bf66f9fd13c077cd6ad8f7a21f3235dbfeb123b07f706a859b0ade6f1278b80616912d5a2df944a73eb698aa4b320a29439d6537a59a8eb30d7e302576143a6ad3a4852292924e96b7b19a713b0be6f3e5eaa0d1d66dfd92820a463b3982a2a80d462e6f422109012b2e515a14c5af9780cf66f297f702a665964646eeee44e9b47405d5a688fdee9d18944d713508e0aa496419bb37c0db9797539b3f57579d78eaed0f760ed355bd3cccb6886d8ed74213e0b55920b447c96f851f3874d2c5c3005e6bd65d5a38101b0841700bfa7b802c9ed1aebaff121df476fa2f0837294f161e178e146ef66915361a565887c5c7542b59b4ec651337f1e69de532d1dc27163eb6bad558db5b3454a5b14b1dd018ca97ae36a841dc91c4b5092ccd136771b0c531b89a4522a8d5102e0fefddc01c9daf69cf27ccfb6a11b88bf43d6412f8ffe5dfc4b15c509314698a5b4c857229b76699f1608f6a336e31be69f42ff55ebccf706a132f7d3f9f69e8ce3795d9fe60648c8c8f1887067778de9a9dfb27df900530502697ffdcb285e939af28770ef4b05fb6410085060c79a4b6a9a06c91baa971977e61d09f21d3d8221b912a05d044043c1e4122e87a031ca4fa61d6b7b34de38", 0x1000}, {&(0x7f0000004d40)="3280822220cd3d51520ad0de7e4c9961461540f079721c8eabaa53f6d1e886c479a94fa174ef719c5fbd8fde6b91caad", 0x30}, {&(0x7f0000004d80)="4f5db2326c61653a867aaa", 0xb}, {&(0x7f0000004dc0)="5c2847bc27424a57dca1e4af82e2b285fd2ea408b34574dad92f15efa8bbf8ffb6ba2ac71bda3da236ef22f9a416a9aebc56882dfdd8e2697447b8225eba28ab1e69ad1a5045931b598ad2012b653a8199ccd93d3777334e923b47a6a692dfa432b0040f0afc01ea6826d4ee0c498ba781dfe7c51764dbc7b2bca8285d126573daf11b40094c74eb544d7bacaeed9956e0cd7fbfd640a0c2b841", 0x9a}], 0x4, &(0x7f0000005140)=[@sndinfo={0x20, 0x84, 0x2, {0x4, 0x209, 0x8, 0x7, r11}}, @dstaddrv6={0x20, 0x84, 0x8, @dev={0xfe, 0x80, [], 0x2a}}, @authinfo={0x18, 0x84, 0x6, {0x1}}, @sndinfo={0x20, 0x84, 0x2, {0xb7, 0x8, 0x18, 0x4, r12}}, @prinfo={0x18, 0x84, 0x5, {0x30, 0x100000000}}, @sndinfo={0x20, 0x84, 0x2, {0x800, 0x0, 0xf9, 0xa6, r13}}], 0xb0, 0x10}, {&(0x7f0000005200)=@in={0x2, 0x4e21, @multicast2}, 0x10, &(0x7f0000005300)=[{&(0x7f0000005240)="ebc37d530a23c27eaa1cfdb52103c5b5cee90c5ba5a94c3a40abe3e66c79f426fbb8c15606a8ca9a99328763138527e89b4c8de7ed2cbee283f8ceeddbd247517aae2122db", 0x45}, {&(0x7f00000052c0)}], 0x2, &(0x7f0000005340)=[@dstaddrv4={0x18, 0x84, 0x7, @rand_addr=0x6}, @authinfo={0x18, 0x84, 0x6, {0x3ff}}], 0x30, 0x10}], 0x8, 0xc0) 13:55:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c40006c0000a4"], 0x0, 0x0, 0x0}) 13:55:23 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$inet6(0xa, 0x1, 0x0) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:23 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x80ffff00000000, 0x0, 0xf5) [ 543.246194] binder: 15787:15789 BC_CLEAR_DEATH_NOTIFICATION invalid ref 27648 [ 543.294367] binder: BINDER_SET_CONTEXT_MGR already set 13:55:23 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$inet6(0xa, 0x1, 0x0) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) [ 543.317983] binder: 15787:15789 ioctl 40046207 0 returned -16 13:55:25 executing program 4: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='ns\x00') fchdir(r0) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) write$evdev(r1, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$sock_ifreq(r0, 0x8927, &(0x7f0000000040)={'bridge_slave_1\x00', @ifru_addrs=@rc={0x1f, {0x2, 0x1000, 0xfffffffffffffe00, 0xcfb3, 0x8, 0x38f4}, 0x3}}) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) 13:55:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c40007a0000a4"], 0x0, 0x0, 0x0}) 13:55:25 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:25 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0xb00000000000000, 0x0, 0xf5) 13:55:25 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x3) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x1400203) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000000)={0x1, 0x0, @ioapic={0x5000, 0x8, 0x7, 0xff, 0x0, [{0x7, 0x4, 0x2, [], 0x56}, {0x800, 0x8, 0x3ff, [], 0x8}, {0x1, 0x42, 0x5}, {0x100000001, 0x81, 0x3, [], 0x4}, {0x4, 0x5, 0x2, [], 0x7d37}, {0x0, 0x0, 0x800, [], 0x3}, {0x8, 0x1000, 0x0, [], 0x80000001}, {0x8, 0x2, 0x100000000, [], 0x1}, {0x3800, 0x5, 0x1f}, {0xbf, 0x180000, 0x1, [], 0x7}, {0x401, 0x1, 0x9, [], 0x400}, {0x9, 0x7, 0xff, [], 0x3}, {0x7, 0xe4, 0x4, [], 0x10001}, {0x5, 0x101, 0x3, [], 0x7}, {0x1f, 0x10001, 0x2f50, [], 0x5}, {0x1, 0xb7, 0x6, [], 0x9}, {0x80000000, 0x6, 0x42e00000000000}, {0x740, 0x2, 0x4, [], 0x2}, {0xcb, 0x2, 0x7ff, [], 0x3}, {0x4, 0x8, 0x9, [], 0x2}, {0x8, 0x101, 0xffffffffffff41c0, [], 0x6}, {0x100000000, 0x1000, 0xfffffffffffffcd9, [], 0x10000}, {0x81, 0x1, 0x9, [], 0x2}, {0x2, 0x2, 0x100000001, [], 0x3}]}}) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:55:25 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000280)='/dev/video37\x00', 0x2, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000140)={0x0, @in6={{0xa, 0x4e22, 0x0, @mcast1, 0x200}}, 0x7, 0x7eb9, 0x9, 0xffffffffffffaf22, 0xcd}, &(0x7f0000000040)=0x98) ioctl$TCSBRK(r2, 0x5409, 0x1) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000380)={r4, @in={{0x2, 0x4e23, @multicast1}}, 0x8, 0x8, 0xb2, 0x7ff, 0x100}, &(0x7f0000000200)=0x98) [ 545.064270] binder: 15814:15823 BC_CLEAR_DEATH_NOTIFICATION invalid ref 31232 13:55:25 executing program 1: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) [ 545.118905] binder: BINDER_SET_CONTEXT_MGR already set 13:55:25 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x409a02, 0x0, 0xf5) 13:55:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000600000a4"], 0x0, 0x0, 0x0}) [ 545.146369] binder: 15814:15823 ioctl 40046207 0 returned -16 13:55:25 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) rt_sigaction(0x25, &(0x7f00000001c0)={&(0x7f0000000140)="f044808100800000f43e2e66490f6e70a167430f9dd4f2ac67400f0bc421fb7095fff7ffffe2f3400f59b59b000000f243dee164f0430066bf660f3841aa79790000", {0x9}, 0x80000000, &(0x7f0000000040)="c4817d28c5c48161dbb00b000000c481a9f99c6306000000660fd49e0d000000c44175d5e5460f1f40002317f2640f986b2c660f380a7f00c4a1b16c27"}, &(0x7f00000002c0)={&(0x7f0000000200)="0f38ca1bc4a1ff11326664f3e021400fb15cf100c4017b2d490046def9400f38c8146fc4437d0576a07ef2ab2e38a608000000", {}, 0x0, &(0x7f0000000280)="66670f9bd765420fc7b10e000000c423057eea0cc461c162c942e7000fae3f3ed1ccf34c0f2ab604100000f040815834ea00000067650f73f003"}, 0x8, &(0x7f0000000380)) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$VIDIOC_QBUF(r3, 0xc058560f, &(0x7f0000000400)={0x2, 0x9, 0x4, 0x4000000, {}, {0x5, 0x1, 0x3, 0x0, 0x3, 0xfffffffffffffff7, "0e63fa7d"}, 0xfffffffffffffffb, 0x4, @planes=&(0x7f00000003c0)={0x1ff, 0x69, @mem_offset=0x6, 0x6}, 0x4}) write(r0, &(0x7f0000000100)="f20e", 0x2) socket$inet_udplite(0x2, 0x2, 0x88) syz_emit_ethernet(0x6f, &(0x7f0000000480)={@local, @broadcast, [{[{0x9100, 0xaa7, 0x7, 0x3}], {0x8100, 0x7ff, 0x6000000000, 0x2}}], {@generic={0xfb, "9cdbd19ea19cd2de3586f8784612bfc45cd3ba93856e5d749a935e9f75374e725b169990d60250ec212ae15145b67b8979695a398e97b385d3da00238e8a329303e9636557365af9859b66d2e1fd683615d3c9e24493a4919a"}}}, 0x0) write$binfmt_aout(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205cf205e201582a22ff8ec9a4b7a6b07333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e1379545c8a30c553ca5b10f5e959427308522da0e7a78a54e40cc34d85f96ac536756e28ea3a22bf7b2d01978eac7609b27d947756d1f215aa39fae451784d643ebc95e3f65d8131fcce7b853a3bc859bacdbdaab31731192a9c87a02e3d4c343ca1159c050030"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:55:25 executing program 1: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) [ 545.288429] binder: 15840:15841 BC_CLEAR_DEATH_NOTIFICATION invalid ref 24576 [ 545.318881] binder: BINDER_SET_CONTEXT_MGR already set 13:55:25 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r1) ioctl$KVM_GET_TSC_KHZ(r3, 0xaea3) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) getpeername$unix(r3, &(0x7f0000000140), &(0x7f0000000040)=0x6e) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) shmget(0x1, 0x2000, 0x20, &(0x7f0000ffc000/0x2000)=nil) [ 545.339801] binder: 15840:15841 ioctl 40046207 0 returned -16 13:55:27 executing program 4: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-control\x00', 0x80, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000100)={0x800100f, 0x7, 0x2}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='ns\x00') fchdir(r1) r2 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) write$evdev(r2, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) 13:55:27 executing program 1: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000004c00a4"], 0x0, 0x0, 0x0}) 13:55:27 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x8000001d, 0x0, 0xf5) 13:55:27 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) r4 = fcntl$getown(r3, 0x9) wait4(r4, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:55:27 executing program 5: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x40000, 0x0) ioctl$VIDIOC_SUBDEV_G_SELECTION(r0, 0xc040563d, &(0x7f0000000040)={0x0, 0x0, 0x103, 0x4, {0x8000, 0x10000, 0x6, 0x401}}) r1 = gettid() syz_open_procfs(r1, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:55:27 executing program 1: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) [ 547.108728] binder: 15863:15872 BC_CLEAR_DEATH_NOTIFICATION invalid ref 4980736 [ 547.164215] binder: BINDER_SET_CONTEXT_MGR already set 13:55:27 executing program 3: lsetxattr$security_smack_entry(&(0x7f0000000040)='./bus\x00', &(0x7f0000000140)='security.SMACK64IPIN\x00', &(0x7f0000000180)='/dev/ptmx\x00', 0xa, 0x1) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd484a21040893770048f9523b12ed909205c7333bb937dee28d4b2921ea4af651c621c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:55:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000007a00a4"], 0x0, 0x0, 0x0}) [ 547.184530] binder: 15863:15872 ioctl 40046207 0 returned -16 13:55:27 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x900000000000000, 0x0, 0xf5) 13:55:27 executing program 1: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) [ 547.301625] binder: 15889:15890 BC_CLEAR_DEATH_NOTIFICATION invalid ref 7995392 [ 547.354683] binder: BINDER_SET_CONTEXT_MGR already set 13:55:27 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sync_file_range(r2, 0xc161, 0x7f, 0x5) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) rt_sigprocmask(0x0, &(0x7f0000000040)={0xfff}, &(0x7f0000000140), 0x8) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) [ 547.388989] binder: 15889:15890 ioctl 40046207 0 returned -16 13:55:29 executing program 4: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='ns\x00') fchdir(r0) ioctl$sock_bt_cmtp_CMTPGETCONNLIST(r0, 0x800443d2, &(0x7f0000000100)={0x1, &(0x7f0000000040)=[{}]}) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) write$evdev(r1, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) 13:55:29 executing program 1: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c400000000010"], 0x0, 0x0, 0x0}) 13:55:29 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x60ffffffffff, 0x0, 0xf5) 13:55:29 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000280)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$TCSBRK(r1, 0x5409, 0x6) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$can_raw(0x1d, 0x3, 0x1) write(r0, &(0x7f0000000100)="f20e", 0x2) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') sendmsg$TIPC_NL_MON_SET(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000080}, 0xc, &(0x7f0000000180)={&(0x7f0000000380)={0x1f4, r3, 0x200, 0x70bd29, 0x25dfdbfb, {}, [@TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9675}]}, @TIPC_NLA_SOCK={0x48, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xfffffffffffffff5}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x2ee29c2b}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3ff}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xfffffffffffffffa}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_MON={0x34, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x100000000}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7ff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x10000}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x729}]}, @TIPC_NLA_NODE={0x14, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x80000000}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_NET={0x64, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x9}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffff}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xcfdd}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xc0e5}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xf7}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x8e}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x5}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}]}, @TIPC_NLA_MEDIA={0xd0, 0x5, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xd7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3ff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffffffff8000}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffffff80000001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffeff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}]}]}]}, 0x1f4}, 0x1, 0x0, 0x0, 0x4}, 0x800) write$binfmt_aout(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8fb12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13981df68c74c000251c8d5ce1692d713d50d7daa34be2d3edad9cea51cfc2679d6b49ee6a"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:55:29 executing program 5: r0 = gettid() r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/dlm-control\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000380)={0xffffffffffffffff}, 0x117, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000400)={0x1, 0x10, 0xfa00, {&(0x7f0000000340), r2}}, 0x18) r3 = syz_open_procfs(r0, &(0x7f0000000300)='smaps\x00') ioctl$SNDRV_TIMER_IOCTL_GINFO(r3, 0xc0f85403, &(0x7f0000000000)={{0x3, 0x0, 0x0, 0x1, 0x10000}, 0x7fff, 0x2, 'id1\x00', 'timer1\x00', 0x0, 0x3666, 0x100, 0x7, 0x3}) getsockopt$inet_sctp6_SCTP_STATUS(r3, 0x84, 0xe, &(0x7f00000001c0)={0x0, 0x3, 0x3, 0x71c2, 0x3, 0x3, 0x5, 0x100000000000000, {0x0, @in6={{0xa, 0x4e20, 0x8000, @loopback, 0x2}}, 0xa892, 0x6, 0x100, 0x200, 0xdcab}}, &(0x7f0000000100)=0xb0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r3, 0x84, 0x13, &(0x7f0000000140)={r4, 0x3}, &(0x7f0000000280)=0x8) ioctl$FS_IOC_FSSETXATTR(r3, 0x401c5820, &(0x7f0000000440)={0xc4, 0x1ff, 0x3f, 0x7, 0x3}) exit(0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') [ 549.134207] binder: 15918:15920 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 0000000000000010 13:55:29 executing program 1: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:29 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x6) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) [ 549.212901] binder: 15918:15929 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 0000000000000010 13:55:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000040000a4"], 0x0, 0x0, 0x0}) 13:55:29 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x1010000, 0x0, 0xf5) 13:55:29 executing program 1: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:29 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750edea90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937168c4e01d7dee28d4b2921ea4f88486a91c0275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13000000"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(r1, 0x40a85321, &(0x7f0000000280)={{0x1, 0x2}, 'port0\x00', 0x48, 0x100000, 0x2, 0x3, 0x40, 0x101, 0x2, 0x0, 0x0, 0x800}) [ 549.389847] binder: 15937:15943 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1024 [ 549.423227] binder: BINDER_SET_CONTEXT_MGR already set [ 549.449248] binder: 15937:15943 ioctl 40046207 0 returned -16 13:55:31 executing program 4: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='ns\x00') fchdir(r0) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) write$evdev(r1, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000100)='nbd\x00') sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x9050401}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="1c022cbd7000ffdbdf140100000008000100000000000c00020055000000000000003c00070008000100", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=0xffffffffffffff9c, @ANYBLOB="08000100", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r0], 0x64}, 0x1, 0x0, 0x0, 0x20000000}, 0x40000) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) 13:55:31 executing program 1: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000480000a4"], 0x0, 0x0, 0x0}) 13:55:31 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TCSETAW(r0, 0x5407, &(0x7f0000000040)={0xa89, 0x9, 0x4, 0x9, 0xa, 0x2, 0x800, 0x1, 0x1, 0x2}) dup2(r2, r1) openat$ppp(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ppp\x00', 0x40, 0x0) fadvise64(r0, 0x0, 0x401, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x6) syz_open_dev$midi(&(0x7f0000000140)='/dev/midi#\x00', 0x4, 0x40000) write(r0, &(0x7f0000000100)="f20e", 0x0) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:55:31 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x500, 0x0, 0xf5) 13:55:31 executing program 5: r0 = openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/attr/current\x00', 0x2, 0x0) r1 = epoll_create(0xea6) r2 = dup2(r0, r1) ioctl$TIOCLINUX3(r2, 0x541c, &(0x7f0000000000)) r3 = gettid() syz_open_procfs(r3, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:55:31 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) [ 551.102191] binder: 15962:15963 BC_CLEAR_DEATH_NOTIFICATION invalid ref 18432 [ 551.130562] binder: BINDER_SET_CONTEXT_MGR already set 13:55:31 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x200000001, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r1, 0x29, 0xd3, &(0x7f0000000140)={{0xa, 0x4e24, 0x3, @mcast2, 0xfffffffffffff31d}, {0xa, 0x4e24, 0x0, @dev={0xfe, 0x80, [], 0x2a}, 0x401}, 0x1, [0x2, 0x2, 0x0, 0x5, 0x401, 0x0, 0xfffffffffffff55f, 0x9]}, 0x5c) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) memfd_create(&(0x7f0000000040)='/dev/ptmx\x00', 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:55:31 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) [ 551.221163] binder: 15962:15963 ioctl 40046207 0 returned -16 [ 551.247881] binder: 15962:15975 Acquire 1 refcount change on invalid ref 0 ret -22 13:55:31 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x712000, 0x0, 0xf5) [ 551.282396] binder: 15962:15975 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 13:55:31 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) fchmod(r0, 0x40) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000180)='/dev/cachefiles\x00', 0x2, 0x0) ioctl$CAPI_INSTALLED(r1, 0x80024322) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r3 = open(&(0x7f0000000000)='./bus\x00', 0x4000002, 0x0) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r5, r3) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000300)='/dev/hwrng\x00', 0x2000, 0x0) ioctl$VIDIOC_G_EDID(r2, 0xc0285628, &(0x7f00000002c0)={0x0, 0x20, 0x8, [], &(0x7f0000000280)=0x1}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) fcntl$getownex(r4, 0x10, &(0x7f00000001c0)) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[], 0x0) poll(&(0x7f0000000040)=[{r4}], 0x1, 0xfffffffffffffffc) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r2, 0x6612) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)={0x0, 0x0, 0x10000000000, 0x0, 0x80000000000}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000200)='/dev/sequencer2\x00', 0x2c0201, 0x0) 13:55:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000007400a4"], 0x0, 0x0, 0x0}) [ 551.454256] binder: 16001:16002 BC_CLEAR_DEATH_NOTIFICATION invalid ref 7602176 [ 551.480071] binder: BINDER_SET_CONTEXT_MGR already set [ 551.485800] binder: 16001:16002 ioctl 40046207 0 returned -16 13:55:33 executing program 4: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='ns\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket(0xa, 0x1, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000340)={{{@in=@dev, @in=@multicast2}}, {{@in=@multicast2}, 0x0, @in=@multicast1}}, 0x0) syz_open_dev$sndseq(&(0x7f0000000540)='/dev/snd/seq\x00', 0x0, 0x2001) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @local}}}, 0x108) setsockopt$inet6_group_source_req(r1, 0x29, 0x2d, 0x0, 0x0) fchdir(r0) r2 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) write$evdev(r2, &(0x7f0000057fa0)=[{}, {{}, 0x4}], 0x30) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) eventfd2(0x2, 0x800) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000000040)=0x8, 0x4) ioctl$TIOCNXCL(r0, 0x540d) socket$nl_netfilter(0x10, 0x3, 0xc) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) socket$caif_seqpacket(0x25, 0x5, 0x1) 13:55:33 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000007400a4"], 0x0, 0x0, 0x0}) 13:55:33 executing program 5: r0 = gettid() syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') lsetxattr$security_smack_transmute(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000080)='TRUE', 0x4, 0x1) 13:55:33 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x10000c000000000, 0x0, 0xf5) 13:55:33 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) ioctl$DRM_IOCTL_RES_CTX(r0, 0xc0106426, &(0x7f0000000340)={0x4, &(0x7f0000000300)=[{0x0}, {}, {}, {}]}) ioctl$DRM_IOCTL_GET_SAREA_CTX(r1, 0xc010641d, &(0x7f0000001600)={r2, &(0x7f00000015c0)=""/11}) r3 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl(r0, 0x5862, &(0x7f0000000500)="3534835a9cb3cbcca063b3959792ffc54809b6cd0f949a89d5cefde6143cee27de7938793e906a41580fb8b7b99fe1acb064ecd9ec7188cbb03db1097f503e91440dc06a2a53abf313c028f8afa09e0380e0df4160032320118ce08f5a6773dbfd4c1ae1abdce59c74ffca2df4a6f9a77d578c26677b18bc85df7f075fc27262733574df3119ab4111bb23e11b75898a00c40284caaae7347c25c56e8ad9c61f4e7cd1da17ed63eb9c9945c78a851da24963f1dc14bf132d2b40f5409c6b293fd20d7153b1ba085618ae0bf8a5a8fcd41ffee33bb9847ebd103fa0c14fcabbf4b7ead53fe88bcd02453fb29e4e6942b89b3d5d17308e0b9dc2803ca01505e03023250eb3f6841d59788539922f34a763eb76d5ffcdadbf052c6ab6a02c33a4c0dcb342e760ed03a607373ede8d0c780bd1dd2ef31145d770cc9c9bea4ceb26833fbca290308197225ddfe4725d6e98651b8784203fd81a127dc452bc1b4660120ef4b9f556ef6dd997e44e32a18f06f84913ada92405d99f939bc7ba2b2023e2903142bce8f8a9a9ea39705722d5f488707954449ebc40ce313d904690964495197a816bca38f83960e7722fbcb341ad1fae9d9c8f6a00da34a5509c6aab6186e3d2b116ff4a4da9b493d0eab05c9d8821cb34a058a9fa552659e53e0216bdd60041437c78dfad40cf20ba279de01d8ac633cf8c1450e25070b6faab97defd0dfa98550d0cf8c80fa8673b7a4cabf8166d217a6c3d3663501343984c8a97dcfd1e7ba6e0412b990ed55619b637700dd1e227ecdbf9c81569d6476eda319cc8944567078320c0f0f85028491fd390e7d2d7b4541c687dcaf599c768d8607012cd999ee121d40aa5bb753059ea4f1a0ba81cc5c2c889f17942a894cb636f90b6e471818deb3a8e4631ae4c52805a0dccd3477d0b2e2e70c45ae79b42efa76066389631e37f9749af538e59363fe72e9ac575f9bbe16eee5909c64076cc96308f3ef9398f4978750774dafed344436353dedd70f918911706d288339b2fac23be11bd96aa66b903ea0c11493a01b38ba0be9a02c60d2660132965948f450164006c07970de779773b7ee9b67e8431b4804671ec746acd1f25f44f9ea8d8e676ebca23de752b27468d7bfe1f3c3ef5876cfbfc02b76065c0e9aa4d76176981f364c5bcb767d466c7cb5aa888e5bd44735463d2a27e37112b5eb2788dc85f25b4c10bf8e6684aa085d7427bd35a970c08d4fd446f9dafce9410d1262cd1861df3dbe85c5eac22b58d98807ae673586fe89b88c29f759e3011ff12ce49379f6c80900c90ea0d3bb0c5932139cb0da05d40c581c01b512357b25b2d18e11551864740a9b92eee12d0dcc8f0ee1473175c9d28d952a6e2b44e52149a0fa1b9fe656645e310202de2113ac1f00cf98bbd04a1ac2e8a12da4822f9d11b49a190ca97f821ba381c6d91461f997311d7c34bf943111f1aa5349d517a526f243a52e830923b6419220274b51ac8d9872088583584ff0c95587eced5219cb3d5e45d3f54b35e6d3d3f7e2f3f1300b8ca089eb5499f7d2bf88c437b2449173b11a3347d9b41804efb28b08a2fda3b071ab407150a1dca2e2d7252a68103d5eb861320e52fe906f279eb50dfda68a2e6283fe308f62bc5be0f483aa6eacaf66ec7e9c1a4f5377de0efc922955f200a4f3b17690a30545368c0e40676b97bba2de9a1a36e11700e5f1fa23c262dfc6dd15e72cb646c91f05c6e7bf67704491e7184ba77e3a71281995bdf921c429483c2e66222130b323a8c601b4f5b53d594a88c4fe8331e6bd942606e917191d24d60757fe177f932bd96b3f4fddc7f9f2860b487a45a7c89820b58aaeead1258ee2d6ef77e954b837119d4133b938bbbed510d234f347cf395bda23fbf37d1bf2dadfc10e511cbf572f96f034da58f533d664c5a4ea019490b84c20573bdf35fc800f18f2865311b88f13a70937daa55ce8aa5c28dee8cf6e8ee0ca29e79ec0e7fd40ac351156c9ce502f5304bb5a0c412f05c40a864fb5bf18175761da16eb5259ff7ada60518499b50836d0134c1bed382dc04768ebff15f4b4e292ea7fb90be36004339b077e56e52cfbd510aba3ecd94fd2ff9e95847794dbb1b9dac049cca9958f812e7cb439b4439d07ec22e42a7510c1d028e949c3fca766e57ff20e6f7ce749aef4673e3ed9a5db191e824ecff65418bd167be39dc76c5a106ceb848901774279e00f7a562d4b23b5e3dff26f3fecf28f6e4fc9067823901f54cce4dacf94a99e054d528221fcf7c88e130a3db774f8cdb7d09ecb0aa15dd9594c429c64e3d0fa647e32a682629f7a3c53846cfec3a447758f86d7fa2143de44897732f56ab2d1bc2728b027d478b70739b89c154b96803a6c9ca092242745f8bc8a17cddf9fbf5f1037986e90eb9f241ea85f136422b2a42469898967833f8310efcc5ee37e41981ac8a1f8cbda0cfafaad17b454a202869997dd8e73e1f9d2c735d24f5d3e038ef151d058995f5c28877fb0a9282199c071e49248a0d5c66dde33892e269762832e2e70400af7de4107adb13e170180900b681430d3c99d8bfe592be5dd80df03df9ae964af1bc190a18d7ba15d1ec0b4612793ebdb34458a1d182e9da61f13b0117371dc89d885c492263f5384833ccfec0af6a828e60ee19b37e0451f73004d4b0c783639e12b91534ed8a7bd5e16a22d06635c1d018a4b61e27733de3b9d9c2dc6a8654b54fd0700384c53c79fb6298b60748a5bd06c24232c836be649f79ce9c3bc379268f1aefde0507c837479b0e3b0efe49ef8177e5a1b286e2c56a915c5ecf8ad3070cb0a386dc876ab1c4d2a57794782c2f5b1abbbe2aa685089c3695057e80cd188ad43df0854d81357b45344b069f7b00b397303e9c9a023f291eb451ba99a7f80f90279bb7bb6fe6e004e82342335329dd24e0a039121424a9c880e525d412ca8ea492feb326bb8dd1f6488472fc52668f681ea6e270120de4d3d689adbd788d320786e379d4f6f8637fd09e56029436f5877d3019316ad2387940e2ad4ac8341f491206b3e446dcc898c30d8c3d4805a5e1715dc405ffa373e161c7323ae7fc2e55a3dc11254266d99ed65343ecbf55ab9c9fbdb07e0fd6595037c0d927172145e7f3e60e3f864b401d83bb4ce6d856bc24de19a55344d8dd8e7f39a43528409246b02b709ec1263dc389cadd719e10eb544816b5333297cd8745317a12bfb8a0cfb5447f7f5fee0c43ff5f0fa1c24278159ddf6d62467c2b6d49add1efad35f2f481b62fd2dd2d6a6b654dea5012daf1409f2460a6f2530062b17243cef0f3f88dcfb21b7e5c344d1362febd0c133268ba17ef23a9f99cc5c10b668afc92482818df19b174f32ba9ecf21fae38cbd4f30feabf755b3e6c209562b8a356b1111b05025944fba182db392fc225ba86610ddf2fa4c411bc53cc059172a4d72f041eb0fa4817d9d7ebaebaf4da06f0ee2c54cf2726c6eb8633a1dbb50d710b8a48b2f5be02b3e9c742a25810e72b5cb578105f9b72eb5f36b74f14cd4a3eb085eb0fd158cca320282642005fe56f650541e44864d79fae827b00ff9ff3503127eee15b58ccdbf2ac2ef9653e4c791fcfc67be2017e7b3de4ff68dadf3a2388c8525c67f3a2e635998d1739a957ac1bdf2fadd895343c119848bfc7ca34d8bd581e8b94c67caccb57b726a6da45ea70fe4c0eb34bf959a186f86ae319e17e8b259d07a6ab9d3da4df75e2f90c120506fc45df59567cb4b3b41c4a5e3eacb95531da641baba27ae4421e7108b9a4ebf67f8f35fca63b6b58204b4b5c1f5597388514069fdde2cb809e8d49158a046ef63dbf6c3d57dcb92ae7bbbf8544a2977e7d2033dbb3a0fabce4e9b3727a0c1005427fd02f25d8341dbbffbce33abd31f391d5c223654e56313cff4f12225a8886b52acd812f1dd1a3c49c07a4c7922057623396882576fce1145c19d653e3e01087d38a8119084bebc8067e31261774914115ae6ec910bd0189241ceb952c20fbdf84763b8199f62a0e771c97734d8dd45b71765d0306d2fd38d50b4991a7a676ce4373d4ab7bafdf62253e6cd75457aa289e1bc4f8cb79b890933b6a42288340cd9db3a48518ff84210ae32ba7de02b33cee3a600f864e92e11f88afab28fdcb30221a04400c486c384281227bfc72dbea771d05aec1b9c78d6d5fad5add61aa6bedcf1e8f018cc41d644f557b1500003f65d74c570851ac5590a8b2a5f2db625371301e9a29fc3929047f152a1d62c1175d84d28869d3d6a09739eca56077b8559eb5f1c82a6012840804e084c631b88ad4dac7ca46f7a98e7257fc7ece820e83b703beaeec628315b638cfe4c4ef6a5939c84983ccf1122e6b5e8e1951732909517449e1b46ff4b8d838e936d3dca6e7ef56cf0725b91f5051777b7ce2b3921540badb34a3b4557938d5ab3ce2d9cd64af9fcba1866e5b0d5c8a7db850732771a3811d4274095db8f86d1ba566b14c932a05a6476b4e991239448c8353f9e1e2eac6cf944b98e7daa0e652e483e555eabcb7e080ecd7a0245fe85b67656d7128f92b68fe086340c0f851788fd869864872947bbbcda56b3aff5d5b67801cfd451ebe2ec80cbc06c9a0efe65e5e480c3cb88cdcc0140e3e589a0d38b91514e1504c592b0ef4c1f322ebf459413c99fccd5c3e93d493abfea0cd1e8fe5f2bd6e77f71131a48371de654ef79b9e164dff2fb792b65ea9a9466dc928b2dbf4c931e92969ed22b8eaad12ea4e984b4b4505ffcc74d99837e5abf308ea5b43bf5a92d0b47085ecd9c87dbb58f53f0d9c3915c5acc8df513185c8b2920f288f1df361a0ef30b8d4ec7237618b8eb1942ce2b53c1f124b2d00759281d4e40348c66290d0096586403d965d102ed0b7da102855525847cad56749d0bde5e978fa8afab3995d90625c2fcb3ac563cbbfafbf10950f44bd233477c0f3d3fc6293a012193723fb161993ba51c6751d2a0539693359eb7f7fceb5179e9e25524f9b0e5c29782f57bccde809814680d9bc88352cf1fe596d5208ecc8bb4e6181994e36a3e704ea9d7ace946058c862ef2399a5e6f2fcd44f44693af630c76f0d009d8e7979a0715fd52ddf5be2d24becde52d03eb6e08f6efcf157f58e8a454bd6f4f8c3049ba3b4be3c04f84a69b4f8e96f227477e466ab7c3bcce38257f01354740d8fabbdcdc96a76cbb4b59b7eea62f4ed7e874c9a6938b485c6fea0a2bf1aa8020856eb06b069f3ff9df42e6bbabd1ad7246c497f27d86dacf95de7ae88aa4c9a8ea23d950c337c6e8abdc2099290265bd4585f63392931e9cb8bd9964fe0841023e681399162ff973ed578eb411707fa525eac6129a25e85e2546300baaaad58334a1643b24f131a4dfe783e0ca5341ff4b21434e6373cb9bfa9a6a6683424eea29e1af784d6501050097c47b2f928279f292f767e18369b39cc92c8c04b8b1ac1e3381a937e0c75f7fcfa675ef45ffbd686b659fe3c9642ed993a6c59259868e41f072de9990ae618e9b0763aa4173191bfd1f8e24792cfaff7ea37d387ce62dfe3efdc78dd20bf3dc2e8a5e8aef38a5b8fda74607fc92074fa2364a69c3ee9b7b0707603575b6c6f74108af15865f3480d55b87b8a022ae549e837551501da31b73cfef0acc5477477183fa3c7b7e9d4a368e95eec85aef3526f5518bb20434f35f94f94f2fd1e5b02ec65250074b1f2d923a14bdc90000dd0574dd0445fce5ce22fb6c7afe29c1b3f6591d07284be81889d6e8b7d257b631ebb5d2885a0be19a74b71") r6 = dup2(r4, r4) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r7 = fcntl$getown(r5, 0x9) ptrace$setregs(0xd, r7, 0x6520, &(0x7f0000001640)="9c455284e4496adb82484dd1fc6373dbfd4cd002d6dc1eaefe2b38b07ae4480c2986a84b15bfba401b25e687ee978df74bbd2d560e13e96b90ea058013f3ba55fe76e0cf4dbd3cb39f35dc61519ba6c528787ddbc73aab70f4007917e3e8c9dc935109883ef25f87d268ee27175942f395c59ceab56bb27150db88a231d76e06d1b11d") write(r0, &(0x7f0000000100)="f20e", 0x2) fsetxattr$security_smack_transmute(r1, &(0x7f0000000040)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000140)='TRUE', 0x4, 0x3) write$binfmt_aout(r3, &(0x7f00000002c0)=ANY=[@ANYRESHEX=r0], 0xfffffffffffffe9b) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000001c0)={0x0, 0x3}, &(0x7f0000000200)=0x8) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f0000001500)={r8, 0x88, "dbba1896aa6e72b0dbf328785ada5b6d2cb455dcb73f20e11717ef0431f5a6853d6d04fc003a4a8d5f240247461043f96c7c9f973fde72f5ae50fbfab95c61e65128f7e4b10a76b88ffb744ffee020c5377652161de87b2b78a9cacb682c9418d5479491713154d5b839648ed059b80da89eca9cd062884877c41cfba5ac7fcd037d07dedfd40a3f"}, &(0x7f0000000280)=0x90) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000380)) recvfrom$packet(r3, &(0x7f0000000180)=""/56, 0x38, 0x40000102, 0x0, 0x0) 13:55:33 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) [ 553.102233] binder: 16013:16015 BC_CLEAR_DEATH_NOTIFICATION invalid ref 7602176 [ 553.139141] binder: BINDER_SET_CONTEXT_MGR already set 13:55:33 executing program 4: r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vsock\x00', 0x200000, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000140)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='ns\x00') fchdir(r1) r2 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x800000, 0x3) write$evdev(r2, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) clone(0x800, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f0000000040)=0x7, 0x4) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) [ 553.180127] binder: 16013:16015 ioctl 40046207 0 returned -16 13:55:33 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) r3 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x1000000000002, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = socket$unix(0x1, 0x801, 0x0) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000280)={0x0, 0x6, 0x30, 0x4, 0x5}, &(0x7f00000002c0)=0x18) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f0000000300)={r6, 0x81}, 0x8) r7 = socket$unix(0x1, 0x1, 0x0) bind$unix(r7, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) listen(r7, 0x0) getsockopt$inet_sctp6_SCTP_EVENTS(r4, 0x84, 0xb, &(0x7f0000000180), &(0x7f00000003c0)=0xb) accept4(r7, &(0x7f0000000400)=@generic, &(0x7f0000dbd000)=0x80, 0x0) connect(r5, &(0x7f0000931ff4)=@un=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_SET_VERSION(0xffffffffffffffff, 0xc0106407, 0x0) add_key(&(0x7f0000000080)='logon\x00', &(0x7f0000000100)={'syz', 0x2}, &(0x7f00000001c0)="ef0ba7c4c852bd7ad094779caa595c7d45c3d5588405b9f76a71d782279c4cc5cc2002ab3e9f3caf053656ca87e1c5790ee302c19eb3781c2991e377de19eefb50c71daaadc889b019ed5c7fb5126657713143c2572fa9b513236bb550770b1c18fd444072d75f5cbbdaae477437e8d021e54396c1af972d027bb01a85113ae613698b4100", 0x85, 0xfffffffffffffffc) keyctl$restrict_keyring(0x1d, 0x0, 0x0, 0x0) linkat(r8, &(0x7f0000000340)='\xe9\x1fq\x89Y\x1e\x923aK\x00', r9, &(0x7f0000000380)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x1400) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000000)={'team_slave_0\x00'}) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000040)={'team_slave_0\x00', 0x200008000005}) getgid() ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$VIDIOC_TRY_FMT(0xffffffffffffffff, 0xc0d05640, 0x0) 13:55:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000007a00a4"], 0x0, 0x0, 0x0}) 13:55:33 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:33 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x101000000000000, 0x0, 0xf5) 13:55:33 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) r3 = fcntl$getown(r2, 0x9) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r2, 0xc1105517, &(0x7f0000000440)={{0x6, 0x3, 0x2, 0x4, 'syz1\x00', 0x2}, 0x1, 0x20000410, 0x8, r3, 0x7, 0x8, 'syz1\x00', &(0x7f0000000380)=['cgroupsecurityselfmime_type\x00', 'em1&nodev,\'vmnet1em1security@\x00', 'nodevwlan1GPLmime_type{systemGPL)\x00', '/dev/ptmx\x00', '#.cgroup:[/$mime_type\x00', '/dev/ptmx\x00', '&security$,{[-\x00'], 0x95, [], [0x100000001, 0x5, 0x5, 0x3fc0000000]}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$bt_rfcomm_RFCOMM_LM(r1, 0x12, 0x3, &(0x7f0000000040)=0x2, 0x4) dup2(r5, r2) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0}, &(0x7f0000000180)=0xc) setuid(r6) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) [ 553.393509] binder: 16043:16045 BC_CLEAR_DEATH_NOTIFICATION invalid ref 7995392 13:55:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000003a4"], 0x0, 0x0, 0x0}) 13:55:33 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) [ 553.611586] binder: 16058:16060 BC_CLEAR_DEATH_NOTIFICATION invalid ref 50331648 [ 553.650320] binder: BINDER_SET_CONTEXT_MGR already set [ 553.669482] binder: 16058:16060 ioctl 40046207 0 returned -16 13:55:34 executing program 5: r0 = gettid() syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$unix(r1, &(0x7f0000000000)=@file={0x0, './file0\x00'}, 0x6e) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:55:34 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x5000000000000000, 0x0, 0xf5) 13:55:34 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TUNSETNOCSUM(r3, 0x400454c8, 0x0) fcntl$setsig(r3, 0xa, 0x1) r4 = socket(0xa, 0x2, 0x0) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast1, 0xffffffff}, 0x1c) setsockopt$inet6_int(r4, 0x29, 0x80000000000004c, &(0x7f0000b54ffc)=0x1000000, 0x4) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:55:34 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)) r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:34 executing program 4: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='ns\x00') fchdir(r0) write$evdev(0xffffffffffffffff, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) 13:55:34 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)) r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000006000a4"], 0x0, 0x0, 0x0}) 13:55:34 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) fcntl$dupfd(r0, 0x0, r1) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write(r0, &(0x7f0000000380)="f20eeadb6306c82cd84a9406c1acaa3d4640e68a619539f5820dcfb9169b2cfa1638b5686f775e44e436fb51a6509346e5a1371e4bd8270985b20edf8aa94286cdc1df8717fdc4d300621b3b66e84c3e287374f47763280ea3e42edfe60f1168161cd52c9cdd8408b82d56197885bbbff88e43bb6af7685f3b0aea5d3e41cdebc6c4262d921c572be86182d71f312e5dff00000000000000000000000000000024bc693168f90d0d19604dbc130879f9ab1a477d95a25f49f82b4413fb99df4f2c339ed6945f0f9e95274410670da01c203967b7f788fee82eafb0ccb131e8842387b152e194804d4e11f45ca88707db1f9da6c9dc0b820937e7ddc4b1d17549b4de56a39a982b2637bded0f18e974636be4fb33bc2cb64b3b17892381d88489d0f20e198f8968e8", 0x1bb) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:55:34 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x3f000000, 0x0, 0xf5) [ 554.254502] binder: 16084:16089 BC_CLEAR_DEATH_NOTIFICATION invalid ref 6291456 [ 554.283605] binder: BINDER_SET_CONTEXT_MGR already set 13:55:34 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)) r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:34 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r3, 0x5407, &(0x7f00000000c0)) [ 554.313045] binder: 16084:16089 ioctl 40046207 0 returned -16 13:55:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000004c00a4"], 0x0, 0x0, 0x0}) [ 554.510672] binder: 16102:16105 BC_CLEAR_DEATH_NOTIFICATION invalid ref 4980736 [ 554.531438] binder: BINDER_SET_CONTEXT_MGR already set [ 554.556063] binder: 16102:16105 ioctl 40046207 0 returned -16 [ 554.582010] IPVS: ftp: loaded support on port[0] = 21 [ 554.593017] device bridge_slave_1 left promiscuous mode [ 554.602897] bridge0: port 2(bridge_slave_1) entered disabled state [ 554.659148] device bridge_slave_0 left promiscuous mode [ 554.664610] bridge0: port 1(bridge_slave_0) entered disabled state [ 554.810567] device hsr_slave_1 left promiscuous mode [ 554.859429] device hsr_slave_0 left promiscuous mode [ 554.913416] team0 (unregistering): Port device team_slave_1 removed [ 554.926434] team0 (unregistering): Port device team_slave_0 removed [ 554.937965] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 555.016934] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 555.103453] bond0 (unregistering): Released all slaves 13:55:35 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x1) 13:55:35 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c12") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:35 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x1000040, 0x0, 0xf5) 13:55:35 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r1) ioctl$KVM_GET_SREGS(r3, 0x8138ae83, &(0x7f0000000380)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) [ 555.480000] chnl_net:caif_netlink_parms(): no params data found [ 555.552933] bridge0: port 1(bridge_slave_0) entered blocking state [ 555.567233] bridge0: port 1(bridge_slave_0) entered disabled state [ 555.579361] device bridge_slave_0 entered promiscuous mode [ 555.589384] bridge0: port 2(bridge_slave_1) entered blocking state [ 555.600555] bridge0: port 2(bridge_slave_1) entered disabled state [ 555.610660] device bridge_slave_1 entered promiscuous mode [ 555.649345] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 555.666535] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 555.704013] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 555.712181] team0: Port device team_slave_0 added [ 555.724962] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 555.732523] team0: Port device team_slave_1 added [ 555.744958] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 555.752526] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 555.817978] device hsr_slave_0 entered promiscuous mode [ 555.855166] device hsr_slave_1 entered promiscuous mode [ 555.915490] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 555.922594] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 555.940314] bridge0: port 2(bridge_slave_1) entered blocking state [ 555.946738] bridge0: port 2(bridge_slave_1) entered forwarding state [ 555.953398] bridge0: port 1(bridge_slave_0) entered blocking state [ 555.959807] bridge0: port 1(bridge_slave_0) entered forwarding state [ 556.014102] 8021q: adding VLAN 0 to HW filter on device bond0 [ 556.030258] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 556.044632] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 556.065527] bridge0: port 1(bridge_slave_0) entered disabled state [ 556.091662] bridge0: port 2(bridge_slave_1) entered disabled state [ 556.112603] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 556.119231] 8021q: adding VLAN 0 to HW filter on device team0 [ 556.131609] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 556.140341] bridge0: port 1(bridge_slave_0) entered blocking state [ 556.146773] bridge0: port 1(bridge_slave_0) entered forwarding state [ 556.177551] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 556.186208] bridge0: port 2(bridge_slave_1) entered blocking state [ 556.192606] bridge0: port 2(bridge_slave_1) entered forwarding state [ 556.240752] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 556.249277] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 556.257451] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 556.275108] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 556.285699] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 556.291749] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 556.299710] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 556.316812] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 556.329516] 8021q: adding VLAN 0 to HW filter on device batadv0 13:55:36 executing program 4: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cachefiles\x00', 0x2442, 0x0) ioctl$RTC_PLL_GET(r0, 0x80207011, &(0x7f0000000140)) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='ns\x00') fchdir(r1) r2 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0xfbf7fffffffffffd, 0x2) signalfd4(r2, &(0x7f0000000040)={0x7}, 0x8, 0x80000) write$evdev(r2, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) ioctl$RTC_UIE_ON(r1, 0x7003) clone(0x20020001, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) 13:55:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000020a4"], 0x0, 0x0, 0x0}) 13:55:36 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c12") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:36 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x20) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:55:36 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x400000, 0x0, 0xf5) 13:55:36 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs(r0, &(0x7f0000000040)='\x1c\x16\x93\xd8\x00') setsockopt$IPT_SO_SET_ADD_COUNTERS(r1, 0x0, 0x41, &(0x7f0000000080)={'nat\x00', 0x2, [{}, {}]}, 0x48) [ 556.520703] binder: 16146:16150 BC_CLEAR_DEATH_NOTIFICATION invalid ref 536870912 [ 556.552250] binder: BINDER_SET_CONTEXT_MGR already set 13:55:36 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c12") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:36 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb936dc728d4b29a1ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b01000100f0ffffffffffff0000710e13"], 0x7e) socketpair(0x5, 0x4, 0x4, &(0x7f0000000140)) open(&(0x7f0000000040)='./bus\x00', 0x2, 0x0) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) [ 556.570845] binder: 16146:16150 ioctl 40046207 0 returned -16 13:55:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c400000003fa4"], 0x0, 0x0, 0x0}) 13:55:37 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:37 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x400000000000, 0x0, 0xf5) [ 556.762695] binder: 16167:16168 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1056964608 [ 556.797514] binder: BINDER_SET_CONTEXT_MGR already set 13:55:37 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup2(r4, r2) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000140)="923f8e31c8300a9008029f85f8ee9ed259f7d94c8ed0d081042d6ffec136ae0eb757ea943b912c43c632a33b892ca1296da9fa999d19d9aba0606264a6bd12335836ba8c4366", 0x46) getsockopt$bt_hci(r2, 0x0, 0x2, &(0x7f0000000440)=""/217, &(0x7f0000000040)=0xd9) setsockopt$TIPC_GROUP_LEAVE(r5, 0x10f, 0x88) syncfs(r3) write(r0, &(0x7f0000000640)="f20e08123433423b5d3e556bc2d1fc86195c741a2a07a78b11ac17c83f4667c0c3d6ac096d7359b1242a804f732ec4cb3b3b855fb76d14bd050e2287f9b5c46bd0edf1fcabecb944955f9749ca2d1f75ec946396f807e29cfd90d4707c70fad079d0e93b40be95ee0b01abbaf6ccdac7195c2ebbfa6207e7873d754e371d3f70a56124d8997096cb443f7807dc9f23e69b30d790e4b69d9b6f724bf977d9b0c7e4b9c8ecf3318dddf9153fe9cbd379e2cf1d13c487f971c972021483bcc522b47743fab65a273e2feb0eb7e9427313233bb759097a76dd1133e6f268a5011d244897ff32e737e48813acd0bc", 0x356) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000009876e700cd4de91a1f98937702d849523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916af8598b518cdf620900edbb78b7559414d055deb4357df02d2eed0800c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f0000000200)={0x100000001, 0x800, 0x7, 0x8, 0x0, 0x9, 0x3, 0x2, 0x0}, &(0x7f0000000280)=0x20) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r5, 0x84, 0x5, &(0x7f0000000380)={r6, @in6={{0xa, 0x4e23, 0x40, @mcast2, 0xffffffff}}}, 0x84) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) [ 556.815623] binder: 16167:16168 ioctl 40046207 0 returned -16 [ 556.856966] binder: 16167:16168 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1056964608 13:55:37 executing program 4: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='ns\x00') fchdir(r0) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) write$evdev(r1, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) ioctl$FS_IOC_GETFSLABEL(r1, 0x81009431, &(0x7f0000000100)) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet_sctp_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000000040)={0x153, 0x7, 0x2, 0x5}, 0x8) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) 13:55:37 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000006800a4"], 0x0, 0x0, 0x0}) 13:55:37 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:37 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x20000000, 0x0, 0xf5) [ 557.118206] binder: 16190:16193 BC_CLEAR_DEATH_NOTIFICATION invalid ref 6815744 [ 557.166400] binder: BINDER_SET_CONTEXT_MGR already set [ 557.192437] binder: 16190:16193 ioctl 40046207 0 returned -16 13:55:37 executing program 5: lsetxattr$security_ima(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.ima\x00', &(0x7f0000000080)=@sha1={0x1, "02bb4fa1f973b6a0b8cc1046e0eea82107a5c585"}, 0x15, 0x2) r0 = gettid() syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:55:37 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a0") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:37 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYBLOB="92a0a7a6c98c010000049c5c2a3c00000000000000010065750ed4ff5e45a90f3d09876e700cd4de91397fc544486edda223b12ed909205c7333bb93c785cb33b2920dcff88486a91c8275dd4b22916a0dc38b518cdf6207000000319149e3591410d055deb4354ff02d2eed248f407189c3003b2cbdae69c72000d6009e8fbf0c707c34115bf2599d2c277a13efeb8a2c35de888c2f471dbeb4fd0dd9b50e3a7b18a245ce8f1c3b310ed421eb0f380965f903d621e1de891438518089e2afea93254cb19393f3af98f05afe1f1f58b6f64725034550a5c6c075f08c88ee4594829126b449152b1661a8b60253c5d4f40531e5fc3e3ba35c452b6661979eb50ff7b4022941a6cdfa33d71a8e6a9dbfc549189e92a369b7ce28c664cb7c4d8deb0d1a10a803d829f9cfa5d38dd159ce3c56c838cb3bc4468c0dcff46c9c184f2cf21656924081e162f7f648d34042ba1ba58db25a91abe3ead5df43f05eda272b7ffbb60c68d7ec2bd89dc2ab711bffb97af6bc3a4d9bb0ef8b372825cde5b765f34e3ab6482aaa25a63c3b8228ec2b79ecbe046aa7298dd2fc531399f2ecd89269e198c6da778f11d6b08cf1eadd27f71df5582b90b41af71e73e00bcb635800c3af1b1ebd7a0695083355b57cb39663536c516e6432315f5db0030204afc4a59e"], 0x7e) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = fcntl$dupfd(r4, 0x406, 0xffffffffffffffff) ioctl$UFFDIO_WAKE(r5, 0x8010aa02, &(0x7f0000000380)={&(0x7f0000be1000/0x2000)=nil, 0x2000}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) getdents64(r5, &(0x7f00000004c0)=""/9, 0x9) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000003c0)}}, 0x20) ioctl$UI_SET_FFBIT(r5, 0x4004556b, 0x0) ioctl$sock_FIOGETOWN(r5, 0x8903, &(0x7f0000000240)) ioctl$TIOCGSID(r5, 0x5429, &(0x7f0000000740)=0x0) r7 = syz_open_procfs(r6, &(0x7f0000000800)='net/dev\x00') getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f0000000280)={0x0, 0x4}, &(0x7f00000002c0)=0x8) r8 = syz_open_dev$mice(&(0x7f0000000180)='/dev/input/mice\x00', 0x0, 0x40000) r9 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r9, &(0x7f0000000180)={0xa, 0x0, 0x0, @mcast1, 0x4}, 0x1c) sendmmsg(r9, &(0x7f0000001300)=[{{0x0, 0x0, &(0x7f0000001180), 0x12b, &(0x7f00000011c0)}}], 0x249, 0x0) ioctl$EVIOCSMASK(r3, 0x40104593, &(0x7f0000000600)={0x1f, 0x7b, &(0x7f0000000580)="3aa4b0e1b7bcbd4cdc7c2936523ca374d9e7a7f3d3db196a1202c53712c2a68b00c7066c6612b3cfc935696b9766d42442ebcd23f3c91b35198e241d578628a6a9f1db93e66e63c58f77fb52cf4d086aaedd22446de3041ae1dabf66d1c94eb729ee5198c8dc929ba1dcc115db2b2f5035415a94ecb2752a5a9a25"}) getsockopt$IP_VS_SO_GET_SERVICES(r8, 0x0, 0x482, &(0x7f0000000680)=""/182, &(0x7f0000000540)=0xb6) fremovexattr(0xffffffffffffffff, &(0x7f0000000640)=@known='trusted.overlay.impure\x00') ioctl$VHOST_SET_LOG_FD(0xffffffffffffffff, 0x4004af07, &(0x7f0000000080)=r7) getsockopt$IP_VS_SO_GET_TIMEOUT(r5, 0x0, 0x486, &(0x7f0000000040), &(0x7f0000000300)=0xfffffff8) 13:55:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000200a4"], 0x0, 0x0, 0x0}) 13:55:37 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0xa05000, 0x0, 0xf5) [ 557.419668] binder: 16210:16215 BC_CLEAR_DEATH_NOTIFICATION invalid ref 131072 13:55:37 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a0") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) [ 557.488106] binder: BINDER_SET_CONTEXT_MGR already set [ 557.493546] binder: 16210:16215 ioctl 40046207 0 returned -16 13:55:38 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x80ffff, 0x0, 0xf5) 13:55:41 executing program 4: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffe) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x3ff, 0x4c0200) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='ns\x00') r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000100)) write$evdev(r1, &(0x7f0000057fa0)=[{{}, 0x0, 0x0, 0x5}, {}], 0x30) ioctl$DRM_IOCTL_RES_CTX(r0, 0xc0106426, &(0x7f00000049c0)={0x4, &(0x7f0000004980)=[{}, {}, {0x0}, {}]}) ioctl$DRM_IOCTL_SET_SAREA_CTX(r0, 0x4010641c, &(0x7f0000004b00)={r2, &(0x7f0000004a00)=""/193}) recvmmsg(r0, &(0x7f00000046c0)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000140)=""/250, 0xfa}], 0x1, &(0x7f0000000280)=""/215, 0xd7}, 0x400}, {{0x0, 0x0, &(0x7f0000001480)=[{&(0x7f0000000380)=""/4096, 0x1000}, {&(0x7f0000001380)=""/250, 0xfa}], 0x2, &(0x7f00000014c0)=""/107, 0x6b}, 0x1ff}, {{&(0x7f0000001540)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80, &(0x7f0000001640)=[{&(0x7f00000015c0)=""/88, 0x58}, {0xffffffffffffffff}], 0x2, &(0x7f0000001680)=""/35, 0x23}, 0xb25}, {{&(0x7f00000016c0)=@ethernet={0x0, @remote}, 0x80, &(0x7f0000001780)=[{&(0x7f0000001740)=""/12, 0xc}], 0x1, &(0x7f00000017c0)=""/90, 0x5a}, 0x4}, {{&(0x7f0000001840)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f0000001a00)=[{&(0x7f00000018c0)=""/148, 0x94}, {&(0x7f0000001980)=""/107, 0x6b}], 0x2, &(0x7f0000001a40)=""/172, 0xac}, 0x2}, {{&(0x7f0000001b00)=@sco, 0x80, &(0x7f0000001cc0)=[{&(0x7f0000001b80)=""/216, 0xd8}, {&(0x7f0000001c80)=""/4, 0x4}], 0x2}, 0x1}, {{0x0, 0x0, &(0x7f0000001d80)=[{&(0x7f0000001d00)=""/69, 0x45}], 0x1}, 0x2}, {{&(0x7f0000001dc0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, 0x80, &(0x7f0000003240)=[{&(0x7f0000001e40)=""/37, 0x25}, {&(0x7f0000001e80)=""/253, 0xfd}, {&(0x7f0000001f80)=""/229, 0xe5}, {&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/14, 0xe}, {&(0x7f00000030c0)=""/73, 0x49}, {&(0x7f0000003140)=""/194, 0xc2}], 0x7, &(0x7f00000032c0)=""/231, 0xe7}, 0x8}, {{&(0x7f00000033c0)=@tipc=@name, 0x80, &(0x7f00000045c0)=[{&(0x7f0000003440)=""/118, 0x76}, {&(0x7f00000034c0)=""/4096, 0x1000}, {&(0x7f00000044c0)=""/213, 0xd5}], 0x3, &(0x7f0000004600)=""/150, 0x96}, 0x200}], 0x9, 0x40000000, &(0x7f0000004900)) ioctl$sock_inet6_SIOCDIFADDR(r0, 0x8936, &(0x7f0000004940)={@empty, 0x51, r4}) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r3, 0x84, 0x16, &(0x7f0000004b40)={0x8, [0x9, 0x3, 0x401, 0x6, 0x3, 0x100, 0x101, 0x80000001]}, 0x14) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) clone(0x4000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) 13:55:41 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a0") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000007a4"], 0x0, 0x0, 0x0}) 13:55:41 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x709000, 0x0, 0xf5) 13:55:41 executing program 3: open$dir(&(0x7f0000000040)='./bus\x00', 0x8800, 0x4) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:55:41 executing program 5: r0 = gettid() syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x8000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') [ 561.070796] binder: 16247:16249 BC_CLEAR_DEATH_NOTIFICATION invalid ref 117440512 13:55:41 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$inet6(0xa, 0x0, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) [ 561.132702] binder: BINDER_SET_CONTEXT_MGR already set [ 561.152772] binder: 16247:16249 ioctl 40046207 0 returned -16 13:55:41 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x200000005, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:55:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000048a4"], 0x0, 0x0, 0x0}) 13:55:41 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0xc0, 0x0, 0xf5) 13:55:41 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) [ 561.375492] binder: 16270:16271 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1207959552 [ 561.440208] binder: BINDER_SET_CONTEXT_MGR already set 13:55:41 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) fsetxattr(r0, &(0x7f0000000040)=@random={'btrfs.', '/dev/ptmx\x00'}, &(0x7f0000000140)='/dev/ptmx\x00', 0xa, 0x2) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000480)=ANY=[@ANYBLOB="92a0a7a6c98c01000004000000663eac9f000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e131e0c4471a6bef1fc0b2218960a2f566ffefd9d69a5f83ae904b31695207b84a6a8a7499f65030935d99119c00b9db06645d132a2714e5449a6ecb23b02f90d5f8e3a73fc11a834d95baa948a50ac4ea6dc3246b1031b9927130c80f75bb97884cc46350c92800130042b96639a5e57f484877e26e83d54520461d8bad7b655672394fef6e6b411b478ac22b42f8fab93af656f366ed62e39520f4ff657b72e2ee609fe0c40a9ebe5300bccdad3bb87df4b166dd1ce1ff965f370a8827d38531c6e951f85486b9e0d38775e352aa350331035b91cec117ba5c1233ff4bdddb454111de3107b955dc328c7e27f1cd012c19689"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) [ 561.489974] binder: 16270:16281 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1207959552 [ 561.494327] binder: 16270:16271 ioctl 40046207 0 returned -16 13:55:42 executing program 4: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='ns\x00') fchdir(r0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f00000002c0)=0x4, 0x4) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhci\x00', 0x0) read$eventfd(r1, &(0x7f0000000040), 0x0) r2 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) write$evdev(r2, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) r3 = add_key(&(0x7f0000000100)='logon\x00', &(0x7f0000000140)={'syz', 0x2}, &(0x7f0000000180)="2ff5df6768558ee94cd801bf24649b70b29c6f71c22b9a5433a70692f5669d0c025f29e8fdc00dc7895dbc4befc433b390795d81ce065ca04971648b17ce2bcd5fe8de249e155277d95189e1c3badc2883179c30bbcf2abe2e113c573d84dc7dd4d470b73e0201855eb61ff5ad5ab75b8b39b35b81fa3606728b03a78198a47405b52d", 0x83, 0xfffffffffffffffb) keyctl$describe(0x6, r3, &(0x7f0000000240)=""/87, 0x57) clone(0x8000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) 13:55:42 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:42 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x740000, 0x0, 0xf5) 13:55:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000006c00a4"], 0x0, 0x0, 0x0}) 13:55:42 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000040)='./bus\x00', 0x2) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:55:42 executing program 5: r0 = gettid() syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') [ 562.024842] binder: 16299:16300 BC_CLEAR_DEATH_NOTIFICATION invalid ref 7077888 [ 562.063997] binder: BINDER_SET_CONTEXT_MGR already set 13:55:42 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:42 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xfffffffffffffffc, 0x1, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf1763626ac35425a19414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) ioctl$FITRIM(r1, 0xc0185879, &(0x7f0000000040)={0x1, 0x400, 0x7f}) [ 562.090632] binder: 16299:16300 ioctl 40046207 0 returned -16 [ 562.127215] binder: 16299:16306 Acquire 1 refcount change on invalid ref 0 ret -22 13:55:42 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x700008000000000, 0x0, 0xf5) [ 562.164284] binder: 16299:16306 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 13:55:42 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x0, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c400000a400a4"], 0x0, 0x0, 0x0}) 13:55:42 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) r2 = dup2(0xffffffffffffffff, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) socket$inet_dccp(0x2, 0x6, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000140)={0x0, 0x101}, &(0x7f0000000180)=0xc) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f00000001c0)={r3, 0x8}, &(0x7f0000000200)=0xc) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x967) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) write$P9_RREAD(r1, &(0x7f0000000380)={0xc3, 0x75, 0x1, {0xb8, "1b70a495b50ee8e335a56a04f2fb3308d2ecf6bf2f9e35e6a3da8acd9bd170966e61c714364f0d353c185629bcf3f6e0303e79d67415d41b9c08b5b21a1f5a7d365a6ddc2f2e3b2435caaddc83c22e4cac313353c742e32b9a0ce665a88f0dfa4296108c80ebc15a971e35d8d915a0a67b42b65919796e738789d1568d6a84fc6608deb0258a4718960bf7edfc6768b3e820bf969c96eb47bd9e16888039facdd2aabcc6c7b1dae9f9db742e894a7c68454a8da67506e51b"}}, 0xc3) ioctl$TIOCMBIS(r0, 0x5416, &(0x7f0000000280)=0x3) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) ioctl$SG_SET_FORCE_PACK_ID(r2, 0x227b, &(0x7f00000002c0)) syz_open_dev$vbi(&(0x7f0000000040)='/dev/vbi#\x00', 0x0, 0x2) [ 562.315424] binder: 16329:16330 BC_CLEAR_DEATH_NOTIFICATION invalid ref 10747904 [ 562.354253] binder: BINDER_SET_CONTEXT_MGR already set [ 562.383916] binder: 16329:16330 ioctl 40046207 0 returned -16 13:55:54 executing program 4: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='ns\x00') openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x4000, 0x0) fchdir(r0) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) write$evdev(r1, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) 13:55:54 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x0, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:54 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x1d00008000000000, 0x0, 0xf5) 13:55:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c400000004ca4"], 0x0, 0x0, 0x0}) 13:55:54 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) dup3(r0, r0, 0x80000) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r3, r2) ioctl$VIDIOC_S_SELECTION(r1, 0xc040565f, &(0x7f0000000040)={0x5, 0x2, 0x6, {0x2, 0xffff, 0x100, 0x8}}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$KVM_GET_DEVICE_ATTR(r1, 0x4018aee2, &(0x7f0000000180)={0x0, 0x80, 0x7, &(0x7f0000000140)=0x9ea3}) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:55:54 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f0000000240)='sm\xd2x\xd5\xdd \x88\x1cb\xf1\xb8aps\x00\'\xb3r\x8ds:\xb2\xb7\x0e\xdca\x04\x06,\xfa\xcb?]E\x03\x8b?N\x10!g\xf1\xa8\xe0%\xe0\xa4\xa1K]S\xeb\xc7l\xf3P\x1dSF\x9c7=\xff\x00\xb1\xc1l\x02^\xa1M\x11)\xeb\xcf4\x84h\x14\x9b\x94\x80j_\xff\a\x00\x00\x00\x00\x00\x00\x00W\xa6') exit(0x0) migrate_pages(r0, 0x81, &(0x7f0000000000)=0x8, &(0x7f0000000040)=0xffffffffffffa381) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:55:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000060a4"], 0x0, 0x0, 0x0}) 13:55:54 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0x5, 0x0, 0x4000, 0x7ff, 0x0, 0x0, 0x4, 0xffffffffffff8000, 0xfffffffffffffffc, 0xffffffffffffffff}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup2(r3, r1) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f0000000140)={0x400000000000, 0xffffffff, 0x6, 0x0, 0x0, [{r4, 0x0, 0x5}, {r3, 0x0, 0x7}, {r3, 0x0, 0xae0b}, {r0, 0x0, 0x2}, {r2, 0x0, 0x7}, {r4, 0x0, 0x2}]}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) [ 574.260808] binder: 16350:16358 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1275068416 [ 574.279694] binder: BINDER_SET_CONTEXT_MGR already set [ 574.285318] binder: 16350:16358 ioctl 40046207 0 returned -16 13:55:54 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x0, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:54 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, 0x0, 0x0) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) [ 574.427731] binder: 16373:16374 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1610612736 13:55:54 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0xff600000, 0x0, 0xf5) 13:55:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000005a4"], 0x0, 0x0, 0x0}) [ 574.476827] binder: BINDER_SET_CONTEXT_MGR already set [ 574.490679] binder: 16373:16374 ioctl 40046207 0 returned -16 [ 574.603117] binder: 16391:16392 BC_CLEAR_DEATH_NOTIFICATION invalid ref 83886080 [ 574.647269] binder: BINDER_SET_CONTEXT_MGR already set [ 574.665982] binder: 16391:16392 ioctl 40046207 0 returned -16 13:55:58 executing program 4: syz_genetlink_get_family_id$nbd(0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000180)=ANY=[@ANYBLOB="0f"], 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$cgroup_pid(r1, &(0x7f0000000000), 0xfffffea6) 13:55:58 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x45) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:55:58 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, 0x0, 0x0) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:58 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0xb, 0x0, 0xf5) 13:55:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c400000006ca4"], 0x0, 0x0, 0x0}) 13:55:58 executing program 5: r0 = gettid() r1 = semget$private(0x0, 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) semtimedop(r1, &(0x7f0000000000)=[{0x3, 0x5}], 0x1, &(0x7f0000000080)={r2, r3+30000000}) syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') [ 577.758664] binder: 16406:16407 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1811939328 [ 577.792219] binder: BINDER_SET_CONTEXT_MGR already set 13:55:58 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, 0x0, 0x0) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:58 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) dup2(0xffffffffffffffff, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) [ 577.817036] binder: 16406:16407 ioctl 40046207 0 returned -16 13:55:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c400000007aa4"], 0x0, 0x0, 0x0}) 13:55:58 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040), 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:58 executing program 4: mmap(&(0x7f00001bf000/0x2000)=nil, 0x2000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8923, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6(0xa, 0x400000000001, 0x0) bind$inet6(r1, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r1, &(0x7f0000e77fff), 0x0, 0x20000008, 0x0, 0x0) 13:55:58 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x8000000000, 0x0, 0xf5) 13:55:58 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040), 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:58 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xa5, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523eb744a7a9afa78e2b403d91036b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc30800000000000000bb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0xffffffffffffffff, r1, 0x0, 0xa, &(0x7f0000000040)='/dev/ptmx\x00'}, 0x30) write$P9_RLOPEN(r1, &(0x7f00000001c0)={0x18, 0xd, 0x2, {{0xe, 0x0, 0x2}, 0x9}}, 0x18) sched_getparam(r4, &(0x7f0000000180)) [ 578.009481] binder: 16430:16431 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2046820352 [ 578.066564] binder: BINDER_SET_CONTEXT_MGR already set [ 578.115732] binder: 16430:16449 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2046820352 [ 578.119298] binder: 16430:16431 ioctl 40046207 0 returned -16 13:55:58 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) lsetxattr$trusted_overlay_opaque(&(0x7f0000000040)='./bus\x00', &(0x7f0000000140)='trusted.overlay.opaque\x00', &(0x7f0000000180)='y\x00', 0x2, 0x2) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x20) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:55:58 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040), 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:58 executing program 4: close(0xffffffffffffffff) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x802}) recvmsg(0xffffffffffffffff, 0x0, 0x0) write$cgroup_subtree(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="2b6d656d6f7279200003000000202d6d88646f7279200072646d61c3fc3672fad4b5ae5367870b3700c51290728756f5d905277153e183bd2e04e9146e06d98bc2e0f8b37aa8ea0f6a2dcfc512b26df0d6a4533d79589c2845bae1fb73611704a76cbfb24cf118cb584162fc7981550a404ae83948d972e62dbd9a296d4e65a8f4ce3fbf5e1f833a4081"], 0x8a) 13:55:58 executing program 5: r0 = gettid() r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_user\x00', 0x0, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000080)={0x2000}) syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:55:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c40000000a4a4"], 0x0, 0x0, 0x0}) 13:55:58 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0xffffffff00000000, 0x0, 0xf5) 13:55:58 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) 13:55:58 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000040)="f20e", 0x11b) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:55:58 executing program 4: r0 = socket$inet6(0xa, 0x2000000000001, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000687000)=0x9, 0x135) bind$inet6(r0, &(0x7f0000402000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x20000000, &(0x7f0000f62fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 13:55:59 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x0, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) [ 578.644621] binder: 16482:16483 BC_CLEAR_DEATH_NOTIFICATION invalid ref -1543503872 [ 578.651229] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 13:55:59 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$VIDIOC_DQEVENT(r3, 0x80885659, &(0x7f0000000140)={0x0, @ctrl={0x0, 0x0, @value64}}) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:55:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000700a4"], 0x0, 0x0, 0x0}) 13:55:59 executing program 4: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) mmap(&(0x7f00001bf000/0x2000)=nil, 0x2000, 0x0, 0x24011, r0, 0x0) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(0xffffffffffffffff, 0x4008240b, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8923, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) sched_setscheduler(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) getpeername$inet(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x400000000001, 0x0) bind$inet6(r2, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r2, &(0x7f0000e77fff), 0x0, 0x20000008, 0x0, 0x0) 13:55:59 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x8000000000000000, 0x0, 0xf5) 13:55:59 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, 0x0, &(0x7f0000000000)) [ 578.861938] binder: 16501:16502 BC_CLEAR_DEATH_NOTIFICATION invalid ref 458752 [ 578.892529] binder: BINDER_SET_CONTEXT_MGR already set [ 578.932430] binder: 16501:16502 ioctl 40046207 0 returned -16 13:55:59 executing program 5: r0 = gettid() syz_open_procfs(r0, &(0x7f0000000000)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:55:59 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) fsetxattr$security_ima(r1, &(0x7f0000000180)='security.ima\x00', &(0x7f00000001c0)=@md5={0x1, "38680c0b70f397e4ada69552cc78cd95"}, 0x11, 0x2) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) write$FUSE_NOTIFY_STORE(r1, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x3, 0x56d, 0x1, 0x0, [0x0]}}, 0x29) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) lsetxattr$trusted_overlay_redirect(&(0x7f0000000200)='./bus\x00', &(0x7f0000000280)='trusted.overlay.redirect\x00', &(0x7f00000002c0)='./bus\x00', 0x6, 0x2) r4 = dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write(r0, &(0x7f00000004c0)="f20e", 0x2) readlink(&(0x7f0000000380)='./bus\x00', &(0x7f00000003c0)=""/236, 0xec) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f5409876e700cd4de91abf98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8284208d4613c63361f10dff75dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c7"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) openat(r4, &(0x7f0000000140)='./bus\x00', 0x40, 0x2) 13:55:59 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x2000000, 0x0, 0xf5) 13:55:59 executing program 4: seccomp(0x0, 0x0, &(0x7f0000000000)={0x0, &(0x7f00000001c0)}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000200)='/dev/null\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@textreal={0x8, &(0x7f0000000240)="ba4300b00bee0f017edaf02114650f1ea7f07f0f20e06635040000000f22e03e0fc72dbaf80c66b80fb2578d66efbafc0cb001ee0fc75ba2f40f3805800060", 0x3f}], 0x1, 0x0, 0x0, 0x0) ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f00000000c0)={0x0, 0x6, 0x0, 0x6}) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000040)) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 13:55:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000004800a4"], 0x0, 0x0, 0x0}) 13:55:59 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, 0x0, &(0x7f0000000000)) [ 579.483978] binder: 16535:16539 BC_CLEAR_DEATH_NOTIFICATION invalid ref 4718592 [ 579.533808] binder: BINDER_SET_CONTEXT_MGR already set 13:55:59 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, 0x0, &(0x7f0000000000)) 13:55:59 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921edcf88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) [ 579.563745] binder: 16535:16539 ioctl 40046207 0 returned -16 13:56:00 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0xa000000, 0x0, 0xf5) 13:56:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000001000a4"], 0x0, 0x0, 0x0}) 13:56:00 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040)=0xa, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000c86000), 0x0) 13:56:00 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) write(r0, &(0x7f0000000100)="f20e", 0x2) ioctl$LOOP_CLR_FD(r4, 0x4c01) write$binfmt_aout(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de7a0f209c052a3c91a1f989377002000000b12ed909205c7333bb937dee28d4b2921ea4f8848626916a0dc38b518cdf620900edbb78b7551aba29e019176f9414d055deb4257df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e1300000000000038a791465e5646a623eca6690043382b90342d832665493c43bd6da6e1d16de0ba87cb00d1b392cf759c3c893492275e964cc604362cc735dc42ccc0258c0b7e88989a0bbaf9e7e898c16252663b379ef2575363d00abee727497b4c8224a0fb60e5d94950aa763810ac07b5196a3f02d972f607ee5f788288fbc74844258364331f6e31905c7e7933cded18cac56d79a5f7c739edc895ea92ab69f614777a08115cae198edbda1567e8a782d18f627d011da103cc243459d61b194310576b5ab1dc5aff83c079eb43c6cab9f5088d6904bb8ca7e5357c530cf7610c42cf278874a176824fd4"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)={0x0, 0xfffffffffffffffe, 0x9, 0xfffffffffffffffe, 0x800000000, 0x0, 0x5, 0x0, 0x0, 0x100000000000}) dup3(r2, r1, 0x80000) [ 579.790457] binder: 16559:16561 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1048576 [ 579.825485] binder: BINDER_SET_CONTEXT_MGR already set [ 579.857560] binder: 16559:16561 ioctl 40046207 0 returned -16 13:56:00 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x5) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') ioctl$KVM_IRQ_LINE_STATUS(r1, 0xc008ae67, &(0x7f0000000000)={0x6, 0x7}) 13:56:00 executing program 4: bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000340), 0x10) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r0) r1 = socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000380)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;<\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xc6\x0f\xd7\x14\x0f\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4N') r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x802}) recvmsg(r1, &(0x7f0000003f80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x16a571d0}, 0x0) gettid() write$cgroup_subtree(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="3b6d656d6f727920000300000020164e8864"], 0x12) 13:56:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000300a4"], 0x0, 0x0, 0x0}) 13:56:00 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @remote, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) 13:56:00 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x409a0200000000, 0x0, 0xf5) 13:56:00 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0x2, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001, 0x4}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) [ 580.378652] binder: 16583:16585 BC_CLEAR_DEATH_NOTIFICATION invalid ref 196608 13:56:00 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = socket(0x840000000002, 0x3, 0xff) connect$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) r2 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ipv6_route\x00') sendfile(r1, r2, 0x0, 0x100000001) [ 580.423099] binder: BINDER_SET_CONTEXT_MGR already set 13:56:00 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) r1 = creat(&(0x7f0000000240)='./bus\x00', 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EVIOCREVOKE(r1, 0x40044591, &(0x7f0000000040)=0x2) dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) [ 580.462320] binder: 16583:16585 ioctl 40046207 0 returned -16 13:56:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000006a4"], 0x0, 0x0, 0x0}) 13:56:00 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x50000000, 0x0, 0xf5) 13:56:00 executing program 1: socketpair$unix(0x1, 0x400000000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x0, 0xf, 0x0, 0x0) [ 580.581232] binder: 16605:16606 BC_CLEAR_DEATH_NOTIFICATION invalid ref 100663296 [ 580.602682] binder: BINDER_SET_CONTEXT_MGR already set [ 580.624420] binder: 16605:16606 ioctl 40046207 0 returned -16 13:56:01 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) dup2(r0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:56:01 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000000c0)='net/udp6\x00') write(r1, &(0x7f0000000000)="2f37c3c718be6af5607b72fedc2e5f257e382247d3f2141a3441c312fb194dabc0074be1e377fbc152bc15931acf219ff628653508d011b21a850cc3d6a6768238645e80183bc284305319cb2b9ea708ef3430203c2cd56fbd405c3c6d8af0dea29ff4a9dafb73339938b88cc74baae35d4a9a39736a0155b3e6f35d8331d715b3e880f639289a8cb92c9abde86d99316badb3bb96cbc7e6f17abfa07a777f274423abb47006b0", 0xa7) exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r1, 0x0, 0x44, 0xb2, &(0x7f0000000140)="1556787844b625803136589321346343b95627dd163fc1ce8099826f18b4a0b5af23713ce43ed41493657abe4882ac3b8f03fcb21c42e4cb643306a475099108bf00497d", &(0x7f00000001c0)=""/178, 0x800}, 0x28) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000068a4"], 0x0, 0x0, 0x0}) 13:56:01 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000240)=ANY=[@ANYBLOB="145f420000000000000007ff000000000300de56b5000000000000000000080000000000000008000500ac14141b080003000100000f01"], 0x1}}, 0x0) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="00b6fc663019d9476a25"], 0x1}}, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) lstat(&(0x7f0000000080)='./bus\x00', 0x0) open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f00000002c0)="b8010000000f01c166b8e2000f00d8b9800000c00f3235004000000f304a0fc75f20c44379608d00000100f22e0f01ca67440ff6143f66ba4000b846c95182ef0f01cf400f01df", 0x47}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 13:56:01 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0xfcfdffff00000000, 0x0, 0xf5) 13:56:01 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7aec98c01000004825e45a90f3d09876e700cd4de91205c7333bb937dee28d4b2921ea4f88486a9fc8275dd4a2691760dc38b518cdf620900ed617ff7855d4434a76d811ad4d4bb78b7559414d055deb4357df02d2eed24a7c27189c3003b2c00000000000000000000000000"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:56:01 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x5000000000000000, 0x0, 0xf5) [ 581.314782] binder: 16628:16635 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1744830464 [ 581.360163] binder: BINDER_SET_CONTEXT_MGR already set 13:56:01 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup2(r3, r1) ioctl$sock_kcm_SIOCKCMCLONE(r4, 0x89e2, &(0x7f0000000040)={r2}) setsockopt$inet_udp_int(r5, 0x11, 0xb, &(0x7f0000000140)=0x100, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:56:01 executing program 4: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='ns\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket(0xa, 0x1, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000340)={{{@in=@dev, @in=@multicast2}}, {{@in=@multicast2}, 0x0, @in=@multicast1}}, 0x0) syz_open_dev$sndseq(&(0x7f0000000540)='/dev/snd/seq\x00', 0x0, 0x2001) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @local}}}, 0x108) setsockopt$inet6_group_source_req(r1, 0x29, 0x2d, 0x0, 0x0) fchdir(r0) r2 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) write$evdev(r2, &(0x7f0000057fa0)=[{}, {{}, 0x4}], 0x30) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) eventfd2(0x2, 0x800) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000000040)=0x8, 0x4) ioctl$TIOCNXCL(r0, 0x540d) socket$nl_netfilter(0x10, 0x3, 0xc) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) socket$caif_seqpacket(0x25, 0x5, 0x1) [ 581.394464] binder: 16628:16635 ioctl 40046207 0 returned -16 [ 581.401121] kvm [16633]: vcpu0, guest rIP: 0x2db disabled perfctr wrmsr: 0xc2 data 0x4000 13:56:01 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x3f00, 0x0, 0xf5) [ 581.449229] kvm [16633]: vcpu0, guest rIP: 0x2db ignored wrmsr: 0x11e data 0xbe706111 13:56:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000400a4"], 0x0, 0x0, 0x0}) [ 581.519079] kvm [16633]: vcpu0, guest rIP: 0x2db disabled perfctr wrmsr: 0xc1 data 0x4000 13:56:01 executing program 3: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='ns\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket(0xa, 0x1, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000340)={{{@in=@dev, @in=@multicast2}}, {{@in=@multicast2}, 0x0, @in=@multicast1}}, 0x0) syz_open_dev$sndseq(&(0x7f0000000540)='/dev/snd/seq\x00', 0x0, 0x2001) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @local}}}, 0x108) setsockopt$inet6_group_source_req(r1, 0x29, 0x2d, 0x0, 0x0) fchdir(r0) r2 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) write$evdev(r2, &(0x7f0000057fa0)=[{}, {{}, 0x4}], 0x30) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) eventfd2(0x2, 0x800) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000000040)=0x8, 0x4) ioctl$TIOCNXCL(r0, 0x540d) socket$nl_netfilter(0x10, 0x3, 0xc) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) socket$caif_seqpacket(0x25, 0x5, 0x1) [ 581.560216] kvm [16633]: vcpu0, guest rIP: 0x2db disabled perfctr wrmsr: 0xc2 data 0x4000 [ 581.581425] binder: 16656:16657 BC_CLEAR_DEATH_NOTIFICATION invalid ref 262144 13:56:02 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) r4 = fcntl$getown(r3, 0x9) wait4(r4, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) [ 581.603621] kvm [16633]: vcpu0, guest rIP: 0x2db disabled perfctr wrmsr: 0x186 data 0x4000 [ 581.614606] binder: BINDER_SET_CONTEXT_MGR already set [ 581.620867] binder: 16656:16657 ioctl 40046207 0 returned -16 [ 581.632113] kvm [16633]: vcpu0, guest rIP: 0x2db disabled perfctr wrmsr: 0xc2 data 0x4000 [ 581.656467] kvm [16633]: vcpu0, guest rIP: 0x2db ignored wrmsr: 0x11e data 0xbe706111 [ 581.708422] kvm [16633]: vcpu0, guest rIP: 0x2db disabled perfctr wrmsr: 0xc2 data 0x4000 [ 581.740731] kvm [16633]: vcpu0, guest rIP: 0x2db ignored wrmsr: 0x11e data 0xbe706111 [ 581.769697] kvm [16633]: vcpu0, guest rIP: 0x2db disabled perfctr wrmsr: 0xc2 data 0x4000 [ 581.788783] kvm [16633]: vcpu0, guest rIP: 0x2db ignored wrmsr: 0x11e data 0xbe706111 [ 581.800247] kvm [16633]: vcpu0, guest rIP: 0x2db disabled perfctr wrmsr: 0xc2 data 0x4000 [ 581.821172] kvm [16633]: vcpu0, guest rIP: 0x2db ignored wrmsr: 0x11e data 0xbe706111 [ 581.850800] kvm [16633]: vcpu0, guest rIP: 0x2db disabled perfctr wrmsr: 0xc2 data 0x4000 [ 581.861376] kvm [16633]: vcpu0, guest rIP: 0x2db ignored wrmsr: 0x11e data 0xbe706111 [ 581.872203] kvm [16633]: vcpu0, guest rIP: 0x2db disabled perfctr wrmsr: 0xc2 data 0x4000 [ 581.882179] kvm [16633]: vcpu0, guest rIP: 0x2db ignored wrmsr: 0x11e data 0xbe706111 [ 581.903868] kvm [16633]: vcpu0, guest rIP: 0x2db ignored wrmsr: 0x11e data 0xbe706111 [ 581.915201] kvm [16633]: vcpu0, guest rIP: 0x2db ignored wrmsr: 0x11e data 0xbe706111 [ 581.926602] kvm [16633]: vcpu0, guest rIP: 0x2db ignored wrmsr: 0x11e data 0xbe706111 13:56:02 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000000080)='/dev/loop#\x00', 0x7, 0x800) ioctl$LOOP_GET_STATUS64(r0, 0x4c05, &(0x7f0000000100)) r1 = gettid() r2 = syz_open_procfs(r1, &(0x7f00000003c0)='smaps\x00') exit(0x80000) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') ioctl$DRM_IOCTL_GET_MAP(r2, 0xc0286404, &(0x7f0000000000)={&(0x7f0000ffb000/0x2000)=nil, 0x0, 0x7, 0x2, &(0x7f0000ffb000/0x1000)=nil, 0x80000000}) openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x400, 0x0) 13:56:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000600a4"], 0x0, 0x0, 0x0}) 13:56:02 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) setxattr$security_evm(&(0x7f0000000040)='./bus\x00', &(0x7f0000000140)='security.evm\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB="0414664d298a5e3521173c"], 0x4, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:56:02 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0xb00, 0x0, 0xf5) 13:56:02 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000180)={&(0x7f0000000000), 0x6f0, &(0x7f0000000140)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0xc, 0x2, [@IFLA_BOND_UPDELAY={0x8, 0x3, 0xf0ffffffffffff}]}}}]}, 0x3c}}, 0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/full\x00', 0x10000, 0x0) ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) lsetxattr$trusted_overlay_redirect(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='trusted.overlay.redirect\x00', &(0x7f00000000c0)='./file0\x00', 0x8, 0x1) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r3 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r4, r3) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r2, 0x84, 0x10, &(0x7f0000000200)=@sack_info={0x0, 0x28000000, 0x1}, &(0x7f0000000280)=0xc) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r3, 0x84, 0x71, &(0x7f00000002c0)={r5, 0xb832}, 0x8) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) 13:56:02 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) r4 = fcntl$getown(r3, 0x9) wait4(r4, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) [ 582.209702] binder: 16673:16674 BC_CLEAR_DEATH_NOTIFICATION invalid ref 393216 [ 582.240953] binder: BINDER_SET_CONTEXT_MGR already set 13:56:02 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) r4 = fcntl$getown(r3, 0x9) wait4(r4, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)) [ 582.273663] (unnamed net_device) (uninitialized): option miimon: invalid value (18446744073709551615) [ 582.298148] binder: 16673:16674 ioctl 40046207 0 returned -16 13:56:02 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x700, 0x0, 0xf5) [ 582.324515] (unnamed net_device) (uninitialized): option miimon: allowed values 0 - 2147483647 13:56:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000500a4"], 0x0, 0x0, 0x0}) 13:56:02 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xfdfdffff}) 13:56:02 executing program 3: r0 = gettid() syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:02 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x80000019, 0x0, 0xf5) [ 582.501223] binder: 16700:16701 BC_CLEAR_DEATH_NOTIFICATION invalid ref 327680 [ 582.561776] binder: BINDER_SET_CONTEXT_MGR already set [ 582.584974] binder: 16700:16701 ioctl 40046207 0 returned -16 13:56:03 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xfdfdffff}) 13:56:03 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) r4 = fcntl$getown(r3, 0x9) wait4(r4, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) 13:56:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000074a4"], 0x0, 0x0, 0x0}) 13:56:03 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400203) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:03 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x2, 0x0, 0xf5) [ 583.135707] binder: 16719:16720 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1946157056 [ 583.162443] binder: BINDER_SET_CONTEXT_MGR already set 13:56:03 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup2(r0, r1) sendmsg$alg(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000001c0)="566e718285b63d49a342a73143b4f83d70cec6c5acb377e7996cbae0ad60c2147b6236ee97da0692778c67a64fc678fb93b8902e1b4f65e89e41d6b6a43aa6688fc0b4d4186667bb5aa06897071e2d691b72ab070dd0919795f47637a49bda6127ffc7bf808dabb2dc42bebd5cb01e60", 0x70}, {&(0x7f0000000040)="eb600d2e16a36b9fddd0d387d99f8d06f79fcadb47f157c76cd5719237c34a0f60b4889917dc9c", 0x27}], 0x2, &(0x7f0000000240)=[@iv={0x88, 0x117, 0x2, 0x6f, "e7cc48a3f8851df8c9f21ecbaf501c9e9bf374913fe929d3782b1196c47fe037551631cfb7ac23aac7c7ae04c698104f516e0baeda6f8f7bce86d21edc167a0462b183660330f3179f6f5fd5b0af8521163a63397613878c9ab7803d0dba0696bdd64edb665529ff69c58f5d74e780"}], 0x88, 0x20044811}, 0x40) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000340)=0x0) r4 = syz_open_procfs(r3, &(0x7f00000003c0)='attr/dsc\x01eate\x00[5\x92\xd6\x18LcU^\xcc]0\x19\x92\xc26[b\xfa\xae\xdb|\xcb9\xd8m2\xbd\r\x987\xf3\x13\xc6\xd5\x10\x10[yq\xf5\xc5 \x9a\xc72\xcf\x95\xec\xec\xb5\xf3\xf8\aB\xfb\xf9\x12f\xdc\xb1k\xa6~\x19\xfd\xd7 \x0f\xa6\x10\xd1\xf5S)\xe8\x12)\xca_\x90\x81\xf7\x7f~\x1c\xd8\xd7\xe4\xb5Sm') preadv(r4, &(0x7f0000000440)=[{&(0x7f0000000380)}], 0x1, 0x0) ioctl$RTC_PLL_GET(r4, 0x80207011, &(0x7f0000000100)) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xa, 0x6400000000000000, 0x20) [ 583.196535] binder: 16719:16720 ioctl 40046207 0 returned -16 13:56:03 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) r4 = fcntl$getown(r3, 0x9) wait4(r4, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) 13:56:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000007a4"], 0x0, 0x0, 0x0}) 13:56:03 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x90700000000000, 0x0, 0xf5) 13:56:03 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup2(r0, r1) sendmsg$alg(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000001c0)="566e718285b63d49a342a73143b4f83d70cec6c5acb377e7996cbae0ad60c2147b6236ee97da0692778c67a64fc678fb93b8902e1b4f65e89e41d6b6a43aa6688fc0b4d4186667bb5aa06897071e2d691b72ab070dd0919795f47637a49bda6127ffc7bf808dabb2dc42bebd5cb01e60", 0x70}, {&(0x7f0000000040)="eb600d2e16a36b9fddd0d387d99f8d06f79fcadb47f157c76cd5719237c34a0f60b4889917dc9c", 0x27}], 0x2, &(0x7f0000000240)=[@iv={0x88, 0x117, 0x2, 0x6f, "e7cc48a3f8851df8c9f21ecbaf501c9e9bf374913fe929d3782b1196c47fe037551631cfb7ac23aac7c7ae04c698104f516e0baeda6f8f7bce86d21edc167a0462b183660330f3179f6f5fd5b0af8521163a63397613878c9ab7803d0dba0696bdd64edb665529ff69c58f5d74e780"}], 0x88, 0x20044811}, 0x40) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000340)=0x0) r4 = syz_open_procfs(r3, &(0x7f00000003c0)='attr/dsc\x01eate\x00[5\x92\xd6\x18LcU^\xcc]0\x19\x92\xc26[b\xfa\xae\xdb|\xcb9\xd8m2\xbd\r\x987\xf3\x13\xc6\xd5\x10\x10[yq\xf5\xc5 \x9a\xc72\xcf\x95\xec\xec\xb5\xf3\xf8\aB\xfb\xf9\x12f\xdc\xb1k\xa6~\x19\xfd\xd7 \x0f\xa6\x10\xd1\xf5S)\xe8\x12)\xca_\x90\x81\xf7\x7f~\x1c\xd8\xd7\xe4\xb5Sm') preadv(r4, &(0x7f0000000440)=[{&(0x7f0000000380)}], 0x1, 0x0) ioctl$RTC_PLL_GET(r4, 0x80207011, &(0x7f0000000100)) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xa, 0x6400000000000000, 0x20) [ 583.385864] binder: 16743:16745 BC_CLEAR_DEATH_NOTIFICATION invalid ref 117440512 [ 583.415567] binder: BINDER_SET_CONTEXT_MGR already set 13:56:03 executing program 3: r0 = gettid() syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:03 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) [ 583.437012] binder: 16743:16745 ioctl 40046207 0 returned -16 13:56:03 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup2(r0, r1) sendmsg$alg(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000001c0)="566e718285b63d49a342a73143b4f83d70cec6c5acb377e7996cbae0ad60c2147b6236ee97da0692778c67a64fc678fb93b8902e1b4f65e89e41d6b6a43aa6688fc0b4d4186667bb5aa06897071e2d691b72ab070dd0919795f47637a49bda6127ffc7bf808dabb2dc42bebd5cb01e60", 0x70}, {&(0x7f0000000040)="eb600d2e16a36b9fddd0d387d99f8d06f79fcadb47f157c76cd5719237c34a0f60b4889917dc9c", 0x27}], 0x2, &(0x7f0000000240)=[@iv={0x88, 0x117, 0x2, 0x6f, "e7cc48a3f8851df8c9f21ecbaf501c9e9bf374913fe929d3782b1196c47fe037551631cfb7ac23aac7c7ae04c698104f516e0baeda6f8f7bce86d21edc167a0462b183660330f3179f6f5fd5b0af8521163a63397613878c9ab7803d0dba0696bdd64edb665529ff69c58f5d74e780"}], 0x88, 0x20044811}, 0x40) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000340)=0x0) r4 = syz_open_procfs(r3, &(0x7f00000003c0)='attr/dsc\x01eate\x00[5\x92\xd6\x18LcU^\xcc]0\x19\x92\xc26[b\xfa\xae\xdb|\xcb9\xd8m2\xbd\r\x987\xf3\x13\xc6\xd5\x10\x10[yq\xf5\xc5 \x9a\xc72\xcf\x95\xec\xec\xb5\xf3\xf8\aB\xfb\xf9\x12f\xdc\xb1k\xa6~\x19\xfd\xd7 \x0f\xa6\x10\xd1\xf5S)\xe8\x12)\xca_\x90\x81\xf7\x7f~\x1c\xd8\xd7\xe4\xb5Sm') preadv(r4, &(0x7f0000000440)=[{&(0x7f0000000380)}], 0x1, 0x0) ioctl$RTC_PLL_GET(r4, 0x80207011, &(0x7f0000000100)) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xa, 0x6400000000000000, 0x20) 13:56:03 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) 13:56:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000010a4"], 0x0, 0x0, 0x0}) [ 583.650147] binder: BINDER_SET_CONTEXT_MGR already set [ 583.673766] binder: 16764:16765 ioctl 40046207 0 returned -16 13:56:04 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$getownex(r1, 0x10, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') munlockall() 13:56:04 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x1a00008000000000, 0x0, 0xf5) 13:56:04 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) 13:56:04 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup2(r0, r1) sendmsg$alg(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000001c0)="566e718285b63d49a342a73143b4f83d70cec6c5acb377e7996cbae0ad60c2147b6236ee97da0692778c67a64fc678fb93b8902e1b4f65e89e41d6b6a43aa6688fc0b4d4186667bb5aa06897071e2d691b72ab070dd0919795f47637a49bda6127ffc7bf808dabb2dc42bebd5cb01e60", 0x70}, {&(0x7f0000000040)="eb600d2e16a36b9fddd0d387d99f8d06f79fcadb47f157c76cd5719237c34a0f60b4889917dc9c", 0x27}], 0x2, &(0x7f0000000240)=[@iv={0x88, 0x117, 0x2, 0x6f, "e7cc48a3f8851df8c9f21ecbaf501c9e9bf374913fe929d3782b1196c47fe037551631cfb7ac23aac7c7ae04c698104f516e0baeda6f8f7bce86d21edc167a0462b183660330f3179f6f5fd5b0af8521163a63397613878c9ab7803d0dba0696bdd64edb665529ff69c58f5d74e780"}], 0x88, 0x20044811}, 0x40) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000340)=0x0) r4 = syz_open_procfs(r3, &(0x7f00000003c0)='attr/dsc\x01eate\x00[5\x92\xd6\x18LcU^\xcc]0\x19\x92\xc26[b\xfa\xae\xdb|\xcb9\xd8m2\xbd\r\x987\xf3\x13\xc6\xd5\x10\x10[yq\xf5\xc5 \x9a\xc72\xcf\x95\xec\xec\xb5\xf3\xf8\aB\xfb\xf9\x12f\xdc\xb1k\xa6~\x19\xfd\xd7 \x0f\xa6\x10\xd1\xf5S)\xe8\x12)\xca_\x90\x81\xf7\x7f~\x1c\xd8\xd7\xe4\xb5Sm') preadv(r4, &(0x7f0000000440)=[{&(0x7f0000000380)}], 0x1, 0x0) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xa, 0x6400000000000000, 0x20) 13:56:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000006a4"], 0x0, 0x0, 0x0}) [ 584.035518] binder: BINDER_SET_CONTEXT_MGR already set 13:56:04 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) 13:56:04 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup2(r0, r1) sendmsg$alg(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000001c0)="566e718285b63d49a342a73143b4f83d70cec6c5acb377e7996cbae0ad60c2147b6236ee97da0692778c67a64fc678fb93b8902e1b4f65e89e41d6b6a43aa6688fc0b4d4186667bb5aa06897071e2d691b72ab070dd0919795f47637a49bda6127ffc7bf808dabb2dc42bebd5cb01e60", 0x70}, {&(0x7f0000000040)="eb600d2e16a36b9fddd0d387d99f8d06f79fcadb47f157c76cd5719237c34a0f60b4889917dc9c", 0x27}], 0x2, &(0x7f0000000240)=[@iv={0x88, 0x117, 0x2, 0x6f, "e7cc48a3f8851df8c9f21ecbaf501c9e9bf374913fe929d3782b1196c47fe037551631cfb7ac23aac7c7ae04c698104f516e0baeda6f8f7bce86d21edc167a0462b183660330f3179f6f5fd5b0af8521163a63397613878c9ab7803d0dba0696bdd64edb665529ff69c58f5d74e780"}], 0x88, 0x20044811}, 0x40) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000340)=0x0) syz_open_procfs(r3, &(0x7f00000003c0)='attr/dsc\x01eate\x00[5\x92\xd6\x18LcU^\xcc]0\x19\x92\xc26[b\xfa\xae\xdb|\xcb9\xd8m2\xbd\r\x987\xf3\x13\xc6\xd5\x10\x10[yq\xf5\xc5 \x9a\xc72\xcf\x95\xec\xec\xb5\xf3\xf8\aB\xfb\xf9\x12f\xdc\xb1k\xa6~\x19\xfd\xd7 \x0f\xa6\x10\xd1\xf5S)\xe8\x12)\xca_\x90\x81\xf7\x7f~\x1c\xd8\xd7\xe4\xb5Sm') remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xa, 0x6400000000000000, 0x20) [ 584.066682] binder: 16776:16778 ioctl 40046207 0 returned -16 13:56:04 executing program 3: r0 = gettid() syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:04 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0xd00000000000000, 0x0, 0xf5) 13:56:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000002a4"], 0x0, 0x0, 0x0}) 13:56:04 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup2(r0, r1) sendmsg$alg(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000001c0)="566e718285b63d49a342a73143b4f83d70cec6c5acb377e7996cbae0ad60c2147b6236ee97da0692778c67a64fc678fb93b8902e1b4f65e89e41d6b6a43aa6688fc0b4d4186667bb5aa06897071e2d691b72ab070dd0919795f47637a49bda6127ffc7bf808dabb2dc42bebd5cb01e60", 0x70}, {&(0x7f0000000040)="eb600d2e16a36b9fddd0d387d99f8d06f79fcadb47f157c76cd5719237c34a0f60b4889917dc9c", 0x27}], 0x2, &(0x7f0000000240)=[@iv={0x88, 0x117, 0x2, 0x6f, "e7cc48a3f8851df8c9f21ecbaf501c9e9bf374913fe929d3782b1196c47fe037551631cfb7ac23aac7c7ae04c698104f516e0baeda6f8f7bce86d21edc167a0462b183660330f3179f6f5fd5b0af8521163a63397613878c9ab7803d0dba0696bdd64edb665529ff69c58f5d74e780"}], 0x88, 0x20044811}, 0x40) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000340)) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xa, 0x6400000000000000, 0x20) 13:56:04 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) [ 584.335112] binder: BINDER_SET_CONTEXT_MGR already set [ 584.360063] binder: 16796:16797 ioctl 40046207 0 returned -16 13:56:05 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) ioctl$sock_TIOCINQ(r1, 0x541b, &(0x7f0000000240)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$tipc(r1, &(0x7f00000000c0)={&(0x7f0000000000)=@name={0x1e, 0x2, 0x3, {{0x41, 0x3}, 0x4}}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000140)="0d666fe3fd648a31156144363570e15cd3b54bd2a86565d7f60bdbbfad13b14b354d7d14a1076d3bc719a98dc1cd4b5227511d1c513b165417ef0f6f040d68b46d7fd2e3840765daa1b97dece97c415dcff7a6b64439215a614d6c337cd9f517d5e74c67edefd4714ebf83244714ce5e3ac8cd047922f001465c6a54ba70d8aeb17ef1201fd1e198e36da3ba6889d7452ec011955bbfae996c5fa4c2c43b68f50da96cff0e7d7e22d415dde7ea03363d7f7a70d7d3e56a6807201c4c1068400c8eced4b9c40bbd452af50400765bb231f77e5fb31b0882e7a8a47ef7b0c9cbe33452b2b18607993a75880692cb3c3253929d2e74ba032731c9", 0xf9}], 0x1, &(0x7f0000000080)="1ef02ce20d26344aeeff286b278bbeac8ae76b4f34448522bf330aca98d15debd525917f44f130107c79f93c70c923425a4f404e32ff", 0x36, 0x8000}, 0x10) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') uname(&(0x7f0000000400)=""/4096) 13:56:05 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup2(r0, r1) sendmsg$alg(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000001c0)="566e718285b63d49a342a73143b4f83d70cec6c5acb377e7996cbae0ad60c2147b6236ee97da0692778c67a64fc678fb93b8902e1b4f65e89e41d6b6a43aa6688fc0b4d4186667bb5aa06897071e2d691b72ab070dd0919795f47637a49bda6127ffc7bf808dabb2dc42bebd5cb01e60", 0x70}, {&(0x7f0000000040)="eb600d2e16a36b9fddd0d387d99f8d06f79fcadb47f157c76cd5719237c34a0f60b4889917dc9c", 0x27}], 0x2, &(0x7f0000000240)=[@iv={0x88, 0x117, 0x2, 0x6f, "e7cc48a3f8851df8c9f21ecbaf501c9e9bf374913fe929d3782b1196c47fe037551631cfb7ac23aac7c7ae04c698104f516e0baeda6f8f7bce86d21edc167a0462b183660330f3179f6f5fd5b0af8521163a63397613878c9ab7803d0dba0696bdd64edb665529ff69c58f5d74e780"}], 0x88, 0x20044811}, 0x40) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xa, 0x6400000000000000, 0x20) 13:56:05 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) 13:56:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000004a4"], 0x0, 0x0, 0x0}) 13:56:05 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x4000000, 0x0, 0xf5) 13:56:05 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) dup2(r0, r1) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xa, 0x6400000000000000, 0x20) [ 584.964363] binder_thread_write: 4 callbacks suppressed [ 584.964376] binder: 16816:16823 BC_CLEAR_DEATH_NOTIFICATION invalid ref 67108864 13:56:05 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) [ 585.045729] binder: BINDER_SET_CONTEXT_MGR already set [ 585.051065] binder: 16816:16823 ioctl 40046207 0 returned -16 [ 585.107792] binder: 16816:16836 BC_CLEAR_DEATH_NOTIFICATION invalid ref 67108864 13:56:05 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000010a4"], 0x0, 0x0, 0x0}) 13:56:05 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xa, 0x6400000000000000, 0x20) 13:56:05 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0xf6ffffff, 0x0, 0xf5) 13:56:05 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) 13:56:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c400000006ca4"], 0x0, 0x0, 0x0}) [ 585.239945] binder: 16842:16843 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1811939328 [ 585.276559] binder: BINDER_SET_CONTEXT_MGR already set [ 585.300726] binder: 16849:16850 ioctl 40046207 0 returned -16 [ 585.306868] binder: BINDER_SET_CONTEXT_MGR already set [ 585.323762] binder: 16842:16843 ioctl 40046207 0 returned -16 [ 585.330780] binder: 16849:16850 Acquire 1 refcount change on invalid ref 0 ret -22 [ 585.343738] binder: 16849:16850 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 585.369148] binder: 16849:16850 BC_CLEAR_DEATH_NOTIFICATION invalid ref 268435456 13:56:06 executing program 5: r0 = gettid() syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:06 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xa, 0x6400000000000000, 0x20) 13:56:06 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) dup2(0xffffffffffffffff, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) 13:56:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c40000000a4a4"], 0x0, 0x0, 0x0}) 13:56:06 executing program 3: r0 = gettid() syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:06 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x1a000080, 0x0, 0xf5) [ 585.910296] binder: 16860:16868 BC_CLEAR_DEATH_NOTIFICATION invalid ref -1543503872 [ 585.946089] binder: BINDER_SET_CONTEXT_MGR already set 13:56:06 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) dup2(0xffffffffffffffff, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) 13:56:06 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xa, 0x6400000000000000, 0x20) [ 585.966013] binder: 16860:16868 ioctl 40046207 0 returned -16 13:56:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000003a4"], 0x0, 0x0, 0x0}) 13:56:06 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x5000, 0x0, 0xf5) 13:56:06 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xa, 0x6400000000000000, 0x20) 13:56:06 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) dup2(0xffffffffffffffff, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) [ 586.119303] binder: 16883:16884 BC_CLEAR_DEATH_NOTIFICATION invalid ref 50331648 [ 586.146823] binder: BINDER_SET_CONTEXT_MGR already set [ 586.154064] binder: 16883:16884 ioctl 40046207 0 returned -16 13:56:07 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000140)=0x20400, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') ioctl$VIDIOC_DBG_G_REGISTER(r1, 0xc0385650, &(0x7f0000000180)={{0x4, @name="285fd14694184ce6c44d6067b66ec7bda04d9cc7ce7e88ef9310602650b8e51b"}, 0x8, 0x8, 0x9}) sendmsg$TIPC_NL_MON_GET(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000400)={0x374, r3, 0x500, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_LINK={0xf4, 0x4, [@TIPC_NLA_LINK_PROP={0x54, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x100000001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xa0}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fffffff}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xc05}]}, @TIPC_NLA_LINK_PROP={0x54, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1ff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x96}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffffffffffbd}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x200}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}]}]}, @TIPC_NLA_BEARER={0x178, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x81, @mcast2, 0xfffffffffffffff9}}, {0x14, 0x2, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7}, @TIPC_NLA_BEARER_PROP={0x54, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x401}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffff9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffffffffff9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffffffff8001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xa2b}]}, @TIPC_NLA_BEARER_PROP={0x4}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10ad}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}]}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xab9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_PROP={0x54, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5bd}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'sit0\x00'}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @remote}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x9, @mcast1, 0x3}}}}]}, @TIPC_NLA_LINK={0x98, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x54, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xb9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1f6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffff9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x800}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000001}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xdbbc}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_MON={0x2c, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xffff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1}]}, @TIPC_NLA_SOCK={0xc, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}]}, @TIPC_NLA_NODE={0x24, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x8000}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x8}]}]}, 0x374}, 0x1, 0x0, 0x0, 0x10}, 0x1) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:07 executing program 3: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0xc0000001, 0x0, 0x0, 0xf5) 13:56:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000068a4"], 0x0, 0x0, 0x0}) 13:56:07 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xa, 0x6400000000000000, 0x20) 13:56:07 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) 13:56:07 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x1400000000000000, 0x0, 0xf5) [ 586.842962] binder: 16907:16909 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1744830464 13:56:07 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xa, 0x6400000000000000, 0x20) [ 586.884184] binder: BINDER_SET_CONTEXT_MGR already set 13:56:07 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) 13:56:07 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) [ 586.939194] binder: 16907:16909 ioctl 40046207 0 returned -16 13:56:07 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xa, 0x6400000000000000, 0x20) 13:56:07 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x209802, 0x0, 0xf5) 13:56:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c400000004ca4"], 0x0, 0x0, 0x0}) [ 587.170914] binder: 16936:16937 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1275068416 [ 587.196282] binder: BINDER_SET_CONTEXT_MGR already set [ 587.201756] binder: 16936:16937 ioctl 40046207 0 returned -16 13:56:08 executing program 1: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xa, 0x6400000000000000, 0x20) 13:56:08 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) 13:56:08 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000060a4"], 0x0, 0x0, 0x0}) 13:56:08 executing program 5: r0 = gettid() syz_open_procfs(r0, &(0x7f0000000040)='comm\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:08 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x80000007, 0x0, 0xf5) [ 587.779419] binder: 16949:16950 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1610612736 13:56:08 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) 13:56:08 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:08 executing program 1: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xa, 0x6400000000000000, 0x20) [ 587.836169] binder: BINDER_SET_CONTEXT_MGR already set [ 587.851601] binder: 16949:16950 ioctl 40046207 0 returned -16 13:56:08 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x940000, 0x0, 0xf5) [ 587.906943] binder: 16949:16956 Acquire 1 refcount change on invalid ref 0 ret -22 13:56:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000005a4"], 0x0, 0x0, 0x0}) 13:56:08 executing program 1: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xa, 0x6400000000000000, 0x20) 13:56:08 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:08 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) 13:56:08 executing program 1: socketpair$unix(0x1, 0x3, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xa, 0x6400000000000000, 0x20) [ 588.076968] binder: BINDER_SET_CONTEXT_MGR already set [ 588.088864] binder: 16975:16976 ioctl 40046207 0 returned -16 13:56:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000074a4"], 0x0, 0x0, 0x0}) [ 588.229253] binder: BINDER_SET_CONTEXT_MGR already set [ 588.252111] binder: 16990:16991 ioctl 40046207 0 returned -16 13:56:09 executing program 5: r0 = gettid() syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') ioctl$SG_GET_VERSION_NUM(r3, 0x2282, &(0x7f0000000040)) ioctl$DRM_IOCTL_RM_MAP(r2, 0x4028641b, &(0x7f0000000000)={&(0x7f0000ffb000/0x4000)=nil, 0x7, 0x7, 0x2, &(0x7f0000ffc000/0x2000)=nil, 0xfffffffffffffffc}) kcmp(r0, r0, 0x7, r3, r1) 13:56:09 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x40000000, 0x0, 0xf5) 13:56:09 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) 13:56:09 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:09 executing program 1: socketpair$unix(0x1, 0x3, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xa, 0x6400000000000000, 0x20) 13:56:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c400000007aa4"], 0x0, 0x0, 0x0}) [ 588.748307] binder: BINDER_SET_CONTEXT_MGR already set 13:56:09 executing program 1: socketpair$unix(0x1, 0x3, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xa, 0x6400000000000000, 0x20) [ 588.776582] binder: 16999:17011 ioctl 40046207 0 returned -16 13:56:09 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) 13:56:09 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:09 executing program 5: r0 = gettid() r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x6, 0x40) r2 = creat(&(0x7f0000000040)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) r3 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') write$USERIO_CMD_SEND_INTERRUPT(r2, &(0x7f0000000080)={0x2, 0x4}, 0x2) exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:09 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xa, 0x6400000000000000, 0x20) 13:56:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000048a4"], 0x0, 0x0, 0x0}) 13:56:09 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0xa0500000000000, 0x0, 0xf5) 13:56:09 executing program 4: creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) [ 589.015863] binder: BINDER_SET_CONTEXT_MGR already set 13:56:09 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:09 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xa, 0x6400000000000000, 0x20) [ 589.046190] binder: 17028:17033 ioctl 40046207 0 returned -16 13:56:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c400000000010"], 0x0, 0x0, 0x0}) 13:56:09 executing program 4: creat(0x0, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) 13:56:09 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x8000080, 0x0, 0xf5) 13:56:09 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xa, 0x6400000000000000, 0x20) 13:56:09 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) [ 589.216720] binder: 17049:17050 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 0000000000000010 [ 589.326350] binder: BINDER_SET_CONTEXT_MGR already set [ 589.369082] binder: 17049:17050 ioctl 40046207 0 returned -16 13:56:10 executing program 5: ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000000)=0x0) ptrace$getregs(0xc, r0, 0x0, &(0x7f0000000140)=""/217) r1 = gettid() syz_open_procfs(r1, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:10 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xa, 0x6400000000000000, 0x20) 13:56:10 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:10 executing program 4: creat(0x0, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) 13:56:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x48, 0x0, 0x0}) 13:56:10 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0xc0000001, 0x0, 0xf5) [ 589.865700] binder: 17074:17075 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:56:10 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:10 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xa, 0x6400000000000000, 0x20) [ 589.914071] binder: 17074:17075 ioctl c0306201 20000080 returned -14 13:56:10 executing program 4: creat(0x0, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) [ 589.958921] binder: BINDER_SET_CONTEXT_MGR already set 13:56:10 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xa, 0x6400000000000000, 0x20) [ 590.041441] binder: 17074:17075 ioctl 40046207 0 returned -16 13:56:10 executing program 4: creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) 13:56:10 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0xd000000, 0x0, 0xf5) 13:56:11 executing program 5: r0 = gettid() syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r2, 0xc0a85322, &(0x7f0000000000)) 13:56:11 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x700000000000000, 0x0, 0x0}) 13:56:11 executing program 4: creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) 13:56:11 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x6400000000000000, 0x20) 13:56:11 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x60ff, 0x0, 0xf5) 13:56:11 executing program 4: creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) [ 590.756819] binder: 17117:17119 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 590.789506] binder: 17117:17119 ioctl c0306201 20000080 returned -14 13:56:11 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x6400000000000000, 0x20) 13:56:11 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) dup2(0xffffffffffffffff, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:11 executing program 4: creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) [ 590.853061] binder: BINDER_SET_CONTEXT_MGR already set 13:56:11 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x9400, 0x0, 0xf5) 13:56:11 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x6400000000000000, 0x20) [ 590.902987] binder: 17117:17119 ioctl 40046207 0 returned -16 13:56:11 executing program 5: r0 = gettid() r1 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0xfffffffffffffbff, 0x40) ioctl$KVM_GET_NESTED_STATE(r1, 0xc080aebe, &(0x7f0000001740)={0x0, 0x0, 0x2080}) syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xed7, 0x40) 13:56:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x6c000000, 0x0, 0x0}) 13:56:11 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xa, 0x0, 0x20) 13:56:11 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x4000, 0x0, 0xf5) 13:56:11 executing program 4: creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) 13:56:11 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) dup2(0xffffffffffffffff, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:12 executing program 4: creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) [ 591.660864] binder: 17153:17157 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:56:12 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xa, 0x0, 0x0) 13:56:12 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) dup2(0xffffffffffffffff, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) [ 591.723732] binder: 17153:17157 ioctl c0306201 20000080 returned -14 [ 591.773878] binder: BINDER_SET_CONTEXT_MGR already set 13:56:12 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$EBT_SO_SET_COUNTERS(r1, 0x0, 0x81, &(0x7f0000000040)={'broute\x00', 0x0, 0x0, 0x0, [], 0x2, &(0x7f0000000000)=[{}, {}, {}], 0x0, [{}, {}]}, 0x98) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') [ 591.807978] binder: 17153:17157 ioctl 40046207 0 returned -16 13:56:12 executing program 4: creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) dup2(0xffffffffffffffff, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) 13:56:12 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:12 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x7ff3402c1000, 0x0, 0xf5) [ 591.860758] binder: 17153:17173 Acquire 1 refcount change on invalid ref 0 ret -22 [ 591.934638] binder_thread_write: 6 callbacks suppressed [ 591.934649] binder: 17153:17173 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 13:56:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x200000000000000, 0x0, 0x0}) 13:56:12 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:12 executing program 4: creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) dup2(0xffffffffffffffff, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) 13:56:12 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) 13:56:12 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:12 executing program 4: creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) dup2(0xffffffffffffffff, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) [ 592.099750] binder: 17197:17198 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 592.135298] binder: 17197:17198 ioctl c0306201 20000080 returned -14 13:56:12 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x800008000000000, 0x0, 0xf5) [ 592.183914] binder: BINDER_SET_CONTEXT_MGR already set [ 592.199852] binder: 17197:17198 ioctl 40046207 0 returned -16 13:56:12 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) [ 592.224496] binder: 17197:17206 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 592.262254] binder: 17197:17206 ioctl c0306201 20000080 returned -14 13:56:13 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$RDS_RECVERR(r1, 0x114, 0x5, &(0x7f0000000000), 0x4) r3 = request_key(&(0x7f0000000040)='id_resolver\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f00000000c0)='smaps\x00', 0xfffffffffffffff9) keyctl$negate(0xd, r3, 0xfffffffffffff001, r3) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000400)=ANY=[@ANYBLOB="0e0000000a000000fc390010d005a4975937857db4ded4534b0ffea766b0d50a278cea225ec931c9beac25a0f42ce576080f3f1a0da7300b7215a0770b001c7ee2ef8fe2a40482d451dcfaa83f876eef4c4a66c65a553ef3160d385d4a679ead5592dee519651b0d77c605f4fc2642c61d86fddf855ffde371bd23195aad651473fa4c754ea5d85245bfc20182a0af44f90a60e9bf64278063e606556e1c7ca52858d9779a55a795a91e780376b73c949e2ed67f3ddd5780e17521ea5ec947cfe0f9fc6afccb34c3b7ad3d8aa4e4855975239d68df1b5f9dedf0005214721fe6955a56f7edac0d103c9725f2d6c6ca2bb2c687b3f663c84f4613ca1aef9be77ac1da77051750e9171e5e2a646b6a3762a873dc41cf364adb41ea29e53513f2076a78d4e349e38f60f75bdd838bfd9f59567b3e69a79b6ef58a9bdecf4eaf0e2af4e7cea0b05e129154cb9b625f4666218c0ae71d3700a29578bc3f1fd14cca2bdef19781ff16267fcd9028ded5c83f465fbf61e3bfdb889b204e008a89f6317f316c6bb910a2fbad749a466a28853ef7e8b9659a879a7cac8bc583dfbc4ffdd3f9d2001183fd930e96d56d7861e3a139f0b5ae66cfd857e4b937944d64402b923df78c5df2e841e09b1a9cfdb9be49d1fce521a1eb1b1b81d19ec397d82bb958cc0384a4ef897436807cc3787a51b13114e495db58ee3ddfa27bc07cc7b5f6314490b6c943a7c7b5819d62333c6ec4fb5b55db03c75dd6ac875f9014c5f94b709ab82590ca4b06019ba505264dff6661d98c325f443b2bbe7cd574636d4b113d2530bff450e7b4d6312bee60ffe094958900652717f6434a893d2d6798124541b4286764526d0fa58f27490f2575e42463636f4b5fd36a728ecc388f8eaad266d34ae2bfadf1a5464745eff4b76e6c3a8e7186786141ae6ec21512526b450320e7779b099f0a6ecd89866dc3662b3e4a1d5f985b67c2f0aa1cce33b8e0ff90f6ccce9bc8cceae5cfaabf2c9173a60748193bd611bdefccb29dbe34f6ab1fd3bccc495a7046c36e604093a045388870b2632ced4309160ad71c87d23294f6f6da89ed5c2f310083e7fd1a7e3734044a945f1a0ff3a79a27a82aa287c1fc833ea4f458bfd7cefb218e5ac5ea35f84b53c194382004ac2ae8f3f19cf719996ce5fcbb30841f0c524b6755a1c84b2a3777c303ade3b6581937fbeafb46defbe65a567001057d78000e62a8b3a198d1d074edb59069369b9d49508fb90d7e22177d4e9c3747b92eee3461ce6c50c48d2e0429e111b4895b1ce630e226153ea3c69961215c1236d773d3023a5e787298d166902acf94d30941a0e789c8a63e0f31561d3cb4e098718d41bd3b45ad08801f46f0b62db15ba45486061eab4ab588a42539b484f4e6b4b89c414de3295c7cea16bb7531e3e20ac270fa26c4735d95365b6984643e70419c25a1ad8aff33153530e69037542b0789e43d1e9267e3786096878bec7702dce87ac3c3c6a0418045553a8a16faabf3e97cf22c1d5dc261b2a31fc418dd108e21606970b514726b4b9df9e0510bdc0d4931ede2161e90002069bb54ba76265d1fceb8984d2f824cbfe1b6ab4b04cddb4fad96c139c867921c410fa6da213481a19ee5f594e05a7e897956dace978bf55aadb03742cfbd0f9e6b2a59a10504710ff3185bd186141e385b22618684292d1abe5c3f67c51184dd121bb89234e74018e62f0ed2d8cbb4f455b981ab00406cdbffcf8a73d53bb35385193a98ec5f4d499bcd4b0d9f0224f5dfb4aa3bfd562862275f56603594a27f0afd33113b82ec798ff9819387da88d38079c81dbfa53231464170e143df32a62cfdb52b002016ed588ffc4b23db897fa8afc362fe34f1a89a1781f7bd4c6153022284e486406f614abd85cd63954bd164074cb15ce62699f87cf042e7a968622526e73d803cdd91302f08614d53954bb4c9d664ad1ec185c7f85b200e2b058a64d50f6b22d3c8fcdd075bab6ec1b2e5ddd647c7dece5e6a959081ecae79c7638534865feea3de40c20252008df9f587626fd83d575d1da90ade13a1af82fa798ecc246703fd2a3c7c6610e10097e1f8cbc7ab22c8cf848a6875e91b51fbe23142f2f1c8652f2fa03dcd3bda37626ab77d672aee22477b33797df3604c43c8bd560010bd72d4cafb6562bdced2ce66091035ccc8e444c38c6019c227d2970bdff0bd2ea9b68e62313274ef81861de9c4fe7896e22a6786a4749cf3763a4700ac7fafb85d33b749b3ed8ee9e8fbaa543936770f775368c79103e05c7081f92af8cca63be96b8a229d824b3aa607f076fdde9949b55e3b6988c5c1cf4fc17044c6b32bd340b54e6689063b498bbffc628e715bc5eeec091716bd45ee0a25b86ecf735604a2ee24d76defbed30545965e1ac5655c6686913cfced0f2ea51971918e195e42b6294f64b57ceb61a32b4323fb41dc2f3a172934de4cd8d23d9fd84892b4230772a2cd574970236f5e0ac976cf855b881dc189545a89dc5175100b984700d6e2d70830f293576e4cd44e7a756a7b24dfb88695e7a0ef8857a4c982df56ac7824c9c701af255daabc6feb9bf3878b619971692fe9220c324379f55b599c178492d07a17c6d3ed0f6a3f84d94924a15e636399300e711615ed4049313ff7b9417542898eeab30b93d9dd0409d3b2cc4d2004072a2f55cfc98daa874acfa9a30b96fee15e5b7f751d50cb9ae54bce455cdb96a2b4835832a153ca827d49c3e2737d49d3724a8677070374d7884eb9a1d85d51544b0afe06e83bc4482d40c77ceb8c44a306ce198d1e3e370666c426d9ce28191bd76d253b44e4bdc43a6e2985a6b23fa53afcfdda29df2ee90e99fa7792f94f39819bb6b406b3f14bb9433e330b900e7caf2d329b4cdea4769e058dce6345ba14608d103d624c6075fdfc6fe40af0041f8a9211dc6bef6885ca1ac14f7740cfec8fd034b0c51fa68b3d97d6b9ce538b3ace5e18c34a007f542dbec35495ebbcbf9c5f4107668d5ea0d01d11e1f75f74200b05d86c7b77aa0e1bffa500c976420a6ed3ae406cac9c05d7a1df92bd0a4fadbe5b62c9be4b14c8710ece2139edc1656703d01c69948a139b91cb7dfeba0e4deb6771e61c894e75d7b67f3bf1ebd1b29a044e66d378856d02811a5fdcc2c8db76e98d4a408e42b4bf2a1e61c5a1ea7f0c8f93da5c6e00a84a2d7752ac0edd678161736084cfa3b926c8df844b959e49bc50b942c93405e657dd0d507c34e87311ee8a74870cf988aad308a3907117a0b8ab1b41caf1f815072c1eec11196f0a78150afc9f0578a399f83e4b1345082d5369deeaafa98f40cd5ccee457e9e39d43d940571f242a6f020c1c3241eb14148e29e8f415bf108bec75bf99376cf4edb130b6b0533bdbd8153b9835c1afe60a07abf460c31f412dee72ab1e24933d43ba943059fddb9838f85f2c402b2f737e97e168940d384170210e2653b30a68d82b3bf0e087a819645cbf322ae162533f5c5c7e86d35cd280b5ce70c0b03474609c4e0fe240b17c8e41b44e6780e0c9f30bcbb857d7eb168d8468cd29f8c48249da8c05b12b2808e5f41872d42d43b192ead99314b44f522002eaab52029568119343c8c1463d0c8e35107ee5aecd88337e0ff572b04c5426c8714ff42fd4151d6ed139398002f75fda2d06ed142a3447779d514fe05cc9b211c27ee4fe53ea4229514408cadd939ddac8d460dea6236438f98d470a116fe3b3404027c35068c442c0c434d3b935ae907a4422dff280547bc26d18ecb3b0d9d4851fa326c5cf709d198860502ba40b48afc1235ff47fcd13ee44f679a367d6cfce18fb93b66942ddafa4b2958c8c6f2ee463bb3e70c904376d43576de548e9816da12a8955825f4534c8f9fe7e6bee7f5ace3a37f33fe2344b8f7b8fddb6533020470b71d08e874f6d9476a3ebb3889c538a0617b92aea4daaa96e46b53ca476bf96718e3c909cfa5bbfaf9e03c52ad782259d3ed4470315e2a99c39cbab0e0f4f705aa776a9ff1c0c593500f3011350e6d315951a5322ad02ac96a880aa428c5280b3fcf292b6a8ebfed51e8316f07bf147ca7a9c9ca793e3930d3dcfc4ea7be7185195c61a3453c26e1553049919b6bce4d099daf021705d028f25cbcf3ddbaf66553b4ffcf96a85be0c1e755749d112d133e82ef322d97c043809df6c72681694190d4291c2a65446641aa31369e3eb015ae7a8cbf76bc6a4ba72a517797e9a27335e7b35ee1d979248be5d241aa363da6f608a0b39958c193fac59602b79f3cd7436fa7764a58c572815afb25c60723ae54e2569b702a1afe45cd596c2a73e107f9255263d8a31165f199864a9ea77d3e17becf978e2930c71837af84743d6d2b235e45224c4e94db55aecc35eb7f13b7169b4cad56331211780867c1d10cbd918642eafb2b3d7bfb1659e5aff26adf6ad847c903c00b22471a419db2644495fe2ad30eb5ba5da4b495df9fbf9cdc61f1efa994348341e61a72a618b06b013a4aef85ef3a99782911d2aa96be19c7b8070967397bbd59e69e827680c50f7cf86d3701d731d84ce159d7d473a3c7772c030a6c9bc349b51758987c6aa2313c4aa4f6c0db72ffb7874a854a8f3290f5d8ca888d93da3071a4b432293e343bec929a9e0fda49399e5b8be4bf409224ed8e74d424ae9bb5b1e30bffee57ecb58f429a4272cd40d6a972e3b548ab9fa7ee602e1d3aeda84cac36995f8165f489b0605d374cd5641c021c272e112775f02d5c7827ac911956930e1a053c704098a0c0a6929c1c9f9b9225f4b061cd59f1dda062428850302b1d95820fa8dfb55dc5ef170b4e9874a7fd850ec9eb6e99c7b9c00c3821ea6e6c21294f8dea5f6576d496b54743dc81d17a59d7e351163bb7a485e1b462ef7d0a5609f403f033b5fb6fceb95996d12263f5e9691f4227fd9a25a531a716b237b0400072bc19dda87f82e538d0d39da65f98b2a49ee550ea23e838ef3ac9e9a70dc6bb9be214343e530575a7f4bac88a2f25ffbaf258fa28df3a5b477a7f81cccba79a8cca3c52530b30b9d3b5c1b7910e89e2f1f75c14429e1d07f263f9cf59b92f279c8dd3d46b539783794a5190d55bab8e0002841d5bd6db5aa69ade42de14cfab64e8c21bed1c02e4ebb50ef000b0cced56ef87bdcb3bce76d7da40e10ef62712401fbeb79aa36df814435a7185928ef648a3759a793b98549684396647444f7bbe3f80f396495c3dfd79534538a38e7d77e459400e21acb005d90e6a77de8ec09ce9f4c92e93898592af55e932680571477fff069dabab622988b47f28fb67b5e49b565c699b4c99e9d79541853665fa6e2760afad483f2fc19ac2c3374a842c0498956033ae67d1d7f975b96f96386033c503e6eed5012f4d5ffbb43fc3aae349a190db60b9a449d83fd7a683940d7fd76e140426c6bf08210fc8cc142cc1de443d18e090353c2eef13c8592eea8628795214ea1e6925dbffb4b6c6368a0b173739257c42a85e0939c074a6cb3dbe27c27a29d324bf5c729f39eb77ac132883f61a648363cc470dbbb30363f0364305d67f30f2ce21d91855ca196a2429abf59bd369ad72595066a9cf5706f3b395c455aa0a7cabdba19882b454a9e8aef2434291e5adf609f483810eb75ebafc33ebc81b0f96045ffd9780e04fb464539ab26d781129271680667fdff9f014135b48d20bc203bdb66fb5785886d62681def46715775494b1a46c0f55a0e52fab88c607ad08f2c3b5903c7423f8c9e25e93ca78d4211e2825bd03f28bc98e65965ed0000"], 0x100c) ioctl$SNDRV_CTL_IOCTL_HWDEP_NEXT_DEVICE(r1, 0xc0045520, &(0x7f0000000180)=0x4) keyctl$get_security(0x11, r3, &(0x7f0000000140)=""/15, 0xf) socket$packet(0x11, 0x3, 0x300) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:13 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) 13:56:13 executing program 4: creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) dup2(0xffffffffffffffff, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) 13:56:13 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x68000000, 0x0, 0x0}) 13:56:13 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x500000000000000, 0x0, 0xf5) [ 592.758527] binder: 17226:17227 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:56:13 executing program 4: creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) dup2(0xffffffffffffffff, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) [ 592.808946] binder: 17226:17227 ioctl c0306201 20000080 returned -14 [ 592.833161] binder: BINDER_SET_CONTEXT_MGR already set 13:56:13 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:13 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="92a0a7a6c98c0100000400000000000000000065750ede825e45a90f3d09876e700cd4de91a1f98937702d8f9523b12ed909205c7333bb937dee28d4b2921ea4f88486a91c8275dd4b26916a0dc38b518cdf620900edbb78b7559414d055deb4357df02d2eed24a7c27189c3003b2cbdae69c72000000000000000710e13"], 0x7e) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) [ 592.860854] binder: 17226:17227 ioctl 40046207 0 returned -16 13:56:13 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x3f00000000000000, 0x0, 0xf5) 13:56:13 executing program 4: creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) dup2(0xffffffffffffffff, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) [ 592.925580] binder: 17226:17227 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 592.935343] binder: 17226:17237 Acquire 1 refcount change on invalid ref 0 ret -22 13:56:13 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) [ 592.979184] binder: 17226:17227 ioctl c0306201 20000080 returned -14 [ 593.013325] binder: 17226:17237 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 593.244856] net_ratelimit: 10 callbacks suppressed [ 593.244863] protocol 88fb is buggy, dev hsr_slave_0 [ 593.254965] protocol 88fb is buggy, dev hsr_slave_1 13:56:14 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000000)={0x9, 0x8000, 0x7, 0x7fff, 0x0}, &(0x7f0000000040)=0x10) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r1, 0x84, 0x6c, &(0x7f0000000140)={r3, 0xc8, "2f3d38b9f876ec787b9cc403800064e69afd92ae9d76530ff7442807a2637b231f4c55f6beb4422f698817964aa1b3d68b8f8780a622fe5b725ca1d9382e4942d1c34933fc6420218f4582f128c85289356363af68ab8fffcb82146a6ee686d66923ea600d38039604158c23550faa73c33d799d1988507c331d4cd657fef2323723146042edf88a9211b656d864b5ac936e7ac633a86658db0cd432d435a199fdb919f58e82329a23048bd86407745dcce02a79ca0f904c2d97d82abc7d4b9afe8f4011bf5512cf"}, &(0x7f0000000080)=0xd0) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:14 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000000100)="f20e", 0x2) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) 13:56:14 executing program 4: creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) 13:56:14 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x3f000000, 0x0, 0x0}) 13:56:14 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0xf6ffffff00000000, 0x0, 0xf5) [ 593.748015] binder: 17262:17263 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:56:14 executing program 3: creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$TCSETAW(0xffffffffffffffff, 0x402c542c, &(0x7f00000000c0)) 13:56:14 executing program 4: creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) [ 593.795513] binder: 17262:17263 ioctl c0306201 20000080 returned -14 [ 593.818496] binder: BINDER_SET_CONTEXT_MGR already set 13:56:14 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) [ 593.844491] binder: 17262:17263 ioctl 40046207 0 returned -16 13:56:14 executing program 3: creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$TCSETAW(0xffffffffffffffff, 0x402c542c, &(0x7f00000000c0)) 13:56:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x7400, 0x0, 0x0}) 13:56:14 executing program 4: creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) [ 594.061982] binder: 17289:17295 Acquire 1 refcount change on invalid ref 0 ret -22 [ 594.090972] binder: 17289:17295 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 594.098956] binder: 17289:17291 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 594.107789] binder: 17289:17291 ioctl c0306201 20000080 returned -14 13:56:15 executing program 5: r0 = gettid() syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:15 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x20980200000000, 0x0, 0xf5) 13:56:15 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) 13:56:15 executing program 3: creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$TCSETAW(0xffffffffffffffff, 0x402c542c, &(0x7f00000000c0)) 13:56:15 executing program 4: creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) 13:56:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x1000000000000000, 0x0, 0x0}) [ 594.672988] binder: 17304:17305 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:56:15 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x5, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:15 executing program 4: creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) 13:56:15 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) [ 594.744539] binder: 17304:17305 ioctl c0306201 20000080 returned -14 [ 594.784355] binder: BINDER_SET_CONTEXT_MGR already set 13:56:15 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x7fff, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:15 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x5, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:15 executing program 4: creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) [ 594.817003] binder: 17304:17305 ioctl 40046207 0 returned -16 [ 594.852344] binder: 17304:17321 Acquire 1 refcount change on invalid ref 0 ret -22 [ 594.896508] binder: 17304:17321 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 13:56:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x74, 0x0, 0x0}) 13:56:15 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) 13:56:15 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:15 executing program 4: creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) 13:56:15 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x5) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:15 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x5, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) [ 595.579943] binder: 17346:17348 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:56:16 executing program 4: creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) 13:56:16 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:16 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) [ 595.637762] binder: 17346:17348 ioctl c0306201 20000080 returned -14 [ 595.693512] binder: BINDER_SET_CONTEXT_MGR already set 13:56:16 executing program 0: r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000180)='/dev/dlm_plock\x00', 0x20000, 0x0) shutdown(r0, 0x1) r1 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r3 = inotify_add_watch(r1, &(0x7f0000000080)='./file0\x00', 0x400) inotify_rm_watch(r1, r3) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$VHOST_SET_VRING_CALL(r1, 0x4008af21, &(0x7f0000000000)={0x0, r1}) syz_kvm_setup_cpu$x86(r1, r5, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:16 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) 13:56:16 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) [ 595.763783] binder: 17346:17369 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 595.765963] binder: 17346:17348 ioctl 40046207 0 returned -16 [ 595.785112] binder: 17346:17369 ioctl c0306201 20000080 returned -14 13:56:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0xa400, 0x0, 0x0}) 13:56:16 executing program 4: creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) wait4(0x0, &(0x7f0000000040), 0x21000000, &(0x7f0000000140)) 13:56:16 executing program 4: creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) wait4(0x0, 0x0, 0x21000000, &(0x7f0000000140)) 13:56:16 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) [ 595.969287] binder: 17383:17384 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 595.983696] binder: 17383:17384 ioctl c0306201 20000080 returned -14 [ 596.032397] binder: BINDER_SET_CONTEXT_MGR already set [ 596.048687] binder: 17383:17384 ioctl 40046207 0 returned -16 13:56:16 executing program 5: r0 = gettid() open$dir(&(0x7f0000000000)='./file0\x00', 0xc00, 0x100) r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) delete_module(&(0x7f0000000080)='smaps\x00', 0xa00) bind$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0x681cdd36fd144992, @host}, 0x10) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:16 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:16 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) write$P9_RLOPEN(r0, &(0x7f0000000000)={0x18, 0xd, 0x1, {{0x80, 0x0, 0x7}, 0x3ff}}, 0x18) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0x40a85323, &(0x7f0000000140)={{0x1f, 0xffffffffffdffff7}, 'port1\x00', 0x40, 0x3fffc, 0x0, 0xfffffffffffffffb, 0x7, 0x5, 0x8f44, 0x0, 0x2, 0xc994}) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:16 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) dup2(0xffffffffffffffff, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) 13:56:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x6800, 0x0, 0x0}) 13:56:16 executing program 4: creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) wait4(0x0, 0x0, 0x0, &(0x7f0000000140)) [ 596.510086] binder: 17401:17402 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:56:16 executing program 4: creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) wait4(0x0, 0x0, 0x0, &(0x7f0000000140)) 13:56:16 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:16 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) dup2(0xffffffffffffffff, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) [ 596.576337] binder: 17401:17402 ioctl c0306201 20000080 returned -14 [ 596.609621] binder: BINDER_SET_CONTEXT_MGR already set [ 596.637800] binder: 17401:17402 ioctl 40046207 0 returned -16 13:56:17 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000fe6000/0x18000)=nil, 0x0, 0xffffffffffffff55, 0x40000000, 0x0, 0x0) 13:56:17 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) dup2(0xffffffffffffffff, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) 13:56:17 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:17 executing program 5: socket$bt_bnep(0x1f, 0x3, 0x4) r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f0000000080)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x2000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000000)=0x4) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:17 executing program 4: creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) wait4(0x0, 0x0, 0x0, &(0x7f0000000140)) 13:56:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x500000000000000, 0x0, 0x0}) 13:56:17 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:17 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) 13:56:17 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') ioctl$KVM_PPC_ALLOCATE_HTAB(r2, 0xc004aea7, &(0x7f00000001c0)) sendmsg$TIPC_CMD_DISABLE_BEARER(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2001}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x2c, r3, 0x0, 0x70bd28, 0x25dfdbfc, {{}, 0x0, 0x4102, 0x0, {0x10, 0x13, @udp='udp:syz2\x00'}}, ["", "", "", "", "", ""]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000014}, 0x44040) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r4, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) [ 597.396759] binder: 17441:17442 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:56:17 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) 13:56:17 executing program 4: creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) wait4(0x0, 0x0, 0x21000000, 0x0) 13:56:17 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) [ 597.439663] binder: 17441:17442 ioctl c0306201 20000080 returned -14 [ 597.495803] binder: BINDER_SET_CONTEXT_MGR already set 13:56:17 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) sendto$isdn(r0, &(0x7f0000000140)={0xcb2e, 0x4, "d6c9d6ab342a89117b621ff19ea76d5dd38a3723e56727aa2552cf4167127d28f5f186dccefda3bb13ca527e8d2dad0515f7ac7952b1acad4c20f0058b168d88c92c5da8083b2d88394ac733a9514e3f7f4e5c696b2292d6fa097e728cf11e708cea24684341e9063eafc15a35689c400b6ee8b4a8e69e4b3152871012847ca3800f1c1316253b85039056d14b804acfbe5487d2e4ab22efc43e1951277eaad0cf4b12206bc4f2ca427c560ab52b8bb46b608fb05538f8e09f39aea859195be662641b7fc86b77eba9dc5fb2c97196e80eae2bff64cde44d510f1f84c086b46b191234ba1c5a72e08dce9b649f78b7403ed14dfb61fdea526a63"}, 0x102, 0x880, &(0x7f0000000000)={0x22, 0x4, 0xb2, 0x2, 0x20}, 0x6) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0x6, 0x2200) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x176, 0x0, 0x0, 0xf5) [ 597.529385] binder: 17441:17442 ioctl 40046207 0 returned -16 13:56:17 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:17 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) creat(&(0x7f0000000240)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) 13:56:18 executing program 5: r0 = gettid() r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x141000, 0x0) ioctl$EVIOCGSW(r1, 0x8040451b, &(0x7f0000000140)=""/203) syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:18 executing program 4: r0 = socket$kcm(0x29, 0x2, 0x0) close(r0) socket$kcm(0xa, 0x5, 0x0) sendmsg(r0, &(0x7f0000000280)={&(0x7f0000000080)=@in6={0xa, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1a0ffffffff], [], @dev}}, 0x80, &(0x7f0000000040)=[{&(0x7f0000000100)="c6", 0x1}], 0x1}, 0x41) 13:56:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x48000000, 0x0, 0x0}) 13:56:18 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:18 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) 13:56:18 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000140)={0x0, @in={{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x29}}}}, &(0x7f0000000000)=0x84) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000080)=@assoc_value={r1, 0x2}, &(0x7f00000000c0)=0x8) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r4, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) [ 598.268754] binder: 17489:17490 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:56:18 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) 13:56:18 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) [ 598.318825] binder: 17489:17490 ioctl c0306201 20000080 returned -14 13:56:18 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='smaps\x00') pread64(r0, 0x0, 0x0, 0x400000000000000) [ 598.385589] binder: BINDER_SET_CONTEXT_MGR already set [ 598.405908] binder: 17489:17490 ioctl 40046207 0 returned -16 13:56:18 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r2, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x3000000, 0x0, 0x0}) 13:56:18 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) dup2(0xffffffffffffffff, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) [ 598.554422] binder: 17514:17515 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 598.598554] binder: 17514:17515 ioctl c0306201 20000080 returned -14 [ 598.631665] binder: BINDER_SET_CONTEXT_MGR already set [ 598.638805] binder: 17514:17515 ioctl 40046207 0 returned -16 13:56:19 executing program 5: r0 = syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0x7, 0x84000) r1 = inotify_add_watch(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x100) write$P9_RLOCK(r0, &(0x7f0000000140)={0x8, 0x35, 0x1, 0x3}, 0x8) inotify_rm_watch(r0, r1) r2 = gettid() r3 = syz_open_procfs(r2, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$IP6T_SO_GET_REVISION_MATCH(r3, 0x29, 0x44, &(0x7f0000000000)={'NETMAP\x00'}, &(0x7f0000000040)=0x1e) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) 13:56:19 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0xd415, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x100000001}) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) 13:56:19 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000100)='maps\x00') preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000000)=""/37, 0xffc1}], 0x1, 0x0) 13:56:19 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) dup2(0xffffffffffffffff, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:19 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) write$P9_RSTAT(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="750000007d010000006e0001010001000040010000000500000000000000000000000008000004000000070000000000000009006d696d655f74797065060047504c2d2c2e0cff0067726f75702847504c282a2000255d7d63707573657473656375726974796b657972696e67657468305b29285d"], 0x75) 13:56:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x500, 0x0, 0x0}) 13:56:19 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) dup2(0xffffffffffffffff, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) [ 599.225741] binder: 17525:17531 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:56:19 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x5, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) 13:56:19 executing program 4: setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) r1 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) recvmmsg(r0, &(0x7f0000000200), 0x38c, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000000c0)={0x0}, &(0x7f0000000100)=0xc) syz_open_procfs$namespace(r2, &(0x7f0000000140)='ns/cgroup\x00') sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000000040), 0x4) [ 599.274903] binder: 17525:17531 ioctl c0306201 20000080 returned -14 [ 599.339500] binder: BINDER_SET_CONTEXT_MGR already set [ 599.358151] binder: 17525:17531 ioctl 40046207 0 returned -16 13:56:19 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000180), 0x13f, 0x20000000006}}, 0x20) syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x4, 0x10000) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:19 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) dup2(0xffffffffffffffff, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) [ 599.382415] binder: 17525:17546 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 599.399334] binder: 17525:17546 ioctl c0306201 20000080 returned -14 13:56:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x400000000000000, 0x0, 0x0}) [ 599.594927] binder: 17561:17562 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 599.628134] binder: 17561:17562 ioctl c0306201 20000080 returned -14 [ 599.636679] binder: BINDER_SET_CONTEXT_MGR already set [ 599.641996] binder: 17561:17562 ioctl 40046207 0 returned -16 13:56:20 executing program 1: creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$TCSETAW(0xffffffffffffffff, 0x402c542d, &(0x7f00000000c0)) 13:56:20 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) dup2(0xffffffffffffffff, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:20 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000000)={0x0, 0x2, 0x7, 0x2}) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:20 executing program 5: r0 = gettid() syz_open_procfs(r0, &(0x7f0000000000)='sma\x00\x00\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x4c000000, 0x0, 0x0}) [ 600.096277] binder: 17566:17567 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:56:20 executing program 1: creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$TCSETAW(0xffffffffffffffff, 0x402c542d, &(0x7f00000000c0)) [ 600.139227] binder: 17566:17567 ioctl c0306201 20000080 returned -14 [ 600.174185] binder: BINDER_SET_CONTEXT_MGR already set 13:56:20 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) dup2(0xffffffffffffffff, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) [ 600.195145] binder: 17566:17567 ioctl 40046207 0 returned -16 13:56:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x1000000, 0x0, 0x0}) [ 600.364531] binder: 17589:17590 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 600.391678] binder: 17589:17590 ioctl c0306201 20000080 returned -14 [ 600.410492] binder: BINDER_SET_CONTEXT_MGR already set [ 600.423690] binder: 17589:17590 ioctl 40046207 0 returned -16 13:56:20 executing program 4: setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) r1 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) recvmmsg(r0, &(0x7f0000000200), 0x38c, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000000c0)={0x0}, &(0x7f0000000100)=0xc) syz_open_procfs$namespace(r2, &(0x7f0000000140)='ns/cgroup\x00') sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000000040), 0x4) 13:56:20 executing program 1: creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$TCSETAW(0xffffffffffffffff, 0x402c542d, &(0x7f00000000c0)) 13:56:20 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xb094}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={r1, 0x90, &(0x7f0000000140)=[@in6={0xa, 0x4e22, 0x2, @empty, 0x1f}, @in={0x2, 0x4e23, @empty}, @in6={0xa, 0x4e24, 0xb733, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0xfffffffffffffffd}, @in6={0xa, 0x4e24, 0x40, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x8}, @in={0x2, 0x4e21, @empty}, @in6={0xa, 0x4e22, 0xffffffffffffff99, @ipv4={[], [], @loopback}, 0x48d}]}, &(0x7f0000000200)=0x10) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000380)=0x14) ioctl$KVM_SET_DEBUGREGS(r0, 0x4080aea2, &(0x7f0000000240)={[0x2, 0xd000, 0x1000, 0x6000], 0x2, 0x2, 0x100}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) fstatfs(r3, &(0x7f0000000300)=""/82) syz_kvm_setup_cpu$x86(r0, r0, &(0x7f0000fe5000/0x18000)=nil, 0x0, 0x6c, 0x0, 0x0, 0xffffffffffffff3c) 13:56:20 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x7000000, 0x0, 0x0}) 13:56:21 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x5, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) 13:56:21 executing program 0: sigaltstack(&(0x7f0000014000/0x4000)=nil, &(0x7f0000000000)) r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) [ 600.614263] binder: 17595:17602 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 600.698651] binder: 17595:17602 ioctl c0306201 20000080 returned -14 [ 600.716944] binder: BINDER_SET_CONTEXT_MGR already set [ 600.726052] binder: 17595:17602 ioctl 40046207 0 returned -16 13:56:21 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') fchmod(r1, 0x83) exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:21 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:21 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x5, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) 13:56:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x3, 0x0, 0x0}) 13:56:21 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x108ffb, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) fchmod(r3, 0x9) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) [ 601.031192] binder: 17626:17627 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 601.078603] binder: 17626:17627 ioctl c0306201 20000080 returned -14 [ 601.113326] binder: BINDER_SET_CONTEXT_MGR already set [ 601.133017] binder: 17626:17627 ioctl 40046207 0 returned -16 13:56:21 executing program 4: setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) r1 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) recvmmsg(r0, &(0x7f0000000200), 0x38c, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000000c0)={0x0}, &(0x7f0000000100)=0xc) syz_open_procfs$namespace(r2, &(0x7f0000000140)='ns/cgroup\x00') sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000000040), 0x4) 13:56:21 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:21 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x5, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) 13:56:21 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) r4 = socket(0x0, 0x8080e, 0x4) fsetxattr$security_capability(r4, &(0x7f0000000000)='security.capability\x00', &(0x7f0000000080)=@v1={0x1000000, [{0x6000000000000000, 0x2}]}, 0xc, 0x0) fsetxattr$trusted_overlay_nlink(r3, &(0x7f00000000c0)='trusted.overlay.nlink\x00', &(0x7f0000000140)={'L-', 0xfffffffffffffffd}, 0x28, 0x1) 13:56:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x6800000000000000, 0x0, 0x0}) 13:56:21 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) [ 601.520542] binder: 17641:17644 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:56:21 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) [ 601.561207] binder: 17641:17644 ioctl c0306201 20000080 returned -14 [ 601.633336] binder: BINDER_SET_CONTEXT_MGR already set [ 601.665943] binder: 17641:17656 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 601.705668] binder: 17641:17656 ioctl c0306201 20000080 returned -14 [ 601.718720] binder: 17641:17644 ioctl 40046207 0 returned -16 13:56:22 executing program 5: r0 = gettid() r1 = socket$isdn(0x22, 0x3, 0x22) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000080)={'vcan0\x00', &(0x7f0000000000)=@ethtool_dump={0x40, 0x566, 0x2, 0x3f, "83cb1558ec48e986246a81e5312fb0eb4b88bb4c259630bff2d6e197d6cd86533809177c76e29230bce405369b4aeb6678f056b4e32116f02d76653a456dad"}}) r2 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000240)={'bridge0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x16, 0x12, &(0x7f0000000140)=@framed={{0x18, 0x0, 0x0, 0x0, 0x932, 0x0, 0x0, 0x0, 0x3ff}, [@map={0x18, 0xf, 0x1, 0x0, r2}, @initr0={0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xfd}, @ldst={0x1, 0x3, 0x1, 0x0, 0x0, 0xfffffffffffffff8, 0x10}, @map={0x18, 0xf0736c19395e41a0, 0x1, 0x0, r2}, @ldst={0x3, 0x3, 0x3, 0x7, 0xa, 0x8, 0x11}, @exit, @alu={0x4, 0x100000001, 0xb, 0xd, 0x0, 0x4}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20}, @initr0={0x18, 0x0, 0x0, 0x0, 0x6}, @call={0x85, 0x0, 0x0, 0x1}]}, &(0x7f00000000c0)='syzkaller\x00', 0x50e, 0x0, &(0x7f0000000200), 0x0, 0x1, [], r3, 0xd}, 0x48) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:22 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) pwrite64(r1, &(0x7f0000000080)="6751e3458397f20c48bb845eaf5ca2110d40df0af93ea6ae51a167f3857b1022adb06f235cb5aae54e8158c4ef7411604bbe81a7e582afdc29", 0x39, 0x0) syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x4, 0x212000) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:22 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) 13:56:22 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x600000000000000, 0x0, 0x0}) [ 601.926783] binder: 17668:17669 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 601.997404] binder: 17668:17669 ioctl c0306201 20000080 returned -14 [ 602.053233] binder: BINDER_SET_CONTEXT_MGR already set [ 602.063741] binder: 17668:17669 ioctl 40046207 0 returned -16 13:56:22 executing program 4: setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) r1 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) recvmmsg(r0, &(0x7f0000000200), 0x38c, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000000c0)={0x0}, &(0x7f0000000100)=0xc) syz_open_procfs$namespace(r2, &(0x7f0000000140)='ns/cgroup\x00') sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000000040), 0x4) 13:56:22 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) 13:56:22 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:22 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x3, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x4000000, 0x0, 0x0}) [ 602.381390] binder: 17684:17685 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:56:22 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:22 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) [ 602.421726] binder: 17684:17685 ioctl c0306201 20000080 returned -14 [ 602.459032] binder: BINDER_SET_CONTEXT_MGR already set [ 602.464387] binder: 17684:17685 ioctl 40046207 0 returned -16 13:56:23 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0xfffffffffffffffd) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000000)={0x0, {0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x2, 0x4e22, @rand_addr=0x9}, 0x100, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x6, 0xff, 0x1}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') setxattr$security_selinux(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='security.selinux\x00', &(0x7f0000000140)='system_u:object_r:audisp_var_run_t:s0\x00', 0x26, 0x3) tee(r2, r3, 0x1, 0x6) 13:56:23 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) 13:56:23 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:23 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0xffffffffffffffff) syz_kvm_setup_cpu$x86(r0, r2, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) 13:56:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x7a000000, 0x0, 0x0}) [ 602.877177] binder: 17713:17715 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 602.922700] binder: 17713:17715 ioctl c0306201 20000080 returned -14 [ 602.932295] binder: BINDER_SET_CONTEXT_MGR already set [ 602.938660] binder: 17713:17715 ioctl 40046207 0 returned -16 13:56:23 executing program 4: setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) r1 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) recvmmsg(r0, &(0x7f0000000200), 0x38c, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000000c0)={0x0}, &(0x7f0000000100)=0xc) syz_open_procfs$namespace(r2, &(0x7f0000000140)='ns/cgroup\x00') sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 13:56:23 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) 13:56:23 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x600, 0x0, 0x0}) 13:56:23 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r2, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) [ 603.204951] binder: 17724:17726 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 603.217156] binder: 17724:17726 ioctl c0306201 20000080 returned -14 [ 603.244237] binder: BINDER_SET_CONTEXT_MGR already set 13:56:23 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) 13:56:23 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$sock_bt_cmtp_CMTPGETCONNLIST(r0, 0x800443d2, &(0x7f0000000080)={0x3, &(0x7f0000000000)=[{}, {}, {}]}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) [ 603.292714] binder: 17724:17726 ioctl 40046207 0 returned -16 13:56:24 executing program 5: r0 = gettid() syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') get_robust_list(r0, &(0x7f00000000c0)=&(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)}}, &(0x7f0000000140)=0x18) exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:24 executing program 3: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$TCSETAW(0xffffffffffffffff, 0x402c542c, &(0x7f00000000c0)) 13:56:24 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) 13:56:24 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0xfffffffffffffffc, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000000)="6800c9b45aeff7100c44286079baee6773b9d510ef578ead0a77", 0x1a) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x5, 0x0, 0x0}) [ 603.805196] binder: 17753:17756 ioctl c0306201 20000080 returned -14 [ 603.837807] binder: BINDER_SET_CONTEXT_MGR already set [ 603.849417] binder: 17753:17756 ioctl 40046207 0 returned -16 13:56:24 executing program 4: setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) r1 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) recvmmsg(r0, &(0x7f0000000200), 0x38c, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000000c0), &(0x7f0000000100)=0xc) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 13:56:24 executing program 0: openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) 13:56:24 executing program 3: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$TCSETAW(0xffffffffffffffff, 0x402c542c, &(0x7f00000000c0)) 13:56:24 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) 13:56:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x7400000000000000, 0x0, 0x0}) [ 604.096569] binder: 17769:17775 ioctl c0306201 20000080 returned -14 13:56:24 executing program 3: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$TCSETAW(0xffffffffffffffff, 0x402c542c, &(0x7f00000000c0)) [ 604.140183] binder: BINDER_SET_CONTEXT_MGR already set 13:56:24 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) [ 604.180491] binder: 17769:17775 ioctl 40046207 0 returned -16 13:56:25 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000000), 0x4) 13:56:25 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x400000, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r0, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffdb2) 13:56:25 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, 0x0) 13:56:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x74000000, 0x0, 0x0}) 13:56:25 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) dup2(0xffffffffffffffff, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) [ 604.677760] binder: 17792:17793 ioctl c0306201 20000080 returned -14 [ 604.706358] binder: BINDER_SET_CONTEXT_MGR already set [ 604.711690] binder: 17792:17793 ioctl 40046207 0 returned -16 13:56:25 executing program 4: setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) recvmmsg(r0, &(0x7f0000000200), 0x38c, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 13:56:25 executing program 3: r0 = memfd_create(&(0x7f0000000040)='\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="7f454c46000000000000c7fb1213000003"], 0x11) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execveat(r0, &(0x7f0000000100)='\x00', 0x0, 0x0, 0x1000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$cgroup_type(r2, 0x0, 0x0) 13:56:25 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) dup2(0xffffffffffffffff, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) 13:56:25 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) ioctl$DRM_IOCTL_ADD_MAP(r0, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffc000/0x3000)=nil, 0xf3, 0x3, 0x80, &(0x7f0000ff9000/0x4000)=nil, 0x66}) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0xa4, 0x0, 0x0}) 13:56:25 executing program 3: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000180)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendfile(r0, r0, 0x0, 0x27) syz_extract_tcp_res(0x0, 0x0, 0x0) 13:56:25 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) dup2(0xffffffffffffffff, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) [ 604.956414] binder: 17813:17819 ioctl c0306201 20000080 returned -14 13:56:25 executing program 5: r0 = dup(0xffffffffffffffff) ioctl$VIDIOC_SUBDEV_ENUM_MBUS_CODE(r0, 0xc0305602, &(0x7f0000000000)={0x0, 0x0, 0x1017, 0x1}) r1 = gettid() r2 = syz_open_procfs(r1, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x401200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x6000000, 0x0, 0x0}) 13:56:25 executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f000014f000)={0x0, 0x3de, &(0x7f0000000000)={&(0x7f0000006440)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@mcast1, @in=@multicast1=0xe0000008, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 13:56:25 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000000)=0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x8c241, 0x0) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-control\x00', 0x12001, 0x0) ioctl$KVM_SET_NR_MMU_PAGES(r2, 0xae44, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r0, 0xffffffffffffffff, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:25 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) dup2(0xffffffffffffffff, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) [ 605.586510] binder_thread_write: 4 callbacks suppressed [ 605.586525] binder: 17843:17844 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 605.641686] binder: 17843:17844 ioctl c0306201 20000080 returned -14 [ 605.689447] binder: BINDER_SET_CONTEXT_MGR already set [ 605.697645] binder: 17843:17844 ioctl 40046207 0 returned -16 [ 605.703980] binder: 17843:17844 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 605.717907] binder: 17843:17844 ioctl c0306201 20000080 returned -14 13:56:26 executing program 4: setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) recvmmsg(r0, &(0x7f0000000200), 0x38c, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 13:56:26 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) dup2(0xffffffffffffffff, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) 13:56:26 executing program 3: 13:56:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x4800, 0x0, 0x0}) 13:56:26 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_SET(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)={0x6c, r4, 0xa00, 0x70bd2c, 0x25dfdbfd, {}, [@TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xa1}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7035}]}, @TIPC_NLA_LINK={0x24, 0x4, [@TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}]}, @TIPC_NLA_NET={0x20, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0xffff}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x8}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xfdb5}]}]}, 0x6c}}, 0x44000) 13:56:26 executing program 3: 13:56:26 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) dup2(0xffffffffffffffff, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) [ 605.828890] binder: 17863:17867 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 605.900040] binder: 17863:17867 ioctl c0306201 20000080 returned -14 [ 605.934082] binder: BINDER_SET_CONTEXT_MGR already set [ 605.950930] binder: 17863:17867 ioctl 40046207 0 returned -16 13:56:26 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') ioctl$TIOCLINUX7(r1, 0x541c, &(0x7f0000000000)={0x7, 0x81}) exit(0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r1, 0x80045400, &(0x7f0000000040)) socket$unix(0x1, 0x5, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$FS_IOC_GETFSLABEL(r1, 0x81009431, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_open_procfs(r0, &(0x7f0000000080)='\x05\x9a\x1aZ3-d \xb1\x9c\xb9\n\xdb7\xa7J\x1f\x7f\x8b\x027g\x9d\v\xfe\b\x00\x00\x00\x11\xf1\x01tOL\xadl\xff\xab\xec\xa3\x9c&\xf4\xa5\xd6\x1e\x92}\xff\xb5\xbd\x92s\x90K\xd3\x12\x8dU\x93\x8c\xf6\x11\xbd{w\x13\xed\\\xeaEQ\xd5\xb1r)\xa8t\x10') 13:56:26 executing program 3: 13:56:26 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) 13:56:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x4c00000000000000, 0x0, 0x0}) 13:56:26 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x90400, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000000140)={0x81, {{0xa, 0x4e24, 0x8, @loopback, 0x100}}}, 0x88) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x800000000000000) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x0, 0x0) ioctl$KDSKBMODE(r4, 0x4b45, &(0x7f0000000200)=0x9) ioctl$KVM_ASSIGN_SET_MSIX_NR(r2, 0x4008ae73, &(0x7f0000000080)={0x5d, 0xbe}) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) ioctl$KVM_SET_GSI_ROUTING(r2, 0x4008ae6a, &(0x7f00000000c0)=ANY=[]) [ 606.515008] binder: 17888:17889 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 606.554907] binder: 17888:17889 ioctl c0306201 20000080 returned -14 [ 606.564344] binder: BINDER_SET_CONTEXT_MGR already set [ 606.569927] binder: 17888:17889 ioctl 40046207 0 returned -16 13:56:27 executing program 4: setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 13:56:27 executing program 3: 13:56:27 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) 13:56:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x6c00000000000000, 0x0, 0x0}) 13:56:27 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) rt_sigtimedwait(&(0x7f0000000000)={0x80000000}, &(0x7f0000000080), &(0x7f0000000140), 0x8) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000180)='/dev/dlm-monitor\x00', 0x490001, 0x0) 13:56:27 executing program 3: 13:56:27 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) [ 606.736329] binder: 17903:17910 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 606.890659] binder: 17903:17910 ioctl c0306201 20000080 returned -14 [ 606.950332] binder: BINDER_SET_CONTEXT_MGR already set [ 606.963816] binder: 17903:17910 ioctl 40046207 0 returned -16 13:56:27 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x3) r2 = syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') ioctl$EXT4_IOC_RESIZE_FS(r2, 0x40086610, &(0x7f0000000000)=0x9) 13:56:27 executing program 3: 13:56:27 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) rt_sigsuspend(&(0x7f0000000000)={0x80000000}, 0x8) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) rt_sigaction(0x9, &(0x7f0000000140)={&(0x7f0000000080)="d9f5f2450f1b3a3ef0450fc70b8fa958928c870c000000c4c17ff08300000081c4e3250256000cf3f04731190f01dcc441fdd7dec441d9dd5905", {}, 0x0, &(0x7f00000000c0)="0fa83666410f38307000c4414154a00f000000c4824bf7636e66440f79dec4a29bf77a01440f022f0f603d09000000c4c11d61eb2af2"}, 0x0, 0x8, &(0x7f0000000180)) exit(0x8) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) r4 = getpid() ioctl$BLKSECDISCARD(r2, 0x127d, &(0x7f00000002c0)=0x2) ioctl$KVM_S390_UCAS_UNMAP(r0, 0x4018ae51, &(0x7f0000000280)={0xfffffffffffffff7, 0x8}) ptrace$getsig(0x4202, r4, 0x9, &(0x7f0000000200)) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f00000001c0)) 13:56:27 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) 13:56:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0xfdfdffff, 0x0, 0x0}) 13:56:27 executing program 4: setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 13:56:27 executing program 3: [ 607.404163] binder: 17927:17928 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:56:27 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) 13:56:27 executing program 3: [ 607.498458] binder: 17927:17928 ioctl c0306201 20000080 returned -14 [ 607.540772] binder: BINDER_SET_CONTEXT_MGR already set 13:56:27 executing program 3: [ 607.571437] binder: 17927:17928 ioctl 40046207 0 returned -16 13:56:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x3f00, 0x0, 0x0}) 13:56:28 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) [ 607.700438] binder: 17950:17951 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 607.727055] binder: 17950:17951 ioctl c0306201 20000080 returned -14 [ 607.744600] binder: BINDER_SET_CONTEXT_MGR already set [ 607.765319] binder: 17950:17951 ioctl 40046207 0 returned -16 13:56:28 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:28 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) 13:56:28 executing program 3: 13:56:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x10, 0x0, 0x0}) 13:56:28 executing program 4: setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x88) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 13:56:28 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) getsockname$netlink(r0, &(0x7f0000000000), &(0x7f0000000080)=0xc) 13:56:28 executing program 3: [ 608.366110] binder: 17968:17978 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:56:28 executing program 3: 13:56:28 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) [ 608.406273] binder: 17968:17978 ioctl c0306201 20000080 returned -14 [ 608.422881] binder: BINDER_SET_CONTEXT_MGR already set [ 608.436374] binder: 17968:17978 ioctl 40046207 0 returned -16 13:56:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x6, 0x0, 0x0}) 13:56:28 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000001100)='net/route\x00') read(r0, &(0x7f0000000040)=""/4096, 0x1000) 13:56:28 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r0, r2, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) [ 608.608317] binder: 17990:17991 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 608.642412] binder: 17990:17991 ioctl c0306201 20000080 returned -14 [ 608.681859] binder: BINDER_SET_CONTEXT_MGR already set [ 608.695290] binder: 17990:17991 ioctl 40046207 0 returned -16 13:56:29 executing program 5: syz_open_procfs(0x0, &(0x7f00000003c0)='smaps\x00') exit(0x0) r0 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x200, 0x20000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000140)={{{@in6=@mcast2, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@mcast2}}, &(0x7f0000000040)=0xe8) r3 = getegid() getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000240)={{{@in, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in6}}, &(0x7f0000000080)=0xe8) getgroups(0x1, &(0x7f00000000c0)=[0x0]) r6 = getuid() lstat(&(0x7f0000000340)='./file0\x00', &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_DIRENTPLUS(r0, &(0x7f0000000480)=ANY=[@ANYBLOB="e801000000000000060000000000000004000000000000000200000000000000070000000000000004000000000000000000000006000000040000000000000059a4000000000000ff0f00000000000009000000000000007c7e00000000000006000000000000002000000009000000010100000400000009000000", @ANYRES32=r2, @ANYRES32=r3, @ANYBLOB="05000000ff070000000000000100000000000000000000000000000000000000040000000500000000000000030000000000000007000000000000000300000000000000010000005000000006000000000000007f0000001b00000000f8ffffffffffff0900000000000000000200003dfd000000000700000000000000050000000000000007000000030000000600", @ANYRES32=r4, @ANYRES32=r5, @ANYBLOB="08000000090000000000000000000000000000001e010000000000000600000000300000736d617073000000060000000000000003000000000000008f84de88ffffffff040000000000000001000000010000000300000000000000b6000000000000003e0000000000000003000000000000000010000000000000ff07000000000000030000000000008004000000ff00000009000000", @ANYRES32=r6, @ANYRES32=r7, @ANYBLOB="aa0d000007000000000000000000000000000000000000000000000006000000e50a0000736d617073000000"], 0x1e8) readlinkat(r0, &(0x7f0000000380)='./file0\x00', &(0x7f0000000680)=""/46, 0x2e) 13:56:29 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) ioctl$TCSETAW(r0, 0x402c542d, &(0x7f00000000c0)) 13:56:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x4800000000000000, 0x0, 0x0}) 13:56:29 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$urandom(0xffffffffffffff9c, &(0x7f0000000140)='/dev/urandom\x00', 0x42, 0x0) 13:56:29 executing program 0: openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) 13:56:29 executing program 4: setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x88) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 609.276558] binder: 18008:18009 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:56:29 executing program 1: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$TCSETAW(0xffffffffffffffff, 0x402c542d, &(0x7f00000000c0)) 13:56:29 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r0, 0xc058534b, &(0x7f0000000180)) [ 609.318831] binder: 18008:18009 ioctl c0306201 20000080 returned -14 [ 609.342437] binder: BINDER_SET_CONTEXT_MGR already set 13:56:29 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) getsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000140), &(0x7f0000000080)=0x8) syz_kvm_setup_cpu$x86(r0, r1, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) [ 609.395771] binder: 18008:18025 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 609.400091] binder: 18008:18009 ioctl 40046207 0 returned -16 [ 609.428379] binder: 18008:18025 ioctl c0306201 20000080 returned -14 13:56:29 executing program 1: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$TCSETAW(0xffffffffffffffff, 0x402c542d, &(0x7f00000000c0)) 13:56:29 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r0, 0xc058534b, &(0x7f0000000180)) 13:56:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0xa400000000000000, 0x0, 0x0}) [ 609.696513] binder: 18039:18040 ioctl c0306201 20000080 returned -14 [ 609.716299] binder: BINDER_SET_CONTEXT_MGR already set [ 609.721643] binder: 18039:18040 ioctl 40046207 0 returned -16 13:56:30 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) setsockopt$inet_udp_encap(r1, 0x11, 0x64, &(0x7f0000000000), 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$inet_udplite(0x2, 0x2, 0x88) syz_open_procfs(r0, &(0x7f0000001700)='fd/3\x00') 13:56:30 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0x5002}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000080)={0x1, &(0x7f0000000000)=[{}]}) 13:56:30 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vfio/vfio\x00', 0xfffffffffffffffd, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$VIDIOC_G_FREQUENCY(r0, 0xc02c5638, &(0x7f0000000000)={0x8, 0x0, 0x200}) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:30 executing program 1: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$TCSETAW(0xffffffffffffffff, 0x402c542d, &(0x7f00000000c0)) 13:56:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x300000000000000, 0x0, 0x0}) 13:56:30 executing program 4: setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x88) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 610.105701] binder: 18052:18056 ioctl c0306201 20000080 returned -14 [ 610.159029] binder: BINDER_SET_CONTEXT_MGR already set 13:56:30 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(&(0x7f0000000240)='./bus\x00', 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542d, 0x0) 13:56:30 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$sock_inet_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={0x0, {0x2, 0x4e22, @remote}, {0x2, 0x4e20, @multicast1}, {0x2, 0x4e22, @remote}, 0x4, 0x0, 0x0, 0x0, 0xc000000, &(0x7f0000000000)='rose0\x00', 0x2, 0x3, 0x4}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) [ 610.215391] binder: 18052:18056 ioctl 40046207 0 returned -16 13:56:30 executing program 3: 13:56:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x20000000, 0x0, 0x0}) 13:56:30 executing program 1: 13:56:30 executing program 3: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$usbmon(&(0x7f00000002c0)='/dev/usbmon#\x00', 0x0, 0x4000) [ 610.483082] binder: 18076:18077 ioctl c0306201 20000080 returned -14 [ 610.514695] binder: BINDER_SET_CONTEXT_MGR already set [ 610.545920] binder: 18076:18077 ioctl 40046207 0 returned -16 13:56:31 executing program 5: r0 = gettid() syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x3ff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) openat$capi20(0xffffffffffffff9c, &(0x7f0000000000)='/dev/capi20\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs(r0, &(0x7f00000000c0)='net/tcp\x00') 13:56:31 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$VIDIOC_G_OUTPUT(r0, 0x8004562e, &(0x7f0000000000)) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:31 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/igmp6\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r1, &(0x7f00000017c0), 0x1fe, 0x400000000000) preadv(r0, &(0x7f0000002440)=[{&(0x7f0000000440)=""/4096, 0x1000}, {&(0x7f0000000280)=""/237, 0xed}, {0x0}], 0x3, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, 0x0) r2 = getpgid(0x0) sched_setscheduler(r2, 0x2, &(0x7f0000000100)=0x7) 13:56:31 executing program 1: memfd_create(0x0, 0x0) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) close(r0) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) 13:56:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x2000, 0x0, 0x0}) 13:56:31 executing program 4: setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f00000092c0), 0x4ff, 0x0) [ 611.016018] binder_thread_write: 3 callbacks suppressed [ 611.016032] binder: 18088:18096 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:56:31 executing program 1: memfd_create(0x0, 0x0) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) close(r0) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) 13:56:31 executing program 4: setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 611.153727] binder: 18088:18096 ioctl c0306201 20000080 returned -14 13:56:31 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) setitimer(0x1, &(0x7f0000000080)={{}, {0x0, 0x7530}}, &(0x7f00000000c0)) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) [ 611.196942] binder: BINDER_SET_CONTEXT_MGR already set [ 611.215018] binder: 18088:18096 ioctl 40046207 0 returned -16 13:56:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x7a00, 0x0, 0x0}) 13:56:31 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000000)={0x0, 0x0, 0x81, 0x6}) [ 611.430415] binder: 18118:18119 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 611.445172] binder: 18118:18119 ioctl c0306201 20000080 returned -14 [ 611.487730] binder: BINDER_SET_CONTEXT_MGR already set [ 611.540408] binder: 18118:18122 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 611.543703] binder: 18118:18119 ioctl 40046207 0 returned -16 [ 611.572973] binder: 18118:18122 ioctl c0306201 20000080 returned -14 13:56:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x68, 0x0, 0x0}) [ 611.802328] binder: 18126:18127 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 611.853857] binder: 18126:18127 ioctl c0306201 20000080 returned -14 [ 611.880751] binder: BINDER_SET_CONTEXT_MGR already set [ 611.896017] binder: 18126:18127 ioctl 40046207 0 returned -16 13:56:32 executing program 5: r0 = gettid() syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) prctl$PR_GET_DUMPABLE(0x3) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') getsockopt$inet_mreq(r2, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @local}, &(0x7f0000000080)=0x8) ioctl$KVM_GET_REGS(r2, 0x8090ae81, &(0x7f0000000100)) 13:56:32 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='clear_refs\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = syz_open_procfs(0x0, &(0x7f00000001c0)='cpuset\x00') sendfile(r3, r5, 0x0, 0x1) r6 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)={0xdc, r7, 0x4, 0x70bd2b, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DAEMON={0x44, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x8001}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x80000000}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x5}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}]}, @IPVS_CMD_ATTR_DAEMON={0x48, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_to_team\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x8}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x80000000}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x27}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x24}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xfff}]}, 0xdc}, 0x1, 0x0, 0x0, 0x20000005}, 0x20000000) syz_kvm_setup_cpu$x86(r0, r6, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:32 executing program 3: clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) write$P9_RLERRORu(r0, &(0x7f0000000180)=ANY=[@ANYBLOB="ff816e5398bd2e5a777d9b3e6eaa476ed5ee27cf3a74448b0ce87c6effb9f16fdfcf5a3037d51c88c3e2fb136a15627ddeed3965ad2991ad6c11fdda2651a78c87eda89a797bc5ceb3c327d15a810e2677959ad26c30044cc6a658eee00b87febd69366ef42432f59f3c8d24a3696144d85e0679c9cd353b74110d78a51207598332bdbb98eef217426c4a9e62c4e3e014902ae4bf217c4462e7274667819978be981cfae8e1b5f31af25600d9d501a2e3ed0000000000"], 0xb7) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) execve(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) 13:56:32 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 13:56:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x6000000000000000, 0x0, 0x0}) 13:56:32 executing program 1: memfd_create(0x0, 0x0) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) close(r0) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) 13:56:32 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg(r0, &(0x7f000000b780)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000044c0)=[{0x10, 0x1}], 0x10}}], 0x1, 0x0) [ 612.066925] binder: 18149:18152 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 612.157581] binder: 18149:18152 ioctl c0306201 20000080 returned -14 13:56:32 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000000)={0x127ff, 0x0, 0x0, 0x2000, &(0x7f0000ffc000/0x2000)=nil}) ioctl$KVM_GET_MSR_INDEX_LIST(r1, 0xc004ae02, &(0x7f0000000180)={0x1, [0x0, 0x0, 0x0]}) ioctl$KVM_X86_GET_MCE_CAP_SUPPORTED(r0, 0x8008ae9d, &(0x7f0000000080)=""/108) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:32 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x5c}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000000180), 0x40000000000034f, 0x0) 13:56:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0xfdfdffff00000000, 0x0, 0x0}) [ 612.402784] binder: 18169:18171 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 612.459132] binder: 18169:18171 ioctl c0306201 20000080 returned -14 [ 612.498662] binder: BINDER_SET_CONTEXT_MGR already set 13:56:32 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) umount2(&(0x7f0000000000)='./file0\x00', 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) [ 612.520171] binder: 18169:18171 ioctl 40046207 0 returned -16 13:56:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0xa4000000, 0x0, 0x0}) [ 612.711684] binder: 18180:18181 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 612.747304] binder: 18180:18181 ioctl c0306201 20000080 returned -14 [ 612.757652] binder: BINDER_SET_CONTEXT_MGR already set [ 612.763090] binder: 18180:18181 ioctl 40046207 0 returned -16 13:56:33 executing program 5: r0 = gettid() r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x7fffffff, 0xa03) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r1, 0x408c5333, &(0x7f0000000040)={0xd572f03, 0x5, 0x8, 'queue0\x00', 0x1}) r2 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f0000000240)={0xffffffffffffffff, 0x9, 0x4, 0x0, 0x4, 0x0, 0x0, 0x1ff, 0x0}, &(0x7f0000000280)=0x20) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r2, 0x84, 0x79, &(0x7f00000002c0)={r3, 0x5, 0x6}, 0x8) exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000140)={@in={{0x2, 0x4e22, @remote}}, 0x0, 0x1000, 0x0, "33fda1a2e1e9e47e0ce080b56317a1fae6683889b00bfb8b494733d6594a70bbf40d26f9406274310c29aecba658ca91cad19213d4adb71a0b182a71bbce1e29b894a06a6649c1f0926b5182fba5c0b2"}, 0xd8) getsockopt$inet6_mreq(r1, 0x29, 0x1c, &(0x7f0000000300)={@dev, 0x0}, &(0x7f0000000340)=0x14) setsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000380)={@remote, @broadcast, r5}, 0xc) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:33 executing program 3: symlink(&(0x7f00000000c0)='..', 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x801c581f, 0x0) getpgrp(0x0) r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x82) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) 13:56:33 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x800, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:33 executing program 4: r0 = socket$inet6(0xa, 0x0, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 13:56:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x60000000, 0x0, 0x0}) 13:56:33 executing program 1: memfd_create(0x0, 0x0) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) close(r0) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) 13:56:33 executing program 1: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000140)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) clone(0x201fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x0) read(r0, &(0x7f0000004d00)=""/4096, 0x100000088) stat(0x0, 0x0) [ 613.186140] binder: 18197:18198 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 613.223188] binder: 18197:18198 ioctl c0306201 20000080 returned -14 13:56:33 executing program 3: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) r1 = dup(r0) sendmsg$nl_netfilter(r1, &(0x7f00000001c0)={&(0x7f0000000080), 0xc, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x10) 13:56:33 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 13:56:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x2000000, 0x0, 0x0}) [ 613.310364] input: syz1 as /devices/virtual/input/input7 13:56:33 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) ioctl$FS_IOC_GETFLAGS(r0, 0x80086601, &(0x7f0000000000)) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) [ 613.419212] binder: 18224:18225 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 613.454218] binder: 18224:18225 ioctl c0306201 20000080 returned -14 [ 613.473310] binder: BINDER_SET_CONTEXT_MGR already set [ 613.482747] binder: 18224:18225 ioctl 40046207 0 returned -16 13:56:33 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000000040)=@getnetconf={0x14, 0x52, 0x7c3324e99b989539}, 0x14}}, 0x0) 13:56:34 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000140)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) ioctl$UI_SET_MSCBIT(r0, 0x40045568, 0x0) 13:56:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x4c00, 0x0, 0x0}) 13:56:34 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$EVIOCGSW(r2, 0x8040451b, &(0x7f0000000200)=""/235) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r0, 0xc08c5336, &(0x7f0000000140)={0x8, 0xfff, 0x1f, 'queue0\x00', 0x587d1c5e}) 13:56:34 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r1, 0x10e, 0x2, &(0x7f0000000000)=0x1, 0x4) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000040), &(0x7f0000000080)=0xc) 13:56:34 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 13:56:34 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000140)={{}, 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) read(r0, 0x0, 0x0) [ 614.043934] input: syz1 as /devices/virtual/input/input8 [ 614.067948] binder: 18236:18243 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 614.136086] input: syz1 as /devices/virtual/input/input10 [ 614.149415] binder: 18236:18243 ioctl c0306201 20000080 returned -14 [ 614.208360] binder: BINDER_SET_CONTEXT_MGR already set [ 614.238422] binder: 18236:18243 ioctl 40046207 0 returned -16 13:56:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0xfffffdfd, 0x0, 0x0}) [ 614.285929] input: syz1 as /devices/virtual/input/input11 13:56:34 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000140)={'filter\x00', 0xc5, "dcdfea06791ad502df8d734f4aa9c4c6b9b157a99db689320571429941aa836c2a42cad30241bd9c4bb2721afb85a59c48c7aad7f978b7699066a561f3091def8dcd0f020be1a02718b4bb882ebd8e9447496c896d322429235d9234591b44b3e63309d6e37c757bd186f8887f3c04f23c510ded152661306b9e4ea72b1de4ac1b254fb760b0dc561283db83c81a6f85301575421fe3cfcda6b91a78ef04d4395b4e5a240ab1cb3595e0d48a2ffdf124c887d3e69ac448cef0243ff3696414eb35700febfd"}, &(0x7f0000000000)=0xe9) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r2) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) 13:56:34 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000480)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCPKT(r0, 0x541f, 0x0) [ 614.390325] input: syz1 as /devices/virtual/input/input12 [ 614.435348] binder: 18260:18261 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:56:34 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$unix(0x1, 0x10000000002, 0x0) bind$unix(r1, &(0x7f0000003000)=@abs={0x1}, 0x8) 13:56:34 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 614.495368] binder: 18260:18261 ioctl c0306201 20000080 returned -14 13:56:34 executing program 1: clone(0x3102001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x4000000080000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0xa) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x20000003}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 614.546442] binder: BINDER_SET_CONTEXT_MGR already set [ 614.551767] binder: 18260:18261 ioctl 40046207 0 returned -16 13:56:35 executing program 3: r0 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000380)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_TRY_FMT(r0, 0xc0d05640, &(0x7f0000000080)={0x2, @vbi}) 13:56:35 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) [ 614.623328] ptrace attach of "/root/syz-executor1"[18280] was attempted by "/root/syz-executor1"[18281] 13:56:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x300, 0x0, 0x0}) [ 614.832024] binder: 18291:18293 ioctl c0306201 20000080 returned -14 [ 614.868353] binder: BINDER_SET_CONTEXT_MGR already set [ 614.878518] binder: 18291:18293 ioctl 40046207 0 returned -16 [ 614.894047] binder: 18291:18293 ioctl c0306201 20000080 returned -14 13:56:35 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') ptrace$getregs(0xe, r0, 0x6, &(0x7f0000000140)=""/202) exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, &(0x7f0000000000)={0x0, 0xffffffffffffff9c}) 13:56:35 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000140)={0x0, 0x7e, "91696297cc7f3e750038e548eca8f949d9167ef5d32455e2d513fec7ea0141b9f1686d9f9b4b17fa8c8e6f815b5b4de08ad372b8f0f4e18fec0ebebba3710c86ec37be5ac664de1c0865fa728f24367d9805f9bf064ced48b3e87bb103a154fb53a25398fe0f10a02361995ecaf526fe35759114033ea9660dcf7e3e7d79"}, &(0x7f00000000c0)=0x86) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000200)={r2, @in6={{0xa, 0x4e23, 0x3, @mcast2, 0x7ff}}, 0x20, 0x1374}, 0x90) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r4 = syz_open_dev$dspn(&(0x7f00000002c0)='/dev/dsp#\x00', 0x2, 0x2080) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f0000000300)={r2, 0x6, 0x20}, &(0x7f0000000340)=0xc) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r5, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) ioctl$KDMKTONE(r4, 0x4b30, 0x0) ioctl$VIDIOC_TRY_EXT_CTRLS(r0, 0xc0205649, &(0x7f0000000080)={0x990000, 0x8, 0x751, [], &(0x7f0000000000)={0x9a0918, 0x1, [], @ptr=0x3}}) 13:56:35 executing program 3: r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r1, 0x0, 0x0, 0x5c0d) sendfile(r0, r1, 0x0, 0x8000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:35 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:35 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 13:56:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x6c00, 0x0, 0x0}) [ 615.015633] binder: 18308:18309 ioctl c0306201 20000080 returned -14 [ 615.068208] binder: BINDER_SET_CONTEXT_MGR already set 13:56:35 executing program 3: r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r1, 0x0, 0x0, 0x5c0d) sendfile(r0, r1, 0x0, 0x8000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:35 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) [ 615.126254] binder: 18308:18309 ioctl 40046207 0 returned -16 13:56:35 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x90, 0x0) sync_file_range(r0, 0x6, 0x7fff, 0x6) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) ioctl$TIOCGPTPEER(r0, 0x5441, 0x1000) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x7704, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:35 executing program 3: r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r1, 0x0, 0x0, 0x5c0d) sendfile(r0, r1, 0x0, 0x8000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:35 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x7a, 0x0, 0x0}) [ 615.341089] binder: 18327:18331 ioctl c0306201 20000080 returned -14 13:56:36 executing program 5: gettid() prctl$PR_GET_TIMERSLACK(0x1e) exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) r0 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x2) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') write$FUSE_IOCTL(r0, &(0x7f0000000380)={0x20, 0xfffffffffffffffe, 0x6, {0x8, 0x0, 0x2, 0x6}}, 0x20) sendmsg$TIPC_NL_MON_SET(r0, &(0x7f00000002c0)={&(0x7f0000000040), 0xc, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="5c00f965da77fbdfc12380e17024fa6276c00000", @ANYRES16=r1, @ANYBLOB="10002abd7000fbdbdf25110000004800010044000400200001000a004e2001000000ff02000000000000000000000000000106000000200002000a004e22edc1000000000000000000000000ffffe000000101000000"], 0x5c}, 0x1, 0x0, 0x0, 0x40881}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x4001fe) gettid() ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000300)={0x3, &(0x7f0000000280)=[{}, {}, {}]}) r2 = syz_open_procfs(0x0, &(0x7f0000000140)='\xe7\x05z\xac\x13;\x81a\x80O\x80\xc6z\xec\xbe\x80\x91$\xa5z\xc8\x1e\xfe\xa3Q\xec\x0fE\x19\xa8a\xee\xad\xc8\xc1\xaf@\x88e\x93-\xd7w\xfd\x92\x9f\xde\xb1\x1c\xda\x9e\x9d\xb3\xa7b\x80z\xd7}\xfcS2\xde)\x03\x03+\xbf\a\x00\x00\x00\x00\x00\x00\x00\b\xe4\xaa\x8d\xd2\x8d\xc1\x8b\x19\xd2\x96\xd1#\xf1\x001\x19~2\"\xc1\xe3l\x8a6X\xf7\xdf\xd2\x9b\x1c\xbf\x1e\x10\f\xe4\x80\x9b0\x89\xafjg+\xbf\x15\x0177\xe1\xb0\xd7\xd8\xf9\r\x0e\x91\xe9\xd6\x93\x00\x00\x00\x00\x00\x00\xa2\xb2\x00') ioctl$sock_inet_SIOCSIFBRDADDR(r2, 0x891a, &(0x7f0000000340)={'bcsf0\x00', {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}}) setsockopt$IP_VS_SO_SET_FLUSH(r0, 0x0, 0x485, 0x0, 0x0) 13:56:36 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x2000000000000000, 0x0, 0x0}) 13:56:36 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x10400, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:36 executing program 3: r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r1, 0x0, 0x0, 0x5c0d) sendfile(r0, r1, 0x0, 0x8000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:36 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 615.903149] binder: 18343:18352 ioctl c0306201 20000080 returned -14 13:56:36 executing program 3: r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r1, 0x0, 0x0, 0x5c0d) sendfile(r0, r1, 0x0, 0x8000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) [ 615.947481] binder: BINDER_SET_CONTEXT_MGR already set 13:56:36 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) [ 616.008791] binder: 18343:18352 ioctl 40046207 0 returned -16 13:56:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x700, 0x0, 0x0}) 13:56:36 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x0, 0x0) epoll_pwait(r0, &(0x7f0000000080)=[{}, {}, {}], 0x3, 0xe4, &(0x7f00000000c0)={0x6}, 0x8) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) rt_sigsuspend(&(0x7f0000000140)={0x901}, 0xfe46) 13:56:36 executing program 3: r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r1, 0x0, 0x0, 0x5c0d) sendfile(r0, r1, 0x0, 0x8000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:36 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) [ 616.173607] binder_thread_write: 5 callbacks suppressed [ 616.173622] binder: 18366:18367 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 616.297962] binder: 18366:18367 ioctl c0306201 20000080 returned -14 [ 616.341131] binder: BINDER_SET_CONTEXT_MGR already set [ 616.374913] binder: 18366:18367 ioctl 40046207 0 returned -16 13:56:37 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000000040)=0x800, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(r2) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x4001fe) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:37 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:37 executing program 3: r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r1, 0x0, 0x0, 0x5c0d) sendfile(r0, r1, 0x0, 0x8000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:37 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) read(0xffffffffffffffff, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(0xffffffffffffffff, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x6000, 0x0, 0x0}) 13:56:37 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 616.833824] binder: 18392:18393 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:56:37 executing program 3: r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r1, 0x0, 0x0, 0x5c0d) sendfile(r0, r1, 0x0, 0x8000) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:37 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) [ 616.907880] binder: 18392:18393 ioctl c0306201 20000080 returned -14 13:56:37 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r2, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x4c, 0x0, 0x0}) 13:56:37 executing program 3: r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r1, 0x0, 0x0, 0x5c0d) sendfile(r0, r1, 0x0, 0x8000) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:37 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) [ 617.170036] binder: 18408:18409 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 617.261279] binder: 18408:18409 ioctl c0306201 20000080 returned -14 [ 617.291317] binder: BINDER_SET_CONTEXT_MGR already set [ 617.300755] binder: 18408:18409 ioctl 40046207 0 returned -16 13:56:38 executing program 5: r0 = gettid() syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') ioctl$SIOCGETNODEID(r2, 0x89e1, &(0x7f0000000000)) 13:56:38 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000000)=0x100, 0x4) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:38 executing program 3: r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r1, 0x0, 0x0, 0x5c0d) sendfile(r0, r1, 0x0, 0x8000) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x60, 0x0, 0x0}) 13:56:38 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bind$alg(0xffffffffffffffff, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r1 = accept$alg(0xffffffffffffffff, 0x0, 0x0) read(r1, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r1, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:38 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 617.745614] binder: 18427:18428 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:56:38 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) [ 617.818026] binder: 18427:18428 ioctl c0306201 20000080 returned -14 13:56:38 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r1 = accept$alg(r0, 0x0, 0x0) read(r1, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r1, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) [ 617.872424] binder: BINDER_SET_CONTEXT_MGR already set 13:56:38 executing program 0: openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket(0x11, 0x800, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, &(0x7f0000000080)={0x0, 0x4004400}) mmap(&(0x7f0000919000/0x400000)=nil, 0x400000, 0x2, 0x10, 0xffffffffffffffff, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000440)}}, 0x20) ioctl$HDIO_GETGEO(0xffffffffffffffff, 0x301, &(0x7f00000000c0)) r2 = open(&(0x7f0000001580)='./file0\x00', 0x240000, 0x82) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f00000001c0)) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000340)={0x2, 0x4, 0x0, 0x2}) sync_file_range(0xffffffffffffffff, 0x6, 0x8, 0x1) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000000580)={0x8, {{0xa, 0x4e23, 0x9, @mcast1}}}, 0x88) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) r3 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82) r4 = memfd_create(&(0x7f0000000180)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x0) pwritev(r4, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81806) stat(&(0x7f0000000400)='./file0\x00', &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r6 = getegid() mount$fuseblk(&(0x7f0000000300)='/dev/loop0\x00', &(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)='fuseblk\x00', 0x0, &(0x7f0000000780)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x1000}, 0x2c, {'user_id', 0x3d, r5}, 0x2c, {'group_id', 0x3d, r6}, 0x2c, {[{@blksize={'blksize', 0x3d, 0xa00}}, {@max_read={'max_read', 0x3d, 0x4}}, {@blksize={'blksize', 0x3d, 0x1600}}, {@max_read={'max_read', 0x3d, 0x401}}, {@allow_other='allow_other'}, {@allow_other='allow_other'}, {@max_read={'max_read', 0x3d, 0x399d}}, {@blksize={'blksize', 0x3d, 0x400}}, {@blksize={'blksize', 0x3d, 0x1600}}], [{@measure='measure'}, {@subj_role={'subj_role'}}]}}) r7 = shmget(0x2, 0x1000, 0x100, &(0x7f0000b13000/0x1000)=nil) shmctl$SHM_LOCK(r7, 0xb) ioctl$LOOP_CHANGE_FD(r3, 0x4c00, r4) sendfile(r3, r3, &(0x7f0000000000), 0x2000005) write$binfmt_elf64(r3, 0x0, 0x0) ioctl$LOOP_CLR_FD(r3, 0x4c01) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r4, 0x84, 0x6, &(0x7f0000000640)={0x0, @in={{0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x21}}}}, &(0x7f0000000700)=0x84) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, 0x0, 0x0) [ 617.895423] binder: 18427:18428 ioctl 40046207 0 returned -16 [ 617.928058] binder: 18427:18428 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 617.978398] binder: 18427:18428 ioctl c0306201 20000080 returned -14 13:56:38 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x4, 0x0, 0x0}) 13:56:38 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r1 = accept$alg(r0, 0x0, 0x0) read(r1, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r1, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) [ 618.160213] binder: 18456:18457 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 618.232429] binder: 18456:18457 ioctl c0306201 20000080 returned -14 [ 618.271767] binder: BINDER_SET_CONTEXT_MGR already set [ 618.287013] binder: 18456:18457 ioctl 40046207 0 returned -16 13:56:39 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) statfs(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)=""/3) 13:56:39 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:39 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r1 = accept$alg(r0, 0x0, 0x0) read(r1, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r1, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x6c, 0x0, 0x0}) 13:56:39 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000000c0)='fd/3\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$FUSE_POLL(r1, &(0x7f0000000000)={0x18, 0xfffffffffffffffe, 0x5, {0xffffffffffffffff}}, 0x18) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:39 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 618.670935] binder: 18474:18476 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 618.695170] binder: 18474:18476 ioctl c0306201 20000080 returned -14 13:56:39 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) [ 618.745309] binder: BINDER_SET_CONTEXT_MGR already set [ 618.765214] binder: 18474:18476 ioctl 40046207 0 returned -16 13:56:39 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r1 = accept$alg(r0, 0x0, 0x0) read(r1, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r1, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:39 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) ioctl$CAPI_GET_FLAGS(r0, 0x80044323, &(0x7f0000000000)) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r2, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x3f00000000000000, 0x0, 0x0}) 13:56:39 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r1 = accept$alg(r0, 0x0, 0x0) read(r1, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r1, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:39 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) [ 618.984872] binder: 18491:18492 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 619.042039] binder: 18491:18492 ioctl c0306201 20000080 returned -14 [ 619.071660] binder: BINDER_SET_CONTEXT_MGR already set 13:56:39 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_GET_EMULATED_CPUID(r0, 0xc008ae09, &(0x7f0000000140)=""/141) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) [ 619.098085] binder: 18491:18492 ioctl 40046207 0 returned -16 13:56:39 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r1 = accept$alg(r0, 0x0, 0x0) read(r1, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r1, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x100000000000000, 0x0, 0x0}) 13:56:39 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) [ 619.245186] binder: 18506:18510 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 619.284538] binder: 18506:18510 ioctl c0306201 20000080 returned -14 [ 619.299406] binder: BINDER_SET_CONTEXT_MGR already set [ 619.318281] binder: 18506:18510 ioctl 40046207 0 returned -16 13:56:39 executing program 5: syz_open_procfs(0x0, &(0x7f0000000140)='net/ip_t\tb\xff\x0f\x00\x00`argets\x00') exit(0x0) lsetxattr$trusted_overlay_opaque(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='trusted.overlay.opaque\x00', &(0x7f0000000180)='y\x00', 0x2, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') write$P9_RSTATFS(r1, &(0x7f0000000000)={0x43, 0x9, 0x1, {0x4, 0x253, 0x9, 0x0, 0x5, 0x6, 0x7f, 0xfffffffffffffffc, 0xffff}}, 0x43) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000200)={&(0x7f00000001c0)='./file0\x00', 0x0, 0x8}, 0x10) 13:56:39 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 13:56:39 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x7a00000000000000, 0x0, 0x0}) 13:56:39 executing program 1: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:39 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = gettid() r5 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uhid\x00', 0x0, 0x0) readv(r5, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/45, 0x2d}], 0x1) timer_create(0x0, &(0x7f0000000080)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000200)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000240)) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x2, 0x31, 0xffffffffffffffff, 0x0) tkill(r4, 0x1000000000014) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0) [ 619.633380] binder: 18522:18532 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:56:40 executing program 1: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) [ 619.675916] binder: 18522:18532 ioctl c0306201 20000080 returned -14 13:56:40 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:40 executing program 1: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:40 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) [ 619.818529] binder: BINDER_SET_CONTEXT_MGR already set [ 619.849515] binder: 18522:18532 ioctl 40046207 0 returned -16 13:56:40 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r2, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffeb1) 13:56:40 executing program 1: socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r1 = accept$alg(r0, 0x0, 0x0) read(r1, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r1, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:40 executing program 5: r0 = gettid() syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') setxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@random={'os2.', 'fd/3\x00'}, &(0x7f0000000080)='smaps\x00', 0x6, 0x3) exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x2, 0x0, 0x0}) 13:56:40 executing program 3: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:40 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000fe5000/0x18000)=nil, 0x0, 0x0, 0x62, 0x0, 0x324) 13:56:40 executing program 1: socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r1 = accept$alg(r0, 0x0, 0x0) read(r1, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r1, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:40 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000), 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 620.472359] binder: 18565:18566 ioctl c0306201 20000080 returned -14 [ 620.508495] binder: BINDER_SET_CONTEXT_MGR already set 13:56:40 executing program 1: socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r1 = accept$alg(r0, 0x0, 0x0) read(r1, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r1, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:40 executing program 3: r0 = open(0x0, 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) [ 620.550199] binder: 18565:18566 ioctl 40046207 0 returned -16 13:56:41 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x20000400800, 0x0) write$P9_RVERSION(r0, &(0x7f0000000100)={0x15, 0x65, 0xffff, 0x3, 0x8, '9P2000.u'}, 0x15) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KDGKBTYPE(r0, 0x4b33, &(0x7f0000000000)) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$EVIOCSABS3F(r0, 0x401845ff, &(0x7f00000000c0)={0x100000000000, 0x7fffffff, 0x1, 0x7f, 0xfffffffffffffff8, 0xf0f7}) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x7, 0x0, 0x0}) 13:56:41 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r1 = accept$alg(r0, 0x0, 0x0) read(r1, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r1, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:41 executing program 3: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) [ 620.774944] binder: 18588:18589 ioctl c0306201 20000080 returned -14 [ 620.818048] binder: BINDER_SET_CONTEXT_MGR already set [ 620.847230] binder: 18588:18589 ioctl 40046207 0 returned -16 13:56:41 executing program 5: r0 = gettid() syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ptrace$setregs(0xf, r0, 0x3, &(0x7f0000000000)="0b82697cdb7c61da1d7649b59b3f4c92bb0ddeefbc0517b56c589f2e3745456a6f75d7848b6d60fa91426186d482c5079dd078556554f2cf3d01df6f94781a54b67fa8529e85446d2857a4da87737ef03c848c266f49100afa78dc6915a54d1e76754b2efb3e1778a4827c1b2b921fc9d5abf470725df110390bd774c9869c974490a4e19037bec2bf7c659140e1f5e2c81239a5ded80a2dddec5baf12e75f0b1a709ce234824a469b64959e035697fb9d42") syz_open_procfs(0x0, &(0x7f0000000180)='fd/3\x00') 13:56:41 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r1 = accept$alg(r0, 0x0, 0x0) read(r1, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r1, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:41 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000000)=0x2, 0x4) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000001240)={0x0, 0x6}, &(0x7f0000001280)=0x8) sendmsg$inet_sctp(r0, &(0x7f0000001300)={0xffffffffffffffff, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)="88c662203706bed05749c8ad143ef67592ebdb6a915e134b4b404fb4520442dd3465bc0ff37ae6632766541d39105e4b03851a07c106f6ae89ff3bfb5e84526d928ad3811cb578d7a9f533726e11e8fe9a9058a95e49ad2aacfdad51af3f4fa8d2c9f520fb788529da0f8530d55dcdd5195e607888f0b00b8a924fe3b00d3bc1c597c8f286be2cb07ad8984915612082f2164668eaff", 0x96}, {&(0x7f0000000200)="00b2501d3ff7d1aa8251c50ba9962ea61f0286b8e174c338c904a120d7ba71a3ea962b0d4a05223c89844d8033832bcbb8827b2f230b0e1b99061dadfc2782293dcfa910b4a651f4d01066762c88d5cf3925662c7d81368b857bb36b5bb2e7c6d9bbb8174cbe9db612f513514461e3b855cbc883a27ad9ef4cd1a530c42ca2d5ee7a7d5c0770f49825e9cc0fa277400baa65af0c81eac670adf4c1b5bc5d372fb672d0bc13347c28cceb78691b5529adb834b44b887fcce668989278f0db8b5e373c75e85916cea9665d8cd89d1f43ca0dc2200c4c9d79f93b039d56b572785f2364986f7a0e7fa7c204c1a2461af90bb23f29b78027cbf6b7ab1ff0c9527c7f133b162b4a17462273eb1ea5471c308573cd3a996c0f210d769f57100298459ce3bea627aa8b3cb8875095e09382219441433c4a64c8f72f6291d4aa89fb9c732376dc6fbbd0d8d83c36ba5fce4f453498b4299237b8f36fa7c7d212fa7bb3cf62b76a0e37f22deefc9b376858e5b1705ac4d91be961fdb03e9a0e043c3f012ebc0831ccc91e562fde1f94bcbf1fc109884c99adb80e663c63c0ed5e5b26976a3a7a367ff7e56c8fc45143917fbe7486b1dc70c76a9666cc44e0c566442e2049b34068a81c1f07924889d09936c132d527e451b4dfcea9b985d0efeaece86a8319c214254e29d2dfb54af7183d189adfb3409ea8cec51204c2cac6c799f5a3f846ad9dae09edb955c939c7d469a1fb71b286a9281449b2d67b1d49685271c92e33c57c79e814e2ea03969bd0952b735422139404f480a59a19ffd886919e0cb4e325f34a86258e8ff7551793d63a75750b6c8b3d903ec2ef1fa421ba92a21345e6e8d2698a086275c16cd37ca92922d2d2e96f4b83fb2af7f29ebb0e23c9889c0685d124200b9d87348b1b4288680bbab0383854d7d83aef35fbcc91e44149fed9315d4d540a02364dc93619e630f6d08fa0a6b3012d71f10a77bc9e4366844e4269f3bd85084d79c257320ac827e676157bc40a23f60e5463eeb995c5d8962150a4415924d467cfa351e091622cf414e9c9cf9610149a7fd37600b4767547505184fdb1dc4aeddeef3a33e21dc2a35b2dfbf9262ed6d422ee5cb1b8aff40032ae286e023ee2f2183407f6e787963cd6f054d1c917620d1deea1ed50420e8b96b9ba830e137327679fdaa21ea08aaabff30ddc7471521b453b1745e1e553b989b02298d655d66136da3d4a68d6c327871220823e78ab16d815187dd514eec5059079101ad7bfb4b147877e4f91455ecadf42d036ed183b00180935a43d25dc2f308ca8f425b0b07626f05b9be02975e1b202c49405487aa9fe20dc319599005888f9afdea52e1b6d8d41e01584f5d6de131b84dc1e83b88c14d05c6e4aca55a37e47488d297a25ec73f8aa79b586e21e6ee952fa678a11ca8f90b03bb8f9962e8e2049c67c7da35ed017077f72eafbf92cc24c6748431732bfb5a177103d0c569b95a3154535691dabbff5e779e2ca2716ffdc4ed1e79c77e924f2e2d0f11a5699057a20f2ea42c368e6ba2a69dced3ed7576251d42578e93166a23c144383f06c90bbe6612ba8e57e03ebaf82e0c46b0f5a4aac1f07addd5324a59ddaa0f15a4d8f9a6b525b961a6fb0e812018843e719257d059a7c5acdb1200e0fed9df941efd38c565b7ba832562f9c0cdfb39ae89cbcca3832e7a0cf1b47aaed3df46e5cc9846c4f9d68bd3b16d19c855ab76cd241f84532dacf260e0c495003df0c91dc63e440a5e8bc0aec182f13e5d7558406dbb79b2066636a5ae83f898ebbfe84bb50cb36a70469c05f94c6aa966baeca25cf35d34af4ed6fadd68db54be6f7393d62207fd16f95bcd98af2c0699ff7b322d25fa0c70b538acc0b6554bac00f041acc5858012338b740c9c9b6540ec406041f689b8a348c69163a689a30a0b02d3ec3d4083f9cc20468236548bffeb79fb0eb65b7e9bc364d964130bb9ba3821273937e5c898f121fe2e4490c2d341677e2ae1f58b2cd607985bc5d012b208c1ffda29c339078c2e4faa8543fae9a975dec4ecc47fda977c0e34a9c10815f983d4b0a34921f0e941d7a0d65b081b0647c807c4bc2e5fbb440d35393a7b1741fbcfd4b52121df28e816e968a98e1483dd7711f331b2dbe23bd23f54ed4500ab385b49284abc0d016d9904b43db6ab730df36be15603cef7e13bf7f71f73f306c06521f7f137979105bfcefb7a23a40bcd64c59e7fd9e552822d0aae6610a33f59b32691aedc9423140fec5b5df0a41a22e72031f53c08b340346d079056e4da5f39424682e1707d8eb3a2d42e80d1b9ba95a010f3c5082b4f4c31dc5dc59fd0b0e3b468f7bfc1f2553f9563718347e6daa297370cc2e712b890906d62bdc1e4e6c10e7283f4b9c0f24e16b76886a080dcbf75404ee08b6f1ac16604b9053f11d88c97d0ab2a929515c3fe6354b936224044ca555e1b226bc71719fb3028a21a1bfc91017b6154091ceb0833ca6a93ab807d522c957ad9a4c5c338ea49a857f427ec744ac8a77a866561352925ab304a59b21705cbcdda870e6f4d8f630185f258da9bb2a64fda4adba2a901cf751f69c3f484a65b2ed499f1e674540bb8147d2993a319a8de55b5f143a00bdcc3860b8fb76e9053a542cac8c283e4f449a08c55e7f3e3ac657294c93980c7b10711d18cac2caf7b222057786c2c8e38ece0554d90c7a81e1ace63e8e7eb5de2e7c50b12de19be6578750aaf25f5fabf1d84482887782cc71f067286b52d3bd2b3aa024528b7883b374d805255f4906a6281b354c8fcc5d438bcbba59d07ba90a8f0b91ce732f34f46fdf77e89e6fa1d1ef16759798ca02df70c4469e56baabe036a198836ee869c98476b9168a0d8567c63659b5a972565ad06f7e470487cd52341ddc2ecd938baa33ee694aa0af6313ba4c41f0a656037cca72c6ebf45a8877e17ddba609f57d0f60b1e5800dbe37cd6b71b29a8a9a5c82a47cca0db4f1dd2203bf1e43b86d4cc74b0918820a88d40ed7ece56c8efb95c60b6b063cd76b19bafbcbe8fc1c949e77b6d63d0b130904ba41dd246aea42dd702b33607376796a1dce8bdba133f4771f36d4080e396516e86271ebe497fb89b099b990a8b8143fb5337b72f58c96d58cfd246a6f3cccd82c79df93b976f4a79bbb4dc44053a13113c1c3c5904d9e09aec640bf7e77955802079a19cc1503ab30139533703ed587d64f5dc09e0a089730509b4d4fa52ce688ff850da96b9727b565949a9a820195f06fd401510aae615e10c11b95a75018204452a5a6abd84635d3854ba831d6faf776de508e95fc38b5a287e3378ba75d1399833da5b720ac9350f18096044a64e107237888bc53f10a1df1d8fe9b588c63a1463de58765f8c370b2602bd59ce388137d8707ddebb7726e7c51fb15cd9c3119215892b746f99c1b6391689c2f0056b0de1c6db450f4cbb9cb51c7b8b634ec64a12415d2cd815d7a96e9430ef6324f491a6d62ce9c36dddd4545b8e60759d9bef8d9f234c75d2db54ab8027cb7dc494991aa56836ea6caa032d38608362f0019169dd20acf80b59504ce3e3455c3d553b9c8fa67fc5a3380bd8792d0e9c7601ad2e53721d67a87977907a0226258212824d79922ef4b9c8d6bbaf9e488a7be0ba520901d67f2ec29cb1aeb11515aa72cd52119d6e0ccb5144a6de917d2a8ea0deb76e85897dba879e82539f2378893b43206ab8d20e9300909080ba489b12b1761d822fa12adc17a9c38dc8669abc1807e740b79130f2cb2d9fd00db39b09dd5546d2e5ee06781e5356846559e447eaef5c862873555594e01e39f26d3fc6bc76378a70711d3994784d806b996d838ab83e4dd831f95cd669319f3cbe305093b2e87fb5d63624148e3821c24ffc155a5a6f5f586d33e1304f355cb0b80711d266efb959861ded2fd01a64a007353fe8bf5b7d0c682eeb78a9d1307a34b3d26463f9d5ff6f1acf3ec11653fa70f9ffadb8cc871cef76277ac01e8446cfb8ed101bcdd4e8dca8a07e951ab0d9b169c6981d1356e2f2616b82ce94992806a53624145a2371d8111df4a48bbacbe9fa9f747cd8a81f0f0c82c44c737cb66d9bf8719c2db7243b5d54fc5a4a48a0c397921ff18b2e2d05c71be829531e02c9e89ef14262420e3bf48e2b1fd812ed7d630267c25e2032a96960909c86cf4edb2b1de01ec9a808333c8a54bce97e8e98bb4048f3feb34fbf91bf08b1f83745e46f97a7ee9696c427ce3067fc7bfef8faf6c1886c33665e615d6d1be9adf97e9c130db76fe38ac3c806f5976955bf2fa0cd622fb43dbafe58d2d989d4fc95f003460b8a0af0a8a9e47df694d73e022fed59a8741b3a26bfb2cce8a3931ca4b4700e95df3b47ffc382b2418c1640465fb4844d862ac1361bc34942b39bdd8b343cb16b5801fa3403dafdcabbcfb277de7443fa71b09400a3377b5919dd2db8b9585ffc3ca2c05ab586a785fa54b675a2dbefae8abf05bfd618e5263ba7f9e8912b4f785c620a9d04ac2499a899d8143318745b5c53540fa00af755d2c1fe799017fc03d11f30d3b9b053e10f22e015f2b75466610089728a16c64d2af54da3b729ab6cc666862e646a9ba958cc4fc09dd0a0779f8f3f5e28051a895df7cc79a28404d416df4f194464e97bb0626e034362e3fdfd03f60c0e291dabe5b5a3582c5f7789e8573eae2c1b826741d765583f5d96d0c3b848d8ea9341446fc6767ac0503dfd6b5c9af00ce5e6e166ebb4dee4b09558f03e8aa05cf773f290c172f10e56d666b475d41acc29b07922ce007d82797caa1aa37f069c22c676649cf03cbc8256b85e6b96936fbe06ba2a30312829b3580da50939ed4a2bae224618e90d356bc8ffca5893fe9c8ec953bb5658d3a9faf1e7956fc8fd9f6607b7684d22f02ad85ea87fb686d5d7c118fc0a6e7cba539aa77070b9b74fe2c633183d72af96838ebfd5f28ec7adbde77bc2a7654dee675ebbbb6e4194b3243b8673d2bbea529a767f91ba01d13d9a2c8345a9361aa9f705866ca674ff71b2adc58a083731acee7e80d40cb6bc0e3f4ab37258df2431e0d7afb07dd71a8e5dbdca9b294a0eab4c9ee54ebf6a4f1cf0a8d3a940dbb56f75c721b6699ec2e9615a52f2cb04d5337b07be4cc8d3c95e6863fd1b6bf6709291cbc8f61af220d2739ef34a4e1f53f080d87506a51b5c28eb1a296b5d92af101a163acac3989246563c96ba5d36d4e59838592738fcf90d7ffc7d3a38966f38b1b9a95f2a8b8eafb1e5c17cff88d19d105b6649e99fa3ccc89d20c3771ab501747ec2c06913b72a0d532a32c938173612b386d42341046cc69a5c3d7cf3e85272633d4a85084eadc6930da76a914ddf19b6d7182d68ee996f58c52f1dbad01d6b1ed1dbf51e11814881826607a7afbac1f309677bd748b932169ed4ace85d246442e4e1d4863936150597de779672eb5b8c44762704058ef8e9672357691a9c8bed0684cdfeb877121b3221910d5567f37a9b4895a8a8175e4ac60365390828966f05bb50ceefd777860fd2c11f4e9cf21945a15d59905cee06064511a377934e27a938befde436cc3c5e8921c41d6f70580396275e98af3c3d1e0d961215c9a62d915965b3ad5604e3ff0dfbbb876d9f98106dc50ea65ad9625ef44b000664068d0570fd68963fef9f03955077477183db37213bffb726e8141d4472fa5040f96ab13bdd6d3e4e9874cc924655f12dbe4b63079318f6db2c8ff6c90db364e7da1b9e7c87e6667dff67002d6c30bb0ae5c9b751927be3f9526", 0x1000}], 0x2, &(0x7f00000012c0)=[@prinfo={0x18, 0x84, 0x5, {0x0, 0x8000}}, @sndinfo={0x20, 0x84, 0x2, {0x3, 0x1, 0x1000, 0x6, r4}}], 0x38, 0x4008805}, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f00000000c0)) 13:56:41 executing program 3: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x10000000, 0x0, 0x0}) 13:56:41 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000), 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 621.327731] binder_thread_write: 2 callbacks suppressed [ 621.327745] binder: 18610:18611 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 621.358791] binder: 18610:18611 ioctl c0306201 20000080 returned -14 [ 621.371782] binder: BINDER_SET_CONTEXT_MGR already set 13:56:41 executing program 3: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x10, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:41 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r1 = accept$alg(r0, 0x0, 0x0) read(r1, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r1, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) [ 621.377881] binder: 18610:18611 ioctl 40046207 0 returned -16 13:56:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x5000000, 0x0, 0x0}) [ 621.521244] binder: 18622:18626 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 621.542595] binder: 18622:18626 ioctl c0306201 20000080 returned -14 [ 621.552614] binder: BINDER_SET_CONTEXT_MGR already set 13:56:41 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:42 executing program 3: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) [ 621.578003] binder: 18622:18626 ioctl 40046207 0 returned -16 [ 621.604006] binder: 18622:18628 Acquire 1 refcount change on invalid ref 0 ret -22 13:56:42 executing program 0: r0 = socket$inet6(0xa, 0x805, 0xffff) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000000), 0x4) r1 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) write$cgroup_subtree(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="eeb6f58961202f6d656d6f7c79202b637075202b63707520006370750fdfcf651df5075433055880"], 0x38) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) [ 621.653413] binder: 18622:18628 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 13:56:42 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x4002) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') openat$rtc(0xffffffffffffff9c, &(0x7f0000000300)='/dev/rtc0\x00', 0x10000, 0x0) ioctl$FS_IOC_FSSETXATTR(r1, 0x401c5820, &(0x7f0000000000)={0x100000001, 0x8000, 0x4, 0xb3}) ioctl$VHOST_SET_VRING_NUM(r1, 0x4008af10, &(0x7f00000002c0)={0x3, 0x80000000}) preadv(r2, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/240, 0xf0}, {&(0x7f00000001c0)=""/170, 0xaa}, {&(0x7f0000000400)=""/4096, 0x1000}], 0x3, 0x1f) 13:56:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x6c, 0x0}) 13:56:42 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:42 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f00000000c0)=@assoc_id=0x0, &(0x7f0000000280)=0x4) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f00000002c0)={r4, 0x5}, &(0x7f0000000300)=0x8) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f, 0xb}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000140)={0x9, 0x108, 0xfa00, {r5, 0x68, "822c08", "1112f751ba64526928f9e7af4bf5f26c3f4d773dea82084d4160b58830766794f76e14319064e5c7153f871b697cb4a398c091798bb42e224ba097fff14d09cbba917f0d78e06c0e781dbf89899bcda9128b834675b752cf011b176acca5f26fdc1eaa415dd019634cf92a5121a93ebffc71fdb290cf6898bc9d4c06a431930328f09eb84f042df1fe011ce408b324eaee5c442b870705dbda8a22c25456f07b99b54cd59427d724a718c647c910186260aabe7add62c7f924a13baa0b0131e3b07c55f9c397c921b1fe237f65843570258a142f0a25ba2ce1ec58afe9f92d5fab0d9c6002c708e0569c11741152cc3df87f82af3f9742862926df8f1b15d4d4"}}, 0x110) 13:56:42 executing program 3: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x0, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:42 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000), 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 622.300373] binder: 18646:18649 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 622.346941] binder: BINDER_SET_CONTEXT_MGR already set [ 622.365811] binder: 18646:18649 ioctl 40046207 0 returned -16 13:56:42 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:42 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r0, 0xffffffffffffffff, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x7400000000000000, 0x0}) 13:56:42 executing program 3: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x0, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) [ 622.548267] binder: 18668:18672 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 622.569433] binder: BINDER_SET_CONTEXT_MGR already set [ 622.590115] binder: 18668:18672 ioctl 40046207 0 returned -16 13:56:42 executing program 3: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x0, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x4800000000000000, 0x0}) [ 622.771360] binder: 18679:18680 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 622.795787] binder: BINDER_SET_CONTEXT_MGR already set [ 622.801265] binder: 18679:18680 ioctl 40046207 0 returned -16 [ 622.808322] binder: 18679:18680 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:56:43 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x13, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_dccp_buf(r1, 0x21, 0xcd, &(0x7f0000000040)=""/155, &(0x7f0000000140)=0x9b) prctl$PR_SET_PTRACER(0x59616d61, r0) shmget$private(0x0, 0x1000, 0x100, &(0x7f0000ffd000/0x1000)=nil) ioctl$UFFDIO_WAKE(r1, 0x8010aa02, &(0x7f0000000000)={&(0x7f0000ffb000/0x4000)=nil, 0x4000}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 13:56:43 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:43 executing program 0: ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$inet_mreqsrc(r0, 0x0, 0x28, &(0x7f0000000080)={@empty, @loopback, @multicast2}, &(0x7f00000000c0)=0xc) r1 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x4) ioctl$BLKSECDISCARD(r1, 0x127d, &(0x7f0000000100)=0x9) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) poll(&(0x7f0000000140)=[{r0, 0x4}, {r3, 0x8208}, {r1, 0x10}, {r1, 0x1}, {r3, 0x20}, {r1}], 0x6, 0x100) 13:56:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x4c00000000000000, 0x0}) 13:56:43 executing program 3: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:43 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 623.208541] binder: 18688:18689 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 623.234480] binder: BINDER_SET_CONTEXT_MGR already set 13:56:43 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 623.253199] binder: 18688:18689 ioctl 40046207 0 returned -16 13:56:43 executing program 3: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x4c, 0x0}) 13:56:43 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r2, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:43 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, 0x0, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) [ 623.401748] binder: 18708:18709 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:56:43 executing program 3: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) [ 623.451250] binder: BINDER_SET_CONTEXT_MGR already set [ 623.494677] binder: 18708:18709 ioctl 40046207 0 returned -16 13:56:44 executing program 5: r0 = gettid() r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cgroup.controllers\x00', 0x0, 0x0) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000000040)=0x6fcb, 0x4) syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:44 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x3, 0x0) ioctl$sock_proto_private(r0, 0x89ef, &(0x7f0000000140)="c9e879cb92aa28b547507423ab71c3a723d2ae850c2ce0421ab96482e36f9fd2a106a2dd5ef63a9b84a9b79c07d1a39c5c2d5e04571af09e4d1627fb657847c2e56b9378136a42f7cb963be119a0a6b9de61d3967a046520f5b302f0bcb70b4c805884c635670860d8109358e75a6e8bbae1cdfe15e5de49542d99dbab5e95e0") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) ioctl$DRM_IOCTL_SET_VERSION(r0, 0xc0106407, &(0x7f0000000000)={0xa, 0x1, 0x4, 0x8}) r4 = geteuid() lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchownat(r0, &(0x7f00000000c0)='./file0\x00', r4, r5, 0x1800) fchmodat(r0, &(0x7f0000000440)='./file0/file0\x00', 0x2) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e21, @local}}, 0xff, 0x9, 0x5, 0x8, 0x44}, &(0x7f0000000340)=0x98) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000380)={r6, 0x7fff, 0x6, 0x2, 0x3, 0xffffffff}, &(0x7f00000003c0)=0x14) 13:56:44 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:44 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 13:56:44 executing program 3: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x4c00, 0x0}) 13:56:44 executing program 3: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) [ 624.116012] binder: 18734:18735 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:56:44 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f00000092c0), 0x4ff, 0x0) 13:56:44 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) [ 624.207108] binder: BINDER_SET_CONTEXT_MGR already set [ 624.212446] binder: 18734:18735 ioctl 40046207 0 returned -16 13:56:44 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, 0x0, 0x0, 0x0) 13:56:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x600, 0x0}) 13:56:44 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = syz_open_dev$vcsn(&(0x7f00000000c0)='/dev/vcs#\x00', 0xfffffffffffffc01, 0x400) write$UHID_GET_REPORT_REPLY(r1, &(0x7f0000000140)={0xa, 0x5, 0x101, 0x3}, 0xa) ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) syz_kvm_setup_cpu$x86(r0, r0, &(0x7f0000022000/0x18000)=nil, &(0x7f0000000080)=[@text16={0x10, &(0x7f0000000000)="b806010f00d0ba2000b8cb00ef0f01df0fc75f200fc75a28b8cd000f00d00f21b4ba420066edeae10083000f2227", 0x2e}], 0x1, 0xa, &(0x7f00000000c0), 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r4, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) [ 624.434334] binder: 18760:18763 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 624.461724] binder: BINDER_SET_CONTEXT_MGR already set [ 624.468580] binder: 18760:18763 ioctl 40046207 0 returned -16 13:56:45 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) ioctl$VHOST_SET_VRING_ERR(r1, 0x4008af22, &(0x7f0000000000)={0x2, 0xffffffffffffff9c}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:45 executing program 3: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:45 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180), 0x0) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:45 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, 0x0, 0x0, 0x0) 13:56:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x1000000, 0x0}) 13:56:45 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f00000000c0)='/dev/vcsa#\x00', 0x1000, 0x2) ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f0000000140)={0x55, 0xfffffffffffffffe, 0x8, {0xffffffff00000000, 0xffff}, {0x1f, 0x4}, @ramp={0x0, 0x2, {0x9, 0xeb, 0x2, 0x223}}}) r1 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x800000048002, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x4, @local, 0xfde6}, 0x1c) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) ioctl$SIOCGIFMTU(r3, 0x8921, &(0x7f0000000080)) [ 625.097610] binder: BINDER_SET_CONTEXT_MGR already set 13:56:45 executing program 3: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:45 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, 0x0, 0x0, 0x0) 13:56:45 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae1", 0x10) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) [ 625.122883] binder: 18778:18781 ioctl 40046207 0 returned -16 13:56:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x6c000000, 0x0}) 13:56:45 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x20, 0x10000) openat$vnet(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-net\x00', 0x2, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$BLKGETSIZE64(r0, 0x80081272, &(0x7f0000000140)) bpf$OBJ_PIN_MAP(0x6, &(0x7f00000000c0)={&(0x7f0000000080)='./file0\x00', r0}, 0x10) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/rfkill\x00', 0x1, 0x0) ioctl$sock_inet_tcp_SIOCOUTQ(r3, 0x5411, &(0x7f0000000200)) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r4, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x68000000, 0x0}) [ 625.285859] binder: BINDER_SET_CONTEXT_MGR already set [ 625.292267] binder: 18798:18800 ioctl 40046207 0 returned -16 [ 625.417499] binder: BINDER_SET_CONTEXT_MGR already set [ 625.433060] binder: 18807:18808 ioctl 40046207 0 returned -16 13:56:46 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) write(r1, &(0x7f0000000000)="3575ee62273de31c3f49fd53a2fda9f611e8470ef74b68614ebb9c5506bdfe479d7cfc3bd9d63e2832b31b65f8532d0f9b0ed323f5bcb3deb4fc5511b28abf3cb04d57a8b32730b325c62a86f03b511e328c4232e229dc6e404c9b", 0x5b) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:46 executing program 3: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:46 executing program 4: unshare(0x8000400) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f023c123f3188a070") r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_int(r1, 0x29, 0xcf, &(0x7f0000000180), &(0x7f00000003c0)=0x4) 13:56:46 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640", 0x18) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x20000000, 0x0}) 13:56:46 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc, @ipv4=@rand_addr=0x1000000}]}, 0x1c}}, 0x0) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0xa75a39900215aca1, 0x0) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000016c0)='/dev/sequencer\x00', 0x0, 0x0) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f0000001700)={0x0, r2, 0x1}) r3 = openat$vfio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vfio/vfio\x00', 0x0, 0x0) preadv(r3, &(0x7f0000001600)=[{&(0x7f0000000100)=""/110, 0x6e}, {&(0x7f0000000180)=""/4096, 0x1000}, {&(0x7f0000001180)=""/160, 0xa0}, {&(0x7f0000001240)=""/114, 0x72}, {&(0x7f00000012c0)=""/73, 0x49}, {&(0x7f0000001340)=""/153, 0x99}, {&(0x7f0000001400)=""/100, 0x64}, {&(0x7f0000001480)=""/65, 0x41}, {&(0x7f0000000080)=""/40, 0x28}, {&(0x7f0000001500)=""/209, 0xd1}], 0xa, 0x39) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x8000000, 0x0) r4 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r3, r5, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:46 executing program 3: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) [ 625.982320] binder: BINDER_SET_CONTEXT_MGR already set [ 626.010251] binder: 18818:18822 ioctl 40046207 0 returned -16 13:56:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0xfdfdffff, 0x0}) 13:56:46 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60b", 0x1c) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:46 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f023c123f3188a070") bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x3, 0x16, &(0x7f0000000140)=ANY=[@ANYBLOB="61121000000000006113500000000000bf2000000000000007000000080000002d0301000000000095000000000000006916000000000000bf67000000000000570600000f0000006706000002000000070600000ee60000bf050000000000001f650000000000006707000002000000070700004c0000001f75000000000000bf54000000000000070400000400f9ffbd43010000000000950000000000000005000000000000009500000000000000"], 0x0}, 0x48) 13:56:46 executing program 3: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) [ 626.178764] binder: BINDER_SET_CONTEXT_MGR already set [ 626.219817] binder: 18836:18839 ioctl 40046207 0 returned -16 13:56:46 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfed", 0x1e) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:47 executing program 5: r0 = gettid() syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x2001200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:47 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000000)=0x3) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$PERF_EVENT_IOC_RESET(r0, 0x2403, 0x80000000) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) read(r3, &(0x7f0000000080)=""/38, 0x26) 13:56:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x7, 0x0}) 13:56:47 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0adc1f023c123f3188a070") unshare(0x8000400) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x6, &(0x7f0000000280)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}}}, 0x108) 13:56:47 executing program 3: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:47 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb8", 0x1f) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) [ 626.915804] binder_thread_write: 6 callbacks suppressed [ 626.915819] binder: 18858:18867 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:56:47 executing program 3: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:47 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'md4\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can={0x1d, 0x0, 0x0, 0x10000000}, 0x200056d0, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x16f, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) 13:56:47 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(0xffffffffffffffff, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) [ 626.956206] binder: BINDER_SET_CONTEXT_MGR already set [ 626.969722] binder: 18858:18867 ioctl 40046207 0 returned -16 13:56:47 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x400000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x60, 0x0}) 13:56:47 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) [ 627.153917] binder: 18887:18888 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 627.197556] binder: BINDER_SET_CONTEXT_MGR already set [ 627.214943] binder: 18887:18888 ioctl 40046207 0 returned -16 [ 627.234885] binder: 18887:18888 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:56:48 executing program 5: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) fcntl$getflags(r0, 0x1) r1 = gettid() r2 = syz_open_procfs(r1, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$VIDIOC_G_FBUF(r2, 0x8030560a, &(0x7f0000000080)={0x10, 0x20, &(0x7f0000000040)="7612d9ee8756efe0aef808a7500b6c1dfcd9c5e41d4566acbccce1a83c132acf687f2572895712e17985ca6ad4bebd63c53e", {0x40, 0x7, 0x36334d5f, 0x3, 0x4, 0x10000, 0x7, 0x1}}) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:48 executing program 3: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:48 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000000)=0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000000c0)={r0, 0x50, &(0x7f0000000140)={0x0, 0x0}}, 0x10) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={r3, r0, 0x0, 0xd, &(0x7f0000000080)='em1}*\\-bdev{\x00', r4}, 0x30) syz_kvm_setup_cpu$x86(r0, r2, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:48 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0xa400000000000000, 0x0}) 13:56:48 executing program 4: syz_emit_ethernet(0x36, &(0x7f0000000040)={@local, @dev, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0xf000, 0x0, 0x0, 0x0, @dev, @remote={0xac, 0x14, 0x223}}, @icmp=@timestamp_reply}}}}, 0x0) [ 627.765176] binder: 18903:18904 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:56:48 executing program 3: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:48 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) [ 627.817524] binder: BINDER_SET_CONTEXT_MGR already set [ 627.822898] binder: 18903:18904 ioctl 40046207 0 returned -16 13:56:48 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syslog(0x4, &(0x7f0000000100)=""/197, 0xc5) 13:56:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x10000000, 0x0}) 13:56:48 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r2, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:48 executing program 3: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) [ 628.021605] binder: 18929:18930 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 628.099515] binder: BINDER_SET_CONTEXT_MGR already set [ 628.110111] binder: 18929:18930 ioctl 40046207 0 returned -16 13:56:49 executing program 5: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x2, 0x4, 0x1ff, 0x2, 0x0, 0x1, 0xff}, 0x2c) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000140)={&(0x7f00000000c0)='./file0\x00', r1}, 0x10) r2 = gettid() r3 = syz_open_procfs(r2, &(0x7f00000003c0)='smaps\x00') exit(0x0) ioctl$VIDIOC_S_AUDOUT(r3, 0x40345632, &(0x7f0000000000)={0x0, "ea1f32f4091496433bbea3ed653b7047c84511f69cf728801ab280d41b2df45c", 0x3, 0x1}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:49 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, 0x0, 0x0) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:49 executing program 4: 13:56:49 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_GET_DEST(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x60c40004}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x1c, r4, 0xe12, 0x70bd26, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x1) 13:56:49 executing program 3: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x2, 0x0}) 13:56:49 executing program 4: [ 628.691355] binder: 18946:18950 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:56:49 executing program 3: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:49 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, 0x0, 0x0) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) [ 628.737692] binder: BINDER_SET_CONTEXT_MGR already set [ 628.745623] binder: 18946:18950 ioctl 40046207 0 returned -16 13:56:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x10, 0x0}) 13:56:49 executing program 4: 13:56:49 executing program 4: [ 628.878233] binder: 18966:18968 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 628.891930] binder: BINDER_SET_CONTEXT_MGR already set [ 628.897762] binder: 18966:18968 ioctl 40046207 0 returned -16 13:56:49 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) ioctl$TIOCSCTTY(r0, 0x540e, 0x200) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = semget(0x3, 0x3, 0x386) semctl$GETVAL(r3, 0x0, 0xc, &(0x7f0000000000)) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r4, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x100000000000000, 0x0}) 13:56:49 executing program 3: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:49 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, 0x0, 0x0) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:49 executing program 5: r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x100, 0x0) setsockopt$inet_sctp_SCTP_RECVNXTINFO(r0, 0x84, 0x21, &(0x7f00000000c0)=0x6, 0x4) ioctl$KVM_ENABLE_CAP_CPU(r0, 0x4068aea3, &(0x7f0000000040)={0x7b, 0x0, [0x5, 0x218, 0x1, 0x7]}) r1 = gettid() syz_open_procfs(r1, &(0x7f00000003c0)='smaps\x00') exit(0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r0, 0x770a, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:49 executing program 4: 13:56:50 executing program 4: [ 629.635257] binder: 18981:18982 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:56:50 executing program 3: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x0) 13:56:50 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(0xffffffffffffffff, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) [ 629.717327] binder: BINDER_SET_CONTEXT_MGR already set 13:56:50 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vfio/vfio\x00', 0x100, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) [ 629.766192] binder: 18981:18982 ioctl 40046207 0 returned -16 13:56:50 executing program 4: 13:56:50 executing program 3: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x0) 13:56:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x3f00000000000000, 0x0}) 13:56:50 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, 0x0, 0x0) 13:56:50 executing program 4: [ 629.942742] binder: 19009:19010 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:56:50 executing program 3: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x0) 13:56:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0xfdfdffff00000000, 0x0}) 13:56:50 executing program 4: 13:56:50 executing program 0: r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000015c0)='/dev/rfkill\x00', 0x410000, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000001640)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000001600)={0xffffffffffffffff}, 0x106, 0xb}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000001680)={0x15, 0x110, 0xfa00, {r1, 0x7fffffff, 0x0, 0x0, 0x0, @in={0x2, 0x4e22, @remote}, @in={0x2, 0x4e21, @local}}}, 0x118) r2 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) write$P9_RLCREATE(r2, &(0x7f0000000740)={0x18, 0xf, 0x2, {{0x11, 0x4}, 0x9}}, 0x18) ioctl$KVM_ASSIGN_SET_MSIX_ENTRY(r2, 0x4010ae74, &(0x7f0000000000)={0x5, 0x827, 0xffffffff}) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f00000005c0)={0x0, 0x74, "2c2dd1c3e68bcf2cc14d93898f177cf2be248b47c3078f7035bac42e316305085501a0d1bb2573b51d669e37113497bbbddc59b60e1a1b48b49adddede50ec0576dba626b268af3400a8d19ed22225cd7cfbe753f22ef1cf3885e45060f20242fae6eb464aab52acf8b9dc403387f428674479c3"}, &(0x7f0000000440)=0x7c) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000640)={r4, @in6={{0xa, 0x4e24, 0x240bfa19, @empty, 0x1ff}}, 0x2, 0x8000, 0x5, 0x80000001, 0x6}, &(0x7f0000000700)=0x98) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000080)={'a\x00'}, &(0x7f0000000540)=0xfffffffffffffda3) getsockopt$inet6_tcp_buf(r2, 0x6, 0x21, &(0x7f0000000440), &(0x7f0000000580)) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000200)={{{@in=@broadcast, @in6=@ipv4={[], [], @dev}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @initdev}}, 0x0, @in6=@dev}}, &(0x7f0000000300)=0xe8) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f00000007c0)={0x0, 0x4, 0x1000000, 0x3ff, 'syz0\x00', 0x6}) sendmsg$nl_route_sched(r2, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="5c0000360f00000029bd7000fedcdf0508000000", @ANYRES32=r5, @ANYBLOB="0d0000000f00ffff0000ffff080005000108000008000500010000000c00010064736d61726b00000c0002000800040020000000080005001f0000000800050005040000"], 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x200488c4) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$VT_GETSTATE(r2, 0x5603, &(0x7f0000000140)={0x0, 0x3f, 0x1f}) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f00000001c0)={0x0, 0x30, &(0x7f00000000c0)=[@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x29}}, @in={0x2, 0x4e21, @multicast1}, @in={0x2, 0x4e21, @remote}]}, &(0x7f0000000480)=0x10) fremovexattr(r6, &(0x7f0000000780)=@known='security.apparmor\x00') getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f00000004c0)={0x2, 0x8002, 0xc55, 0x4, r7}, &(0x7f0000000500)=0x10) ioctl$TIOCSCTTY(r2, 0x540e, 0x1c) flock(r3, 0x7) syz_kvm_setup_cpu$x86(r2, r6, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f00000017c0)=ANY=[@ANYRES32=r8, @ANYBLOB="0010000087bc1bd6e79f05aaf5887154709bce0ec99f68576e4a0174952f3376fe92f73ca51eadcff867fec163adc5a9c94268a1dbd2ae6ca06909f976a6eceab08488aadafea9577c28f67ee3a2559caf9084119086c78403d87935b43fa15f8847a93d90fc46f170b4eb80fe6bfe2492659beafe463d2fa93ab9b746239bc72006d1a1a39e8f5fd6028895396b76697978bebcc47e4350f4fc20e34b5251654e78562df92dfd9934c3fcc3f4c2b58357cd69df1606cd307e64eefd395ecf4f582e76300825eb969b96808f81a66c64afa91841fafe41b7c298bd4eaf2bbed593d23ef1a050ec7e5368509f4d27598f190d7de46464723224184d34c91912f8303d80dbbced67e5b5644337be3757450145b2feb94aeaaa50542945ff10d154ff03c0e039ab63d03b5c24426bf7d8675f52b987084101f05a80a53e1775e2fea581c5c7fa88ec9ed1de99e80efed181a3d499f4540f7559770a2a8503c83881433da99298201982faa1e8d4c42157f85187aa0e64c6de952589ac8b73951bb33dedb1b778c4885435e36813f1332f1858f6f7fce2a390c6ca7d32b5a7b1612625fc55ed0c8af13d67a833a3029b923fc0f3e15ef59286b0520f49d8a48600ba3b7ec9d3d9fe658d027b514c3570b255e7ab7454146c9cee0290c3a0d16afeff2c2f6b8797b1a9403657e3ce93e0677a7a0711f5e893815184f0b54b705efd1d719f1b12b1c5e111e09c58ad7230e64de235022782c1967814c30b9aac9a7ba6ee83bc520f503fc06f5fcf5bba504da247b5e346257399351470bf07d3e409cf7973b97f7074bb6ac9d01bd0d692ec825f4b7d4f6219189e076bbdb19594502f08822020b170e55cf97db4200d741da81c124b7331017888ccfc167d04f798558b49c3502d1196d6fd234a1039383fe4f5a58e8d8a273029be3fdcdeb9dd1ddf9ce1a1d1fa8cfb0cefc0fc1558fc4e10b6aa0ee573d40ff516e0dee8e3a4fa1a866a31725a3c84f7653d904743a3ab921fd768c719172e0fc8bb32976fd137d25cb94d18f3a4cb73f18a26fc0b47d47877ebec3006da019e3d573b2f20e445b5f3d0350b23e52db51580b3a90e25e255ebda7e32197ff65f76cf99910b417f3f7c58660b4d6d58320f94528c4119ff2a4f06c5b750510701592dae7e867825e07486a7839612f2ed9d65100d2e2d7423dcf7581ee4e2a6df831604e5e9e88b1cc0df263a3ccafecd034ba37ce8ecda5274bb80da6a9b1b35b123c3b431dfc91cacdcf3851e94d1b3e4f03f8174dc5ff8a744d1cc912e02f157a36262861b37e466bb6d891676c602075827eadc8b5ec1b435d5f6e06fe673171a4500de907d914d603da6068c560a97feb5a20a3a9c4ca23178953838d1aa8011c903dd5e56e880d18ee18ba26c63f230ce23ca9ee990c953b530bb836a96f02340cdad6c6efa74cdd8f9baf818694670fb3dcbb22306a9d42e2b9daa967fc55e58582f0ee01dd3b5ae57317f0df8dac71ccf02be9767ebf1ac7b78e95c5bc2d23524f73f182b5aba8e5c68fa913e593dfb425eeef29fe8867b8f17186477dd52b1816b2c4be5c2f8090ae3c5f4877cdbc37616d0366d52c306a8fcd34313900fe54f166492c9d5300d8f2aaa5c8b95807e7d047e8211d1902318f9b7c9e624a3f813667eabd96b61c441404d99cbc1737338f4729e9630e40ad0a22e15ce6dc509bd7f2dba6743d4568766c6ccdff0cb3a5374fb399aa499d36ea77f142206ad7bb99aa29027966681a5a7cf0fcfceca22033c1c434c8e0e5e1809bccc2aa3cf0e8801e87e86716a25afbcb6905956ed3998c9fb7d25a482b34bcdcaed2e4a2458dee1c6cdaa70da46896722a1fbbd55a69cfcdba1fff53c7cc86f5f8ed5b30d5f8ca13a91f32038099f1f445c4de6e8cf416ccbb7901647ea95376a98cf95946d1b26a4a3e5701d919e7444ce79f791fbbfa64e8136c0402b2289da246a56166dcfb8950fb2c5b9ce5316550553a8e39c2768158fe2cf9ae85ee032abb6b843ff04f5295ef7977814ba2beca5674b34b02740daa188d0c47fa823e72d1ce1c5585d207f8f5e75561e469aa1fb18191041f2a9597f2e23c3afc12282fc7d02b47f6b323e17e577971ef1037933f913452ff096fa9b376c673213d4aac06672302ca81e7301aa07fb97748ecfbed483cab9eb1460aa33bc4760061fa22aa7739ced1728478dca85e129bad823d4842dffc763197e126fdbe9707fc239cd220d875984fb52c421d1831d086adbc3810582312a2b8bcb5a47d568c4228ada4d7026b67caedac52c5eee40a58d4fd4df3f91d238cd4aaa4dba9e492f480bc493d850ea2bce876c55eb6e985ca196d2ff3273e6708d4ffdfaa37235473c73b0c825dd0893668141ea9c5ef75158727105f3b3855ef2e8c8477e12082bd38f6382bafcb51c538bc06381dace636d186ea9f8a53b6e2d57ece1217cff1b19deb48c27ff6058573c22555f3053d96c7f0d91fe803183e9b54fe8769ab018a9cd5f589c0b59956e42d3079830a873616d7581d9e668211abd0a318e11cb3aa3a39d2c9a8d883918cec8ed0813cec6cceb821a72aeef621261e131635850d13aed46db32a8b96106a9a6a8d65d8f184fd1089bed2f8a95a03f9f5230309c26c437066650140b3213a9113dc46d85257bb2e3313aa9bf80782b006aaf123a0d707b7e1e04986fb3fe9af51a270128b052ea0782e97fede6066f876191683607bb306c860c91ff87aa1e431d33ad11548b99c096b1f51f745e1e12573187f32ebbf141079961cfac0296ce396510b07d70a1095b14b6bc5c6ad5c280a4acfc573d9282c5bf6674f4043d0ab29bf0d015701f315c70c326c96ee61ef2f0478f340c1735c6d5fd8527ad48ade6618a55db054e35ab8c4d32997010cba4cb18d8cc5b8e8a5746314389a1a91b7f88ad5866d5f149c86885cff21a22a0294759c8824a544b6de6592161994f5ba1e1120f087163c20f377acb1ad8a908a2e9a74ec8a52bf6830c89310aff1f92bddccd842473a4c8a55957cd27c1e7c705f6854cd9cc12314400ab1dcbfb8932100ad1049881eae91f0c14094203e839ca9158e5af71a1e37eb171093dbc2a1276798bf39c7134de65e631bd6771cd4f244b7046712d817e8fd181986b999cf7ade388d7ae40f9883535e1acfee18ae4d62baeef3c089eee1091b538a5d601440138ae24d0380c8821e7573a78578d4aafd1bb51e799e8a77d1d29795b5c781076902bf969b5286a68d1efa84269862531744c7e9a7b46e4ca3783fc82a071e08e8b3dfc87c87244902be4b69e34d76eb6ed5d1c04904170565a6606007604d8f012bdf4799bf321abc582657af708922fa97a42b87cd2d137911061343bf26612d477b9190248cf93afa616b94318ee5aaae4e153eb40904ac0cc06bd8ad349a91659de9cab06ff771f3254d62c0233d9b9e02e93b0d0bbf1baf94493d8a427d91dc18882d636d9e9e50286146fcfd323b33df879c1ede7c29620db7ce7eaf84f8efa82807e9dfcfdaed51a081f9737edc80b8a005e92e38fb71f6199e5e8f96b38bd172544c4ce5a979e47372d8120881f6c5b3625c3a549b7984c59edb5ac5c060243451554d9e984b68a49085f0edeaff53baae626ca74c3e5a5649fd45ce8b118f87bf1b9d8678ff7e97077a4aeeb40262ecc9d389176ed9ca7dc67a2be8da8dea4ab399d59a51d2f648b28234d85d674474954a041565652cf981467185dd475921b85d7605c8fd842a4bddd9c81925c241280dee78c4aed8296ebd6b1eb465b9bb6443408f8d08fbf20e02afd9102ffdc28f1f674e5d14093ee2688a314ebc9e99ff673e0f36c86141c3ce04610806b892dadcdb9e573160c8633028db0f138626c1e8993411a64489c63afefefd4dad44f92b0e2fda9cba0169152a841becca30bea48b2efa4c06264821eb38bc31d6c88c727427fcca0db03613ff799131308cd6a03288b7a7400be263cdaf7cd4c7370c694e4aa6a1c2223e5000cf26787a47ca36f5b005670e487ee83ab8797a0550019e0ca6a1cc89dbf72bba6e79964f766d9265979cd2714fe69b2518f48fac53d93e01b76cf978bc0043899ddb0d0defd72bf091346ff95391e39988da9530f0e6169a198df8b5ae2169e6b27bf8fe3ec84c56e1370008bb76d598c9f4862602cf7b58b635fd6903524b81a104ef678771b12a1396836bb8af6b9b74d8f2e816571c8ab7203cdba500fa2f31b8839858c757d60698b89d0509f225d3795d28c4eacaed4530e2021d270ad582648b2777f559227022ffda2cd18c52b6222ed5f54dca6396ce9e9543a09aaf7d14c4c9f43bea010288253b54bd33563abd70c8dc9bb51c6bfac56f0e7a81f8b68f24fcdf20ec391937f852442bb1dedd4fdf187030e86ff121fb709c970e8efe344aec699c5e73b61086300cb419343c653f59a1c297f6f11121a8002b4160f58928b3fdb926cc99f2c59e0931f131649d3ec7ac5233c33ccf9ec63340d7a224aa6a2ce01c839d13190c8fcd287c589ab4eed5b8025163b5baf18dcf25a2ce6357ded0d9aca505ba893c362b859713df1849640cd185d69f88b37cecff20f168bc22249063dd2243a4a4572782dab248677ac4b056b5d09ab560e20bb27500da3933188d083b5a7a4e3cd4002fd6e3e5b2625da6876c977f943c3ecc955bcda172b0b8d56c7bd99a6f3fe05901a4fba783cd6794d107885843e8fd9e94e60e655e43979ab534e93e024f4f25496980e0043c69e5fa3f0c03a5e209bb694645eaca1a0fd724bc176a4d3811c8be82473b200b1378dc108670801e467610a382c57d95bc30520520aea8612d8a73e8e0ddca505fc066f771734bc4f7dc5942b067dd077691d347f3d893cdd7452b8b902baeafba3e8e292a3edf92d876e8d2dac2310465434a77f900983c41746a5acbb2f30432ba07ae5c62a401e8466f0f34eeec16394b28d2170b0f72071ed088a9cc0ded231aa70df6a03c5a528881699d3e4155b99d0cbd97079abe1c58e15b4af5605f45e7f850e18067a730264ba187e8d519f9df67b1703df2ffe4ee2820d096945ac71ff1e722f9d74ad4e14330e6b43b1c263efca71e1637e58aeab2a33faea39c6026c9f6e8b110d0fdf790bac987b277088255927a2a10045c76302efbe5713ba46f4f1caf3f03801eeb37bbfc6819901f5d919852e608d27bb2535dff5c0fea0f5f62ed230e95bb72f3a976de4046466257e57e612b74076fa81c7caf7002c72f80aca010a97b9e19138e28100036f587a78a334925c4146a7e43ba79c4669b19568d01df3ac51f9f8c802d1f30019ab627db31690a22404c6cb5cb4044dba701ebe0d4485f38320b2a37a073c21db3b28b8efc0ee699c5b557f682bd54262add3f9e44210facbc177af4da04422d270dcbfe60735209188d420bafbea6d43138e28d0e1b7abcadc2c5cd6f80a0324926cb553e5108f17fecd40f29899cc8b8eb3aed142ad7ae3e6257bc05894e3f0fdc7ce4cd31c371f2eca07c9184f2cadb0410bda01cb856e4048c5d1404ae57cee23bcbe69c436b324cb447055d7f18c2757bc97b32c215e92b8d675f057319678ed056eb4566f7835a07e9a7ec3c83edd1278cceac736ac33cb9119d62b3ac6cbd29bfb8a3c69b85598259c412ea2a46ccbc63919d865de5dd18f08ae5a9df7a03f56703726f590b85b03012f29cd5bdcb083d0be0116b4fdac055a6a90aa53b7768e352479424201e646cf80850d9945595d372c4a2b4710ad0e386ae5c03e0595b58b87"], &(0x7f0000001580)=0x1008) ioctl$TCFLSH(r0, 0x540b, 0x7ff) 13:56:50 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, 0x0}, 0x0) 13:56:50 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') fanotify_mark(r1, 0x1, 0x2, r1, &(0x7f00000000c0)='./file0\x00') ioctl$KVM_ENABLE_CAP(r1, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, [0x2, 0x6, 0x4, 0x3f]}) exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x1, 0x0) write$selinux_attr(r1, &(0x7f0000000000)='system_u:object_r:hugetlbfs_t:s0\x00', 0x21) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:50 executing program 3: 13:56:50 executing program 3: 13:56:50 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, 0x0}, 0x0) 13:56:50 executing program 4: [ 630.557109] binder: 19028:19038 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 630.616252] binder: BINDER_SET_CONTEXT_MGR already set 13:56:51 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x1, 0x0) ioctl$VHOST_GET_VRING_BASE(r0, 0xc008af12, &(0x7f00000000c0)) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$VIDIOC_G_OUTPUT(r0, 0x8004562e, &(0x7f0000000000)) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0xffffffffffffff92, 0x3, 0x0, 0x0) 13:56:51 executing program 3: [ 630.662740] binder: 19028:19049 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 630.668600] binder: 19028:19038 ioctl 40046207 0 returned -16 13:56:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x6000000, 0x0}) 13:56:51 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, 0x0}, 0x0) 13:56:51 executing program 4: 13:56:51 executing program 3: 13:56:51 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x5, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) [ 630.857571] binder: BINDER_SET_CONTEXT_MGR already set [ 630.880450] binder: 19062:19064 ioctl 40046207 0 returned -16 13:56:51 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f0000000080)='sma\x99c\xd43\xe1)T\x9f\xb4\xce\x10;\xf5\x1ap\x00\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_open_pts(r1, 0x2) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') r3 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, 0xffffffffffffffff, &(0x7f0000000040)) 13:56:51 executing program 4: 13:56:51 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)}, 0x0) 13:56:51 executing program 3: 13:56:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x74000000, 0x0}) 13:56:51 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_ASSIGN_PCI_DEVICE(r0, 0x8040ae69, &(0x7f0000000000)={0x6, 0x7, 0x4, 0x5, 0x10001}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r2, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) [ 631.454517] binder: BINDER_SET_CONTEXT_MGR already set 13:56:51 executing program 3: 13:56:51 executing program 4: 13:56:51 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x10000, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) [ 631.480904] binder: 19081:19086 ioctl 40046207 0 returned -16 13:56:51 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)}, 0x0) 13:56:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0xa400, 0x0}) 13:56:51 executing program 4: [ 631.652414] binder: BINDER_SET_CONTEXT_MGR already set [ 631.698039] binder: 19097:19098 ioctl 40046207 0 returned -16 13:56:52 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) ioctl$VIDIOC_S_AUDOUT(r1, 0x40345632, &(0x7f0000000040)={0x1, "0f8b455ab7524506ddd6c65e10cfde8eeab52b78ad78f62ce2d32ba0aa72db23", 0x1, 0x1}) socketpair$unix(0x1, 0x19, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x802) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000000)=0xfffffffffffff062, 0x4) r3 = syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x66, &(0x7f0000000180)={0x0, 0x1}, &(0x7f00000001c0)=0x8) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r3, 0x84, 0x7b, &(0x7f0000000080)={r4, 0x2}, &(0x7f00000000c0)=0x3bc) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r3, 0x84, 0x71, &(0x7f0000000140)={r5, 0x596}, 0x8) 13:56:52 executing program 3: 13:56:52 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)}, 0x0) 13:56:52 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000000)={0x0, 0x3}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f00000000c0)={0x511a, 0x0, 0x401, 0x100000000, r4}, &(0x7f0000000140)=0x10) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20ncci\x00', 0x101000, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:52 executing program 4: 13:56:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0xa4, 0x0}) 13:56:52 executing program 3: [ 632.330454] binder_thread_write: 3 callbacks suppressed [ 632.330470] binder: 19114:19115 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 632.390601] binder: BINDER_SET_CONTEXT_MGR already set 13:56:52 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{0x0}], 0x1}, 0x0) 13:56:52 executing program 4: [ 632.431364] binder: 19114:19115 ioctl 40046207 0 returned -16 13:56:52 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0xfffffffffffffffc) syz_kvm_setup_cpu$x86(r0, r2, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:52 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) select(0x40, &(0x7f0000000040), 0x0, &(0x7f0000000180)={0x8, 0x80000001, 0x3, 0x0, 0x2, 0x4, 0x255, 0xcc}, &(0x7f00000001c0)={0x77359400}) 13:56:52 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) write(0xffffffffffffffff, 0x0, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x0, 0x10, r0, 0x0) futex(0x0, 0x85, 0x0, 0x0, &(0x7f0000000040), 0x81f40002) [ 632.599659] futex_wake_op: syz-executor4 tries to shift op by -192; fix this program [ 632.617480] futex_wake_op: syz-executor4 tries to shift op by -192; fix this program 13:56:53 executing program 5: r0 = gettid() syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x3, 0x0}) 13:56:53 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{0x0}], 0x1}, 0x0) 13:56:53 executing program 4: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz1\x00', 0x200002, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r1, &(0x7f0000000980), 0xffffff4d) sendmsg$kcm(r1, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f00000009c0)="26330a8bf5189fc5bb9779ff4d7bc49267f6a34129572c05807ead334cef26a4af866911da692ba5efc938d6457d6b6d49cb10e80ff4bd339a800f492b1d22c919b04aede7e1e4128775cd479e8a8bd59f6166697a123de4324d0a6cdd5d43b9d1ba4b14ab401fccf1723373b72518cf8167b1655e0ed9b503679dd21d818015fc31e8e4605b7c0fa0b8b55db1de43bc6430a6c466f0d180b1978c07d5836ae615c3197c751b3477e64d289e105beae1ed56098b995732620317ba8d0d7812c6ac1caa0f796d6eb6721f53ce013441fa15b59ebbc0cac43196ecff36b58adcfc9b4ce256ab7848baadfa55231a1a4acff1bb21e2d47c5a7b3bff0d2843bdff9773a31b981010626b88c9461d5f55ab29b06e942225de39560951ccf25ca49e5bbb36b9ea62a8ac0a0f46b2e8378dcba860bdcf7c870be7ddad574404b636942a3f9c3b7dc6986b8c7398a81340ff17f449b3dad0f9274d4c263710630fdd33bec1e2017e528bab835999c25a88d751118c4a592ab77f41bfe55f4a0b5b88ba4f3f078e41b4e173cbe4cdbcce0d0a714099e2594f7bf19c936da3072e5614c5da49b40388517ab7ba1b3cc34a4fc713382cc48b81b6cbdf1519b0b31d024061be1ed049cf6119ae689ce37b9d89b4dc8802b5cc5add8a95feb88c6c402f301fa6a2263bbdaafb647d0c81202e77b5ed8b196cb3003d3315ed5643e896191ab444955785919169a848971914f99f144203e9f229a84a2ee9ab5a8242a416ce3055ef10562cb7b4af2b4a4bc1479714abaacfc8873601f2186e6615fd0cc55e2c1712e721fb47dbd45be75df1b19e97b76753a24fa9cb2e4ac0988cddd03f8f963e27543fcfe999ed09e39f365ddfd3709ab464242bd67e902c0206cd0e49af7b0198f65c3394e32430891e369089c7f5031a50f09d3571150e4cf416e8ec2fd48af0e3d04030600324093aeaa5b8e2e9643cb01e7e9a8e5ee90825a8a0a79281e5f378d937c1d597d0884c236b421b0fe325d035a8de3acfb1d03ab5991f09cad8baeb992cb6599a36b76ee91d1e72ed84d749eba1ae7c7c16149888f6b2e19c024f32e9291b71aafb3b7fe2f9f104fca29b9ee21ee9c3cbab5f51a62171b1daee1f9301a216b9e55bcbae5044d957c9450b8dcb16f67ce54618498177d2731046f6b21e33ae4aacc568bb381827102d1dd233caf678a157105af485356e9e2f2b0a6e3a5fb92d9ad389dea93c25eab847adbc7665ae22eff65aaf9192027d2f2bd06e4f86d48388a073b4ef049c1557dbbe6773e33e7bc0d287ce22edc61ef1359f56ceb635a0fe89a6f40856e804231e3ecbb4c9687ead295b199efa82eba1ab473d2f70094612b883ca803177f9a30d304da290b602957d30d3587ef4fc6b4febb311ea895206b47f8c09c2a4904a63bb133a151e53ed07d9be9c4032e34d3639dad13d1b65379752d7e2d8bdc61ac8c7dab49ff4fa86c4abef9ce53952c21b72e56e4338972c688edbef2fd64d3adda4ecedde2dabb89de738ee8075f9fd6b6b464b76125bf9f1c83978f82cbffe2ab3aab25b66c338030951515132dc55c27458c55b5f20eaee296fee2549b1a1181d3317858ea3d9f556cc83bf0a553fa75703e92e195e4e39411cf728a7ae28fff358a45178ecf2eeb570c1b562c92c6ac2e063babf13d7a72f797fc1857e8545d7eeff99e58061961583c547e67e424b727d9a9e63558790c992777dcef38556106c6905ee9a7314bf50d9c9e0f2fb3b048c803773db331e9b6663e146e90086a0db50465b9f6052a89675f5f2791a3b478b546b752177f642c46355221c4889e757586ccc7a4f3fbdfa778a6a3fab0e40a01276758ccb0e10cf5bde004936e7eba88d4c7e0749fca344740e39a026f4c93e18a438c7e26f0bd1550df3627dd4b457e7f9f38e710e8a502f2bd9c9c14d5d9cd3cecc11bf7482eb4a42552f7ef1615776ae1f2bcc4940cf9060d724a0c1ac1fd62d3e73ffa4a4a7105c16d49b4a35231ae0aaffa56783c393ca9bb8f41fb1118b539c25b25baaed88e8c590e7ff9d8cd7db5c1623319cb5afed5fb4aa90b4114eb8c77f53ea75bec0ea319ec5f008e9e349c1524ce1405b257afbfd1e56c460f23d89773ae6c9ae5575df38ceb9a37770bfb334adbbecbe542a00371f9fdc6e9286e75a280647b0ed5dfa16975906fc55bce9224bd310e1bee640c3c890c716c762b2de33d2093d2bef840e4cdc5be330c9790a09fbe1684e4fdb6b99219afc92179e85bbc889ac07199f8304e208035336f725cfbb2ea81188f14099b6af8594035e2a26c4e56d29edf1f4928928113cc8c952d56b631fd18495184af0d6cf9aaf454b935b242ffe66ad110244ad9afd03d9f710e7dc92278555143f079180992d3ba4f16da0fcbbc0899ae2a8c9646df116d429bcadfc3fbbc41b525c5762e836fc46044ca08adaf89f00ccc8c3cb97dd5ca174a9b6f87ecb4071451cf3f117fca7108c8efe3883cc2824fd12ae69b16b2a7b66f0568a64b83e0ba2919a06312fd28adbdd346b7fd9a8857df68edb08770748f03e8a0cf8d3db3d6109d7a19ab91270b31566885f8cdac619d8fc301cb5fd26f3f223e3070ce27f4a5168db1ba4a4ac28a462454a9438dbf139fdeb43eeb6fed7645ffea2f992b9be4b6e5c6ec9586f1c128091fd33a439ca800d08f1607dad69e4be5df7942c9d02d3293a87b1549461e53abefdd1cdcbff3698631b19b78e4836a0993e3707d406cb82c63e36cabb661cb832a01ae7d2e9f35e78798cbcadb27bbdd027958a4be83f449d323903d648aba8f73e95eb430cb3b3ce110761c990441c31eab11c3fc278e79af9d5505b451850c755949fdbbb7b400ed1c2fc4c770f5191021f851d43ae243abc4e91ddd710dedf732a48250a3f1e71e28e45f6bc7892e359df8d53153108dd94d0f65a3366fd4af62971a02d6af2baea5c0b5e52f4708c025b8af81dde38ef6ea52c380cbca17958e644b039eec8d89bced952671562b66f4acb577acda78f722a48df051e154c5b9c0f2913c448c41958eba4432df33f783ef76cca9197d46ba43eb0807322ea4d7ca279795db75a0300bc5e90424e880dd93d67ed9a332b7bb99f7257d2e3a7b2ddbb0bb70ecfd6fc365c997795c4c9ba915b80899879f27bd8b6e27198e8e6be188a1cd410518165fb8cd841accb797cd4ad3633e3824e7d5653f524b5741b9898c31f836f13e59dd3cc614222ab784caaa9dee24dfbd93b0d66edb9180b0d528bba67c50c13912cd323ba99840c1d9b38459b8161a206a8dfd44a435d026ddcf8df5a1bd9fc9fbaf0716b04ea5f7b15379ab7bd215c0ab7926c97ec502cf4592b7f870bcc47ea5b982193286347053197f2e642d3f5fa086e59b42f9c81e28f18d0484e09a9b0077973391d8f2b0d1f37d97133ea66e37d2bc89fb9a9b653cc52051145c6c2b38a68cb32a3a4562af72ffbedcae239d2ffa8ade503f287981d46b42ea0ea86771931b876d7b6d185a144977957256a3d9f55a579acf827c1fd5fca250097a16b52f98620c730f6e07aeab68ceffd4bd933ba90edbe7c6ac94b4a9fad6ccc479e6734e59c2cc44eb2529f6dc9ea0635511b678e337efb544b92337d92d241c57566f8bb186877e833a2dcd7a2a70aaa45cb2fa96c66417c4bb2867b524e3530b30e0aa8658f5f8eed1ff937a1d30273f6740a4cb78455b1b410b4135632fd2f2dccb3dee3a73ee22f13de48c23630070439ec76f8a30643ba2f7abdfd266045d7884e64162cc280dbc11d6be57a56e63d80fdd4a69f1ad9213790d807db26a4503f888a1b932a36b8ae564b22f07db63059b7a1d7ee441daf103bdf34dc92bbd5a1d8fa14fa65a8f7e3e89e2ffc487af8a16111bd95ec022d22b06eaa3e9fe983958afae8a69f379f00f5cc94b7976c0c1091aa0793e91b435c1d642feaa6584fd9ef1820300c0478a288b18d47a0f7c25806a73d6e106c01900daa24d7b9dc3287770106c842c40fdceeb4072b4b33414e1dda2cb0515ea64b2cf8acb3f88b0f415808eb1831bbf81f5fbcaf35d183ad0a61ffcd1a047a2685e218bb11e6e710c9416c8fd930cdfd5eb993f6a32ed76b3b32a198fbb34b34bbcd460dce49c133d75ca60f7cb024def375153f5fc967edb75d98a8732f2f5cd3a17787bf77f5a02ef169d890ff96ef59d147962837305ce3ab20776bc01e8fe32ddd57ef386811c97b4aca3b364a4f4703222208d18dc343fb8d2ab07c48380fb331ed38a5f88171159b2e4dc0fa2164fc22a194a48366af5e2ab4925df203f20506115b794bf675dbc44dabea131272570b2e11247957f886d41b12b8a521bf56b75178ce1711f4107d7ef43f950d452787014a42f77b882df1adfeef04c16fa714b59eccb7863bd43da15da632d99101b9e8a9ffd1bec9d146c66782fa0642bf0c297c7c6febe2f0fd2c9268b6cdc6f3ac03c2463803785875ea8a2e7c6031dc4b663769a43d63f64b0a10e4e6ed119270ed17788f8d6381c80c51f9fcd6646fc764748f7d75f75fc22807021c4e560b434a89336d6aab7aa8ed2e42b3a6a46d287a945865fc10c18ec8b54df0316e2cef1487f63ca1fd3f73eed17ef07ac9050048824da91511a811baed315709557b99ac431fe3787f46bb3b4927e231b23d03fec839f5c2ef3979bedec815a05a3d27f78f12aaa4ae16b2b292c999244e528ce7c1ccfa1a2ff29bce81bbaf880a5d86b39af2c6b97305ce136bf76cb7beb4d1c5a133c68d068215974d368f04b63b3ccb4c0ad8", 0xd41}], 0x1, 0x0, 0x0, 0x4}, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x3f00) perf_event_open(&(0x7f00000002c0)={0x4, 0x70, 0x0, 0x7, 0x0, 0xffffffffffffffff, 0x0, 0x1, 0x0, 0x8, 0x7fffffff, 0xffffffffffffff59, 0x4, 0x0, 0x6, 0x8001, 0x0, 0x0, 0x7ff, 0xe1, 0x64e, 0x200, 0x0, 0x5, 0x8, 0x100000000, 0x9, 0x1ff, 0x401, 0x339, 0x0, 0x0, 0x0, 0x1f, 0x2, 0x2, 0x80000001, 0x3, 0x0, 0x5, 0x4, @perf_config_ext={0x1, 0xffffffff}, 0x400, 0x0, 0x80, 0x0, 0x3, 0x2f, 0x7}, 0x0, 0xe, 0xffffffffffffffff, 0x3) openat$cgroup(0xffffffffffffffff, &(0x7f0000000240)='syz0\x00', 0x200002, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000000)=0x903f, 0x12) 13:56:53 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000000000), 0x4) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) arch_prctl$ARCH_SET_GS(0x1001, 0x6) 13:56:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x5, 0x0}) 13:56:53 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{0x0}], 0x1}, 0x0) [ 633.265168] binder: 19153:19163 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 633.283650] binder: BINDER_SET_CONTEXT_MGR already set [ 633.289198] binder: 19153:19163 ioctl 40046207 0 returned -16 13:56:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x6c00, 0x0}) 13:56:53 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = syz_open_dev$ndb(&(0x7f0000000140)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_CLEAR_SOCK(r1, 0x127e) [ 633.393668] binder: 19171:19176 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 633.420830] binder: BINDER_SET_CONTEXT_MGR already set [ 633.427154] binder: 19171:19176 ioctl 40046207 0 returned -16 13:56:53 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r0, r0, &(0x7f0000013000/0x18000)=nil, 0x0, 0xd7, 0x4, 0x0, 0xfffffffffffffe0d) 13:56:53 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000180)='/proc/thread-self/attr/current\x00', 0x2, 0x0) sendfile(r0, r0, 0x0, 0x27) syz_extract_tcp_res(0x0, 0x0, 0x0) 13:56:53 executing program 3: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x20, 0x10000) openat$vnet(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-net\x00', 0x2, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$BLKGETSIZE64(r0, 0x80081272, &(0x7f0000000140)) bpf$OBJ_PIN_MAP(0x6, &(0x7f00000000c0)={&(0x7f0000000080)='./file0\x00', r0}, 0x10) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/rfkill\x00', 0x1, 0x0) ioctl$sock_inet_tcp_SIOCOUTQ(r3, 0x5411, &(0x7f0000000200)) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r4, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) [ 633.564335] binder: 19185:19186 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 633.641143] binder: BINDER_SET_CONTEXT_MGR already set [ 633.665122] binder: 19185:19186 ioctl 40046207 0 returned -16 [ 633.687592] binder: 19185:19186 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:56:54 executing program 5: r0 = gettid() syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x3, 0x2) r1 = syz_open_procfs(r0, &(0x7f00000002c0)='smap@\xd6H2\'a\xa5\xa3\x81}\xbe\xb9\x11[]\x9d \x14\xf2\xa0|\x1b \x04\x90\xed \x19w\x85\xc0\xbfg\x81\'\xff \xfc-\xbfMN\x1di\xa3K\xe64LHR(-a\xa2\x8dA\x9f5\xc5\x10\xf4\xd9\xbfOpjv\xd9lo\x96T\x91\xd3\xf6\xaf\xe7 \xaa\xc9@\x97\\\x90\x88B~\xd6\xaf\x1d`\v\x02\x00\x00\x00\x84i\x01\xb4\xafU\xaf\x9c\x98\xd2\xbf\xd8\xdd$7\xb7\x1b\xbewl6\xf8\xc3\xe9\xf8\x91m\xf1\xee.B\x95\xb8\xb81\xda\fu6\xbaX\x91j\x9a\xff\xe3|4\xa3\x846\xa4m\x9bY\x1d\x11\x80A\xb9\xdeq\x0eJ\x8bl\vv') exit(0x0) setsockopt$inet6_MRT6_DEL_MFC(r1, 0x29, 0xcd, &(0x7f0000000000)={{0xa, 0x4e22, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, {0xa, 0x4e20, 0x3, @dev={0xfe, 0x80, [], 0x26}, 0x80000001}, 0x3, [0x2, 0x800, 0xffffffffffffffff, 0x1536, 0x8, 0x8, 0x0, 0x8000]}, 0x5c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:54 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) fcntl$getown(r0, 0x9) 13:56:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x7400, 0x0}) 13:56:54 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae1", 0x10) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:54 executing program 3: creat(&(0x7f0000000700)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x1000000, 0x0}) [ 634.140699] binder: BINDER_SET_CONTEXT_MGR already set [ 634.169461] binder: 19205:19206 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 634.181995] binder: 19208:19212 ioctl 40046207 0 returned -16 13:56:54 executing program 3: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000000040)=0x800, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(r2) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x4001fe) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') [ 634.192489] binder: 19208:19216 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 634.218072] binder: BINDER_SET_CONTEXT_MGR already set 13:56:54 executing program 1: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000000040)=0x800, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(r2) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x4001fe) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x48, 0x0}) [ 634.246875] binder: 19205:19206 ioctl 40046207 0 returned -16 13:56:54 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vfio/vfio\x00', 0x0, 0x0) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$FS_IOC_GETFSMAP(r2, 0xc0c0583b, &(0x7f0000000180)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000006eaa000000040000000000000400000000000000ffffffff00000000010000000000000000000000000000000000000000000000000000000000000001000080030000000400000000000000ffffffff29639d86d80000000000800000000000000100000000000000000000000000000000100000000000000000000000000000d13dacea71b053cdbb48267cad3203874b1d0fbb4e1681b599a1d18204eb002fcfbc73e8a1537aa4e33496da0cbef6379e510ca69ff9720a093a62394e31d43c1212bb21cbe3511dc68a4e04afc4ccabedd3dfa8d5641041c8ae1a36c30bab59a18e611a33f4c10e6abb4381ffa77382cb76e993946baf46d0c4fdbb7eb5940000000000"]) r3 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:54 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='clear_refs\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = syz_open_procfs(0x0, &(0x7f00000001c0)='cpuset\x00') sendfile(r3, r5, 0x0, 0x1) r6 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)={0xdc, r7, 0x4, 0x70bd2b, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DAEMON={0x44, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x8001}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x80000000}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x5}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}]}, @IPVS_CMD_ATTR_DAEMON={0x48, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_to_team\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x8}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x80000000}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x27}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x24}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xfff}]}, 0xdc}, 0x1, 0x0, 0x0, 0x20000005}, 0x20000000) syz_kvm_setup_cpu$x86(r0, r6, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) [ 634.384273] binder: 19228:19229 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 634.431740] binder: BINDER_SET_CONTEXT_MGR already set 13:56:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x7a00000000000000, 0x0}) [ 634.463297] binder: 19228:19229 ioctl 40046207 0 returned -16 [ 634.533136] binder: 19241:19242 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 634.546723] binder: BINDER_SET_CONTEXT_MGR already set [ 634.552365] binder: 19241:19242 ioctl 40046207 0 returned -16 13:56:55 executing program 5: r0 = gettid() syz_open_procfs(r0, &(0x7f0000000080)='schedstat\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='mounts\x00') fchmod(r2, 0x25) 13:56:55 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='clear_refs\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = syz_open_procfs(0x0, &(0x7f00000001c0)='cpuset\x00') sendfile(r3, r5, 0x0, 0x1) r6 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)={0xdc, r7, 0x4, 0x70bd2b, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DAEMON={0x44, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x8001}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x80000000}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x5}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}]}, @IPVS_CMD_ATTR_DAEMON={0x48, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_to_team\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x8}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x80000000}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x27}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x24}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xfff}]}, 0xdc}, 0x1, 0x0, 0x0, 0x20000005}, 0x20000000) syz_kvm_setup_cpu$x86(r0, r6, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:55 executing program 0: r0 = syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x6, 0x300) write$FUSE_IOCTL(r0, &(0x7f0000000280)={0x20, 0xfffffffffffffffe, 0x3, {0x22, 0x0, 0x2, 0x7}}, 0x20) r1 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) getsockopt$inet_sctp_SCTP_PR_STREAM_STATUS(r1, 0x84, 0x74, &(0x7f0000000000), &(0x7f0000000080)) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000000c0)=0x0) fcntl$setownex(r2, 0xf, &(0x7f0000000140)={0x0, r5}) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f0000000180)={0x0, 0x6}, &(0x7f00000001c0)=0x8) setsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000200)={r6, 0x3be0}, 0x8) sigaltstack(&(0x7f0000020000/0x1000)=nil, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0) syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x1, 0x400) 13:56:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x300000000000000, 0x0}) 13:56:55 executing program 3: setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) r1 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) recvmmsg(r0, &(0x7f0000000200), 0x38c, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000000c0)={0x0}, &(0x7f0000000100)=0xc) syz_open_procfs$namespace(r2, &(0x7f0000000140)='ns/cgroup\x00') sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 634.990531] binder: 19245:19246 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 635.022172] binder: BINDER_SET_CONTEXT_MGR already set [ 635.032640] binder: 19245:19246 ioctl 40046207 0 returned -16 13:56:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x6000000000000000, 0x0}) 13:56:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x5, 0x0, 0x0}) 13:56:55 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='clear_refs\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = syz_open_procfs(0x0, &(0x7f00000001c0)='cpuset\x00') sendfile(r3, r5, 0x0, 0x1) r6 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)={0xdc, r7, 0x4, 0x70bd2b, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DAEMON={0x44, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x8001}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x80000000}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x5}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}]}, @IPVS_CMD_ATTR_DAEMON={0x48, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_to_team\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x8}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x80000000}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x27}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x24}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xfff}]}, 0xdc}, 0x1, 0x0, 0x0, 0x20000005}, 0x20000000) syz_kvm_setup_cpu$x86(r0, r6, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:55 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) [ 635.223993] binder: BINDER_SET_CONTEXT_MGR already set [ 635.247237] binder: 19262:19263 ioctl 40046207 0 returned -16 [ 635.253493] binder: BINDER_SET_CONTEXT_MGR already set 13:56:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x3f00, 0x0}) [ 635.277571] binder: 19266:19269 ioctl 40046207 0 returned -16 [ 635.303138] binder: 19266:19271 Acquire 1 refcount change on invalid ref 0 ret -22 [ 635.320632] binder: 19266:19271 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 635.367388] binder: 19266:19269 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 635.368049] binder: BINDER_SET_CONTEXT_MGR already set [ 635.387452] binder: 19275:19276 ioctl 40046207 0 returned -16 [ 635.402707] binder: 19266:19269 ioctl c0306201 20000080 returned -14 13:56:55 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='clear_refs\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = syz_open_procfs(0x0, &(0x7f00000001c0)='cpuset\x00') sendfile(r3, r5, 0x0, 0x1) r6 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') syz_kvm_setup_cpu$x86(r0, r6, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x500000000000000, 0x0}) [ 635.615197] binder: BINDER_SET_CONTEXT_MGR already set [ 635.650557] binder: 19283:19284 ioctl 40046207 0 returned -16 13:56:56 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) creat(0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETAW(r0, 0x402c542c, &(0x7f00000000c0)) 13:56:56 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r2, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:56 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='clear_refs\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = syz_open_procfs(0x0, &(0x7f00000001c0)='cpuset\x00') sendfile(r3, r5, 0x0, 0x1) r6 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r6, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:56 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000000000)=0x10001, 0x4) 13:56:56 executing program 3 (fault-call:7 fault-nth:0): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x400000000000000, 0x0}) 13:56:56 executing program 1: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x3f00000000000000, 0x0, 0xf5) 13:56:56 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000080)={&(0x7f0000000000)='./file0\x00', r0}, 0x10) [ 635.978084] binder: BINDER_SET_CONTEXT_MGR already set [ 636.005501] binder: 19302:19303 ioctl 40046207 0 returned -16 13:56:56 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='clear_refs\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='cpuset\x00') sendfile(r2, r4, 0x0, 0x1) syz_kvm_setup_cpu$x86(r0, 0xffffffffffffffff, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x2000, 0x0}) 13:56:56 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:56 executing program 1 (fault-call:6 fault-nth:0): r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:56 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) [ 636.177832] binder: BINDER_SET_CONTEXT_MGR already set [ 636.205451] binder: 19316:19318 ioctl 40046207 0 returned -16 13:56:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x6000, 0x0}) 13:56:56 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='clear_refs\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f00000001c0)='cpuset\x00') r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r4, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) [ 636.341248] binder: BINDER_SET_CONTEXT_MGR already set [ 636.403809] binder: 19331:19339 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 636.404866] binder: 19331:19332 ioctl 40046207 0 returned -16 13:56:57 executing program 5: r0 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x0) ioctl$IOC_PR_RELEASE(r0, 0x401070ca, &(0x7f0000000080)={0x7ff, 0x7f}) r1 = gettid() syz_open_procfs(r1, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') write$FUSE_NOTIFY_RETRIEVE(r3, &(0x7f0000000000)={0x30, 0x5, 0x0, {0x0, 0x2, 0x1f, 0x79}}, 0x30) 13:56:57 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0xf, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:57 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:56:57 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) lsetxattr$security_smack_entry(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='security.SMACK64\x00', &(0x7f00000000c0)='/dev/vfio/vfio\x00', 0xf, 0x1) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:57 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='clear_refs\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r4, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x4, 0x0}) [ 636.864985] binder: BINDER_SET_CONTEXT_MGR already set 13:56:57 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x100000000000000, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:57 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x7fffffffffffffff, 0x9) [ 636.905384] binder: 19349:19351 ioctl 40046207 0 returned -16 13:56:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x68, 0x0}) 13:56:57 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000140)="7ac39128972fa98817193b6b37d5f9ca63d2ae0112b0568b9a70a897d6bf5e2cd6632df1c0f328f29f7a25109a43a5ff48b2ee6e5da1e56316d52a06e8bf1cca79111c149ccbd7b1381dbe146abbef2ac72ff094006d825ec84932875aa77f143939e23117d7a6c8e73924085796f8f9b28dc9de186f057e490cbd1e9a17d03d7608a0aea17d4759273e77b76c13af6f8c30eb9dd74ab65eeaf9eebfd27f1d645bf623", 0xa3) vmsplice(r2, &(0x7f00000004c0)=[{&(0x7f0000000200)="ed48c8110c87f0a507fbd86026841eda03f6b9aa72b3476652c3ce3e7dfb87465abe6efc143220b3e619d13ceb6058fb36130d8f79b41fd1eab53bc8834b2d7573ecab6ac53cd1fc043611b698db40b5d6b62a386445c1e26fa58b96005d93c0b30bea9729f09abd973ee5f6575063879814d9b4580bec0984729f8974bd0b5a10c4744a3e88eaf30e8b15c33a092ba33dcf8422d6849585fd033df958a6951e201774acc97054827b1a208aee25b4ad665c854b3e5aeb919085a10da8b5f4d22d1d09e53323413014b454f3f4d55fc71d61f4c120b76572c5c55bd4ca881b7910d3f7ab05af5adea01916f886c158b3824af056", 0xf4}, {&(0x7f0000000300)="4ebc2989030b2fca05bc80a1e751435b9b303b0979e708b877e894077ac29b4a8847f4dfa516516fb0ce565d7f4f0050ed9bbbea7c7e3a70fffa8fb5aab61bf87c98307fc91d394abd79f79598bec5aca0d8e9d36ac03ee9446a47e620a04977ea8346960a866e2f73a2d63a0aa022c2209f6d5ad80211f44784567e8e56c2a3c0ccc5be890ad087cf21a5c217ea96613695062625b92eb24271977571", 0x9d}, {&(0x7f00000003c0)="71f840f3eaae08b67d31ef5b61aa619f6f6be13d2083fb2159af48afa35651886dbde652f684b889865c686e35a2c9f55c3a285b616cd48c58001edefc0e26c2bc55254f9898f31d11b68cbe96a783cd3a9dccad1bf094022d952470c282b6e7789db584d2e8b18887a4164b5dd99368e680438330831f6904e8ed98788e192a94bf3992a072e0bb4641c6ac777f40e55745668ef77554c777517cf7dac7a8278f655227fd2cedc7a0eb976600611505f26b5703fee6829540e0eeefb576fab9441a52f2fad31a33d78d3259f3a891ee7ee55ba7bd8fa54832695b80adbee78915e46dabd7d489574e06f253", 0xec}, {&(0x7f0000000080)="758ada9d01aae962cbbee32f353bcb09684cebd0cfa970e7a4262e1d023aae2245f0a709f78cc6efbd8d335c27bfa76c440f15f7783e7e17bcd5649ae0d894f10f1faca2dca946e73f229b361cc6408ed279cfd9b2cf1f782f9d1c74691c85f819d1476ae889a1c3975ae03aae951a3c09ca3edac506c1", 0x77}, {&(0x7f0000000000)="440ad13933d7386293be3f73f89c5fefe3296289b8c424f96b22512ce677f29621f1", 0x22}], 0x5, 0x1) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:57 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='clear_refs\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:57 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x2000000, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) [ 637.069410] binder: BINDER_SET_CONTEXT_MGR already set [ 637.099780] binder: 19370:19371 ioctl 40046207 0 returned -16 13:56:58 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f0000000180)='smaps\x00') exit(0xfffffffffffffffc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$XDP_STATISTICS(r1, 0x11b, 0x7, &(0x7f00000001c0), &(0x7f0000000200)=0x18) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x73, &(0x7f0000000240)={0x0, 0x5, 0x10, 0x9, 0x5}, &(0x7f0000000280)=0x18) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r1, 0x84, 0x19, &(0x7f00000002c0)={r3, 0xa456}, 0x8) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000000)={{{@in6=@dev, @in6=@local}}, {{@in=@empty}, 0x0, @in=@initdev}}, &(0x7f0000000140)=0xe8) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:56:58 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x300020, 0x9) 13:56:58 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x14f, 0x0, 0x0, 0x17c) 13:56:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x2000000000000000, 0x0}) 13:56:58 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0xf000000, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:58 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='clear_refs\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:58 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x500020, 0x9) [ 637.849813] binder_thread_write: 8 callbacks suppressed [ 637.849856] binder: 19395:19396 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 637.863980] binder: BINDER_SET_CONTEXT_MGR already set [ 637.880640] binder: 19395:19396 ioctl 40046207 0 returned -16 13:56:58 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x1000000, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x7a000000, 0x0}) 13:56:58 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='clear_refs\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:58 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x600020, 0x9) 13:56:58 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x2, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) [ 638.052316] binder: 19416:19417 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 638.155882] binder: BINDER_SET_CONTEXT_MGR already set [ 638.178073] binder: 19416:19417 ioctl 40046207 0 returned -16 13:56:59 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x2000, 0x0) ioctl$KVM_GET_LAPIC(r0, 0x8400ae8e, &(0x7f0000000400)={"8df3c8c280357eec5cf80df9de49ab89979a062289d6ed512e2d45fbf8651b118a3500d8cc7fe51856ac7fcfded2906aea184bb39fafd92ffafe094ab0caba86c52ffd948b020b3b3a5472642202cf4d3d6e8d6ea4353407421a6867f80090015d16e48d0a347ca4bf23205c312a3d6a8dced8e5c97cfec8e36f21d477e19133f071308f5b135a5b873a7a3d06a4e1a96d2fa9a8dcea8a54fdd59db1c111dff551a27176100de1bd349a0e05e95ecbe5f7d5b5772e97bc342bce521a76d0c350f55b874b6712cb5c77ba0dd318fda5fb95d1ce9e4808dce28a9cb40a1c932f2d42d34704cf2d838a841480a490060e6be3a096cd008032c44e9693af96501f0321019cb346dfab96cc38fbce8e163d73b0d37d39b03144c2e0dfc8ddde025a355e31f7a777d482bb13ac88783cf4fa49e2a4f4de247ef39d8990e64072bbfd2283a617430e480e54b3e1d149958495b0e891959bed7ca66c4c6a555d55bdf3b786f865e1b61f4b3833496d6ab70e5d31e99845ec8b03437eb09c3a9b6400908cb201cdffa921b7edea17edb61cab67a0ece25fd54063f5744109916bb305dc845c41d1bf069bfa7d5ac02a1cc403b5e47f810e86dfc22c88c370c7a85533d122371ce0caf3cf7a0b5ad186e65d8c5792359e834f5e7070d875123370158da6c4b063ef69b8328fd813ccc772583dee22b798398ba4f6048d10477e09c1579ed9834e49e605cbaa4c66135dc8da1386a1ad4830f763e4dffa6ca78d0e7bf73e1d5420d8ef5ddb8a066a75c5a0b47ada937d0384f0877d22f1ce1ce35f328ac61a9ef6c503029d411d25e2f198d60a26579aa6880f1851fcb6ba8ecec0066d8223a4b15416d16c6902655a6333a701468a518d1aeeb7a4717a66784565d0d320e866ea70116c711c992b306c186df46a7ba5fdb46cae8350b1ebf4629e80d7312dd0e976ebd74b9e2fc9b36db36d835219f2eaaf76f53ba23c98c227221c550413fb630e19bb5c67ecace3ccf8d2939d5ff00f01a947f2975e7b7ba5fdc7efc04704652ede62b9ccf813ef503915f63713f3590ccc5442868daeb17e8883373340c4280f499886b438281f4c68678c3c95af39c6787ec1ffd51bb92dd3999e637bfd3594980a2f4057b5797aa60c20f3d4ee23bf20f83abe15a31f80e134e4a81c67c407541d0a07a7054fc0736641f5a9ba34c4c58334618fb4b99188e9f50e4858375aceeec4e7c8eeb55c5cd743e132f621ea0547152e49e22d3742350136a4bc493592c33a5f8427eef1815aca1c028c5bc894905f0ea5291270ded46b17ee22bd41c2b5bcd70493bd3df722158819be658564677db8eb991e11c370613ad91257cc66964173d586052cde307a86eeab40509a1dfedb1889e67f30f9631f4f60bd0fabcafedf82756931c2a82e90ac2a633a6e42572e0d01a45a043ef17b93"}) r1 = gettid() syz_open_procfs(r1, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') write$FUSE_INIT(r3, &(0x7f0000000040)={0x50, 0x0, 0x1, {0x7, 0x1c, 0x5, 0x40000, 0x4, 0x8, 0x4, 0xfffffffffffffffa}}, 0x50) 13:56:59 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4002, 0x9) 13:56:59 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000080)=@assoc_value={0x0}, &(0x7f00000000c0)=0x8) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r0, 0x4010ae68, &(0x7f0000000000)={0x6000, 0x2000}) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r4, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) setsockopt$inet_sctp6_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f0000000140)={r2, 0xf43}, 0x8) 13:56:59 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x8, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:59 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='clear_refs\x00') ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x48000000, 0x0}) [ 638.744982] binder: 19443:19445 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 638.775996] binder: BINDER_SET_CONTEXT_MGR already set [ 638.782286] binder: 19443:19445 ioctl 40046207 0 returned -16 13:56:59 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x200000000000000, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x5000000, 0x0}) 13:56:59 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4003, 0x9) 13:56:59 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='clear_refs\x00') ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) [ 638.912321] binder: 19456:19458 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:56:59 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x20000000000000, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000080)=0x3f, 0x152) r4 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) write$FUSE_GETXATTR(r0, &(0x7f0000000000)={0x18, 0x0, 0x6, {0x6}}, 0x18) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) ioctl$KVM_DEASSIGN_DEV_IRQ(r4, 0x4040ae75, &(0x7f00000000c0)={0x8, 0x7, 0x10000, 0x2}) 13:56:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x200000000000000, 0x0}) [ 638.962506] binder: BINDER_SET_CONTEXT_MGR already set [ 638.977766] binder: 19456:19458 ioctl 40046207 0 returned -16 [ 639.139259] binder: 19474:19476 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 639.182835] binder: BINDER_SET_CONTEXT_MGR already set [ 639.188934] binder: 19474:19476 ioctl 40046207 0 returned -16 13:56:59 executing program 5: r0 = gettid() syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20ncci\x00', 0x20141, 0x0) syz_open_procfs(r0, &(0x7f0000000000)='fd/3\x00') 13:56:59 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x800000000000000, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:56:59 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4005, 0x9) 13:56:59 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='clear_refs\x00') ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:56:59 executing program 0: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x300020, 0x9) 13:56:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x700000000000000, 0x0}) [ 639.639287] binder: 19482:19483 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:57:00 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0xf00000000000000, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:57:00 executing program 0 (fault-call:3 fault-nth:0): r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 13:57:00 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4007, 0x9) [ 639.715707] binder: 19482:19497 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:57:00 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r4, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:57:00 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x13) [ 639.824867] FAULT_INJECTION: forcing a failure. [ 639.824867] name failslab, interval 1, probability 0, space 0, times 0 13:57:00 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x8000000, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) [ 639.901490] CPU: 1 PID: 19509 Comm: syz-executor0 Not tainted 4.20.0+ #396 [ 639.908551] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 639.908558] Call Trace: [ 639.908588] dump_stack+0x1d3/0x2c6 [ 639.908609] ? dump_stack_print_info.cold.1+0x20/0x20 [ 639.908628] ? print_usage_bug+0xc0/0xc0 [ 639.908656] should_fail.cold.4+0xa/0x17 [ 639.908681] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 639.908705] ? print_usage_bug+0xc0/0xc0 [ 639.908737] ? find_held_lock+0x36/0x1c0 [ 639.908775] ? ___might_sleep+0x1ed/0x300 [ 639.950833] ? arch_local_save_flags+0x40/0x40 [ 639.950865] __should_failslab+0x124/0x180 [ 639.950883] should_failslab+0x9/0x14 [ 639.967642] kmem_cache_alloc_node+0x273/0x730 [ 639.972239] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 639.972257] ? check_preemption_disabled+0x48/0x280 [ 639.972349] __alloc_skb+0x119/0x760 [ 639.986531] ? __lock_is_held+0xb5/0x140 [ 639.990605] ? skb_scrub_packet+0x440/0x440 [ 639.990631] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 639.990730] ? fib_table_lookup+0x14f2/0x2550 [ 640.005030] alloc_skb_with_frags+0x133/0x7c0 [ 640.009551] ? graph_lock+0x270/0x270 [ 640.013371] ? skb_complete_wifi_ack+0x1b0/0x1b0 [ 640.018146] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 640.023700] ? check_preemption_disabled+0x48/0x280 [ 640.028739] sock_alloc_send_pskb+0x865/0xab0 [ 640.033259] ? sock_wmalloc+0x1f0/0x1f0 [ 640.037245] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 640.042898] ? find_exception+0x517/0xc40 [ 640.047076] ? check_preemption_disabled+0x48/0x280 [ 640.052105] ? ipv4_link_failure+0x220/0x220 [ 640.056527] ? kasan_check_read+0x11/0x20 [ 640.060823] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 640.066114] ? find_held_lock+0x36/0x1c0 [ 640.070188] ? graph_lock+0x270/0x270 [ 640.074020] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 640.079572] ? check_preemption_disabled+0x48/0x280 [ 640.084611] sock_alloc_send_skb+0x32/0x40 [ 640.088866] __ip_append_data.isra.50+0x1b7e/0x3310 [ 640.093910] ? udp_sk_rx_dst_set+0x330/0x330 [ 640.098419] ? xfrm_policy_lookup+0x80/0x80 [ 640.102768] ? __ip_flush_pending_frames.isra.51+0x2d0/0x2d0 [ 640.108583] ? ip_route_input_noref+0x260/0x260 [ 640.113259] ? print_usage_bug+0xc0/0xc0 [ 640.117346] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 640.122893] ? ipv4_mtu+0x37d/0x590 [ 640.126536] ? __build_flow_key.constprop.55+0x600/0x600 [ 640.132016] ? ip_route_output_key_hash+0x270/0x3b0 [ 640.137041] ? lock_downgrade+0x900/0x900 [ 640.141208] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 640.146752] ? ip_setup_cork+0x55d/0x890 [ 640.146770] ip_make_skb+0x2aa/0x340 [ 640.146789] ? udp_sk_rx_dst_set+0x330/0x330 [ 640.146808] ? ip_flush_pending_frames+0x30/0x30 [ 640.146825] ? ip_route_output_key_hash_rcu+0x3490/0x3490 [ 640.146843] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 640.146856] ? xfrm_lookup_route+0x74/0x1f0 [ 640.146873] udp_sendmsg+0x29b1/0x3bf0 [ 640.159037] ? print_usage_bug+0xc0/0xc0 [ 640.159060] ? udp_sk_rx_dst_set+0x330/0x330 [ 640.159081] ? udp4_lib_lookup_skb+0x430/0x430 [ 640.196119] ? __lock_acquire+0x62f/0x4c20 [ 640.200373] ? find_held_lock+0x36/0x1c0 [ 640.204452] ? print_usage_bug+0xc0/0xc0 [ 640.208540] ? print_usage_bug+0xc0/0xc0 [ 640.212619] ? __lock_acquire+0x62f/0x4c20 [ 640.216863] ? print_usage_bug+0xc0/0xc0 [ 640.220946] ? mark_held_locks+0x130/0x130 [ 640.225202] ? print_usage_bug+0xc0/0xc0 [ 640.229349] udpv6_sendmsg+0x182c/0x36a0 [ 640.233416] ? udpv6_sendmsg+0x182c/0x36a0 [ 640.237658] ? __lock_acquire+0x62f/0x4c20 [ 640.241912] ? udp6_unicast_rcv_skb.isra.30+0x2f0/0x2f0 [ 640.241934] ? graph_lock+0x270/0x270 [ 640.241951] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 640.256642] ? aa_label_sk_perm+0xfc/0xa50 [ 640.256662] ? __lock_acquire+0x62f/0x4c20 [ 640.256675] ? print_usage_bug+0xc0/0xc0 [ 640.256692] ? aa_profile_af_perm+0x410/0x410 [ 640.256719] ? ___might_sleep+0x1ed/0x300 [ 640.256735] ? arch_local_save_flags+0x40/0x40 [ 640.256754] ? lock_downgrade+0x900/0x900 [ 640.286629] ? __might_sleep+0x95/0x190 [ 640.290680] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 640.295627] ? aa_sk_perm+0x22b/0x8e0 [ 640.299438] ? import_iovec+0x178/0x2d0 [ 640.303430] ? aa_af_perm+0x5a0/0x5a0 [ 640.307255] inet_sendmsg+0x1a1/0x690 [ 640.311059] ? udp6_unicast_rcv_skb.isra.30+0x2f0/0x2f0 [ 640.316410] ? inet_sendmsg+0x1a1/0x690 [ 640.320375] ? ipip_gro_receive+0x100/0x100 [ 640.324702] ? apparmor_socket_sendmsg+0x29/0x30 [ 640.329474] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 640.335025] ? security_socket_sendmsg+0x94/0xc0 [ 640.339780] ? ipip_gro_receive+0x100/0x100 [ 640.344157] sock_sendmsg+0xd5/0x120 [ 640.347885] ___sys_sendmsg+0x51d/0x930 [ 640.351867] ? copy_msghdr_from_user+0x580/0x580 [ 640.356650] ? get_pid_task+0xd6/0x1a0 [ 640.360529] ? lock_downgrade+0x900/0x900 [ 640.364676] ? check_preemption_disabled+0x48/0x280 [ 640.369709] ? __fget_light+0x2e9/0x430 [ 640.373694] ? fget_raw+0x20/0x20 [ 640.377472] ? __f_unlock_pos+0x19/0x20 [ 640.381438] ? lock_downgrade+0x900/0x900 [ 640.385596] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 640.391149] ? proc_fail_nth_write+0x9e/0x210 [ 640.395643] ? proc_cwd_link+0x1d0/0x1d0 [ 640.399705] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 640.405246] ? sockfd_lookup_light+0xc5/0x160 [ 640.409760] __sys_sendmmsg+0x246/0x6d0 [ 640.413744] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 640.418061] ? __lock_is_held+0xb5/0x140 [ 640.422120] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 640.427659] ? check_preemption_disabled+0x48/0x280 [ 640.432687] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 640.438215] ? fput+0x130/0x1a0 [ 640.441665] ? do_syscall_64+0x9a/0x820 [ 640.445641] ? do_syscall_64+0x9a/0x820 [ 640.449626] ? lockdep_hardirqs_on+0x421/0x5c0 [ 640.454213] ? trace_hardirqs_on+0xbd/0x310 [ 640.458528] ? __ia32_sys_read+0xb0/0xb0 [ 640.462585] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 640.467970] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 640.473427] __x64_sys_sendmmsg+0x9d/0x100 [ 640.477659] do_syscall_64+0x1b9/0x820 [ 640.481539] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 640.486911] ? syscall_return_slowpath+0x5e0/0x5e0 [ 640.491878] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 640.496760] ? trace_hardirqs_on_caller+0x310/0x310 [ 640.501770] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 640.506787] ? prepare_exit_to_usermode+0x291/0x3b0 [ 640.511806] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 640.516644] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 640.521821] RIP: 0033:0x457ec9 [ 640.525019] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 640.543920] RSP: 002b:00007ff3402dfc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 640.551632] RAX: ffffffffffffffda RBX: 00007ff3402dfc90 RCX: 0000000000457ec9 [ 640.558898] RDX: 00000000000004ff RSI: 00000000200092c0 RDI: 0000000000000003 [ 640.566173] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 640.573449] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff3402e06d4 [ 640.580721] R13: 00000000004c4b4c R14: 00000000004d8148 R15: 0000000000000004 13:57:01 executing program 5: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') setsockopt$inet_udp_encap(r1, 0x11, 0x64, &(0x7f0000000000)=0x4, 0x4) 13:57:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x6800000000000000, 0x0}) 13:57:01 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r2, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:57:01 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0xf00, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:57:01 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0xffffffffffffffff) 13:57:01 executing program 0 (fault-call:3 fault-nth:1): r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 640.683564] binder: 19532:19536 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 640.698985] FAULT_INJECTION: forcing a failure. [ 640.698985] name failslab, interval 1, probability 0, space 0, times 0 [ 640.727785] binder: BINDER_SET_CONTEXT_MGR already set 13:57:01 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x3) 13:57:01 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) [ 640.744177] binder: 19532:19536 ioctl 40046207 0 returned -16 [ 640.765404] CPU: 1 PID: 19535 Comm: syz-executor0 Not tainted 4.20.0+ #396 [ 640.772464] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 640.781823] Call Trace: [ 640.784441] dump_stack+0x1d3/0x2c6 [ 640.788097] ? dump_stack_print_info.cold.1+0x20/0x20 [ 640.793318] should_fail.cold.4+0xa/0x17 [ 640.797399] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 640.802509] ? __save_stack_trace+0x8d/0xf0 [ 640.806860] ? save_stack+0xa9/0xd0 [ 640.810501] ? save_stack+0x43/0xd0 [ 640.814147] ? find_held_lock+0x36/0x1c0 [ 640.818233] ? ___might_sleep+0x1ed/0x300 [ 640.822388] ? arch_local_save_flags+0x40/0x40 [ 640.827001] ? check_preemption_disabled+0x48/0x280 [ 640.832050] __should_failslab+0x124/0x180 [ 640.836302] should_failslab+0x9/0x14 [ 640.840117] kmem_cache_alloc_node_trace+0x277/0x740 [ 640.845237] ? __alloc_skb+0x119/0x760 [ 640.849145] __kmalloc_node_track_caller+0x3c/0x70 [ 640.854089] __kmalloc_reserve.isra.40+0x41/0xe0 [ 640.858859] __alloc_skb+0x155/0x760 [ 640.862580] ? __lock_is_held+0xb5/0x140 [ 640.866654] ? skb_scrub_packet+0x440/0x440 [ 640.870995] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 640.876546] ? fib_table_lookup+0x14f2/0x2550 [ 640.881074] alloc_skb_with_frags+0x133/0x7c0 [ 640.885585] ? graph_lock+0x270/0x270 [ 640.889401] ? skb_complete_wifi_ack+0x1b0/0x1b0 13:57:01 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:57:01 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:57:01 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) [ 640.894176] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 640.899725] ? check_preemption_disabled+0x48/0x280 [ 640.904765] sock_alloc_send_pskb+0x865/0xab0 [ 640.909284] ? sock_wmalloc+0x1f0/0x1f0 [ 640.913265] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 640.918814] ? find_exception+0x517/0xc40 [ 640.922979] ? check_preemption_disabled+0x48/0x280 [ 640.928031] ? ipv4_link_failure+0x220/0x220 [ 640.932450] ? kasan_check_read+0x11/0x20 [ 640.936608] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 640.941891] ? find_held_lock+0x36/0x1c0 [ 640.945967] ? graph_lock+0x270/0x270 [ 640.945991] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 640.946008] ? check_preemption_disabled+0x48/0x280 [ 640.946029] sock_alloc_send_skb+0x32/0x40 [ 640.946049] __ip_append_data.isra.50+0x1b7e/0x3310 [ 640.946073] ? udp_sk_rx_dst_set+0x330/0x330 [ 640.946090] ? xfrm_policy_lookup+0x80/0x80 [ 640.946110] ? __ip_flush_pending_frames.isra.51+0x2d0/0x2d0 [ 640.984195] ? ip_route_input_noref+0x260/0x260 [ 640.988867] ? print_usage_bug+0xc0/0xc0 [ 640.992948] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 640.998484] ? ipv4_mtu+0x37d/0x590 [ 641.002105] ? __build_flow_key.constprop.55+0x600/0x600 [ 641.007547] ? ip_route_output_key_hash+0x270/0x3b0 [ 641.012554] ? lock_downgrade+0x900/0x900 [ 641.016709] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 641.022241] ? ip_setup_cork+0x55d/0x890 [ 641.026299] ip_make_skb+0x2aa/0x340 [ 641.030010] ? udp_sk_rx_dst_set+0x330/0x330 [ 641.034413] ? ip_flush_pending_frames+0x30/0x30 [ 641.039164] ? ip_route_output_key_hash_rcu+0x3490/0x3490 [ 641.044699] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 641.050230] ? xfrm_lookup_route+0x74/0x1f0 [ 641.054544] udp_sendmsg+0x29b1/0x3bf0 [ 641.058428] ? print_usage_bug+0xc0/0xc0 [ 641.062485] ? udp_sk_rx_dst_set+0x330/0x330 [ 641.066905] ? udp4_lib_lookup_skb+0x430/0x430 [ 641.071487] ? __lock_acquire+0x62f/0x4c20 [ 641.075742] ? find_held_lock+0x36/0x1c0 [ 641.079797] ? print_usage_bug+0xc0/0xc0 [ 641.083857] ? print_usage_bug+0xc0/0xc0 [ 641.087923] ? __lock_acquire+0x62f/0x4c20 [ 641.092153] ? print_usage_bug+0xc0/0xc0 [ 641.096218] ? mark_held_locks+0x130/0x130 [ 641.100447] ? print_usage_bug+0xc0/0xc0 [ 641.104507] udpv6_sendmsg+0x182c/0x36a0 [ 641.108564] ? udpv6_sendmsg+0x182c/0x36a0 [ 641.112790] ? __lock_acquire+0x62f/0x4c20 [ 641.117022] ? udp6_unicast_rcv_skb.isra.30+0x2f0/0x2f0 [ 641.122383] ? graph_lock+0x270/0x270 [ 641.126179] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 641.131738] ? aa_label_sk_perm+0xfc/0xa50 [ 641.135970] ? __lock_acquire+0x62f/0x4c20 [ 641.140196] ? print_usage_bug+0xc0/0xc0 [ 641.144251] ? aa_profile_af_perm+0x410/0x410 [ 641.148745] ? ___might_sleep+0x1ed/0x300 [ 641.152883] ? arch_local_save_flags+0x40/0x40 [ 641.157471] ? lock_downgrade+0x900/0x900 [ 641.161615] ? __might_sleep+0x95/0x190 [ 641.165587] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 641.170511] ? aa_sk_perm+0x22b/0x8e0 [ 641.174304] ? import_iovec+0x178/0x2d0 [ 641.178278] ? aa_af_perm+0x5a0/0x5a0 [ 641.182080] inet_sendmsg+0x1a1/0x690 [ 641.185873] ? udp6_unicast_rcv_skb.isra.30+0x2f0/0x2f0 [ 641.191240] ? inet_sendmsg+0x1a1/0x690 [ 641.195231] ? ipip_gro_receive+0x100/0x100 [ 641.199547] ? apparmor_socket_sendmsg+0x29/0x30 [ 641.204307] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 641.209842] ? security_socket_sendmsg+0x94/0xc0 [ 641.214591] ? ipip_gro_receive+0x100/0x100 [ 641.218920] sock_sendmsg+0xd5/0x120 [ 641.222631] ___sys_sendmsg+0x51d/0x930 [ 641.226602] ? copy_msghdr_from_user+0x580/0x580 [ 641.231354] ? get_pid_task+0xd6/0x1a0 [ 641.235266] ? lock_downgrade+0x900/0x900 [ 641.239405] ? check_preemption_disabled+0x48/0x280 [ 641.244416] ? __fget_light+0x2e9/0x430 [ 641.248386] ? fget_raw+0x20/0x20 [ 641.251834] ? __f_unlock_pos+0x19/0x20 [ 641.255803] ? lock_downgrade+0x900/0x900 [ 641.259946] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 641.265478] ? proc_fail_nth_write+0x9e/0x210 [ 641.269966] ? proc_cwd_link+0x1d0/0x1d0 [ 641.274050] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 641.279582] ? sockfd_lookup_light+0xc5/0x160 [ 641.284073] __sys_sendmmsg+0x246/0x6d0 [ 641.288050] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 641.292393] ? __lock_is_held+0xb5/0x140 [ 641.296453] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 641.302011] ? check_preemption_disabled+0x48/0x280 [ 641.307032] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 641.312560] ? fput+0x130/0x1a0 [ 641.315835] ? do_syscall_64+0x9a/0x820 [ 641.319799] ? do_syscall_64+0x9a/0x820 [ 641.323767] ? lockdep_hardirqs_on+0x421/0x5c0 [ 641.328369] ? trace_hardirqs_on+0xbd/0x310 [ 641.332686] ? __ia32_sys_read+0xb0/0xb0 [ 641.336742] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 641.342127] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 641.347576] __x64_sys_sendmmsg+0x9d/0x100 [ 641.351807] do_syscall_64+0x1b9/0x820 [ 641.355714] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 641.361073] ? syscall_return_slowpath+0x5e0/0x5e0 [ 641.365996] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 641.370830] ? trace_hardirqs_on_caller+0x310/0x310 [ 641.375851] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 641.380884] ? prepare_exit_to_usermode+0x291/0x3b0 [ 641.385903] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 641.390747] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 641.395929] RIP: 0033:0x457ec9 [ 641.399119] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 641.418013] RSP: 002b:00007ff3402dfc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 641.425725] RAX: ffffffffffffffda RBX: 00007ff3402dfc90 RCX: 0000000000457ec9 [ 641.432986] RDX: 00000000000004ff RSI: 00000000200092c0 RDI: 0000000000000003 [ 641.440246] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 13:57:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x3000000, 0x0}) [ 641.447505] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff3402e06d4 [ 641.454766] R13: 00000000004c4b4c R14: 00000000004d8148 R15: 0000000000000004 [ 641.532257] binder: 19566:19567 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 641.599704] binder: BINDER_SET_CONTEXT_MGR already set [ 641.605904] binder: 19566:19567 ioctl 40046207 0 returned -16 13:57:02 executing program 5: r0 = gettid() syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000000)={r2}) 13:57:02 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x4) 13:57:02 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:57:02 executing program 0 (fault-call:3 fault-nth:2): r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 13:57:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x600000000000000, 0x0}) 13:57:02 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r4, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) [ 641.707903] FAULT_INJECTION: forcing a failure. [ 641.707903] name failslab, interval 1, probability 0, space 0, times 0 [ 641.721524] binder: 19581:19585 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:57:02 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) [ 641.766685] CPU: 1 PID: 19577 Comm: syz-executor0 Not tainted 4.20.0+ #396 [ 641.773801] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 641.783179] Call Trace: [ 641.785795] dump_stack+0x1d3/0x2c6 [ 641.789449] ? dump_stack_print_info.cold.1+0x20/0x20 [ 641.794658] ? sock_alloc_send_skb+0x32/0x40 [ 641.799079] ? __ip_append_data.isra.50+0x1b7e/0x3310 [ 641.799092] ? ip_make_skb+0x2aa/0x340 [ 641.799109] ? udp_sendmsg+0x29b1/0x3bf0 [ 641.799127] ? inet_sendmsg+0x1a1/0x690 13:57:02 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x8) [ 641.799149] should_fail.cold.4+0xa/0x17 [ 641.799170] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 641.799191] ? rcu_lockdep_current_cpu_online+0x1a4/0x210 [ 641.825426] ? rcu_pm_notify+0xc0/0xc0 [ 641.825445] ? graph_lock+0x270/0x270 [ 641.825463] ? __kmalloc_node_track_caller+0x3c/0x70 [ 641.825476] ? rcu_read_lock_sched_held+0x108/0x120 [ 641.825492] ? kasan_unpoison_shadow+0x35/0x50 [ 641.825509] ? find_held_lock+0x36/0x1c0 [ 641.838816] ? __nf_conntrack_find_get.part.42+0x10e1/0x1cf0 [ 641.838849] ? lock_downgrade+0x900/0x900 [ 641.867522] ? check_preemption_disabled+0x48/0x280 [ 641.872566] ? kasan_check_read+0x11/0x20 [ 641.876734] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 641.882043] __should_failslab+0x124/0x180 [ 641.886296] should_failslab+0x9/0x14 [ 641.890112] kmem_cache_alloc+0x47/0x730 [ 641.894280] ? __nf_conntrack_find_get.part.42+0x1108/0x1cf0 [ 641.900101] __nf_conntrack_alloc+0x1aa/0x7c0 [ 641.904620] ? early_drop+0xc20/0xc20 [ 641.908444] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 641.913651] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 641.919198] init_conntrack.isra.44+0xfed/0x13c0 [ 641.923952] ? __lock_acquire+0x62f/0x4c20 [ 641.928182] ? skb_set_owner_w+0x21d/0x320 [ 641.932415] ? nf_conntrack_alloc+0x50/0x50 [ 641.936732] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 641.941918] ? lock_acquire+0x1ed/0x520 [ 641.945889] ? nf_conntrack_in+0x5de/0x1390 [ 641.950209] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 641.955741] ? check_preemption_disabled+0x48/0x280 [ 641.960784] ? kasan_check_read+0x11/0x20 [ 641.964926] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 641.970201] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 641.975649] nf_conntrack_in+0xc7d/0x1390 [ 641.979841] ? nf_conntrack_update+0xbb0/0xbb0 [ 641.984420] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 641.989438] ? rt_cache_valid+0x250/0x250 [ 641.993675] ? __do_replace+0xab0/0xab0 [ 641.997641] ? graph_lock+0x270/0x270 [ 642.001436] ? lock_acquire+0x110/0x520 [ 642.005415] ? nf_ct_l4proto_register_sysctl+0x1a0/0x1a0 [ 642.010862] ipv4_conntrack_local+0x16a/0x220 [ 642.015354] nf_hook_slow+0xc2/0x1c0 [ 642.019064] __ip_local_out+0x568/0xb30 [ 642.023030] ? ip_finish_output+0xf90/0xf90 [ 642.027347] ? ip_append_data.part.52+0x170/0x170 [ 642.032190] ? skb_checksum+0xd9/0x140 [ 642.036073] ip_local_out+0x2d/0x1b0 [ 642.039782] ? ip_route_output_key_hash_rcu+0x3490/0x3490 [ 642.045408] ip_send_skb+0x40/0xe0 [ 642.048941] udp_send_skb.isra.46+0x6a4/0x1150 [ 642.053551] udp_sendmsg+0x29fc/0x3bf0 [ 642.057434] ? print_usage_bug+0xc0/0xc0 [ 642.061495] ? udp_sk_rx_dst_set+0x330/0x330 [ 642.065903] ? udp4_lib_lookup_skb+0x430/0x430 [ 642.070481] ? __lock_acquire+0x62f/0x4c20 [ 642.074708] ? find_held_lock+0x36/0x1c0 [ 642.078769] ? print_usage_bug+0xc0/0xc0 [ 642.082841] ? print_usage_bug+0xc0/0xc0 [ 642.086902] ? __lock_acquire+0x62f/0x4c20 [ 642.091129] ? print_usage_bug+0xc0/0xc0 [ 642.095188] ? mark_held_locks+0x130/0x130 [ 642.099415] ? print_usage_bug+0xc0/0xc0 [ 642.103477] udpv6_sendmsg+0x182c/0x36a0 [ 642.107533] ? udpv6_sendmsg+0x182c/0x36a0 [ 642.111764] ? __lock_acquire+0x62f/0x4c20 [ 642.116025] ? udp6_unicast_rcv_skb.isra.30+0x2f0/0x2f0 [ 642.121385] ? graph_lock+0x270/0x270 [ 642.125178] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 642.130713] ? aa_label_sk_perm+0xfc/0xa50 [ 642.134941] ? __lock_acquire+0x62f/0x4c20 [ 642.139167] ? print_usage_bug+0xc0/0xc0 [ 642.143219] ? aa_profile_af_perm+0x410/0x410 [ 642.147924] ? pcmcia_card_add+0x220/0x330 [ 642.152166] ? ___might_sleep+0x1ed/0x300 [ 642.156306] ? arch_local_save_flags+0x40/0x40 [ 642.160882] ? lock_downgrade+0x900/0x900 [ 642.165029] ? __might_sleep+0x95/0x190 [ 642.169002] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 642.173923] ? aa_sk_perm+0x22b/0x8e0 [ 642.177714] ? import_iovec+0x178/0x2d0 [ 642.181690] ? aa_af_perm+0x5a0/0x5a0 [ 642.185491] inet_sendmsg+0x1a1/0x690 [ 642.189288] ? udp6_unicast_rcv_skb.isra.30+0x2f0/0x2f0 [ 642.194667] ? inet_sendmsg+0x1a1/0x690 [ 642.198635] ? ipip_gro_receive+0x100/0x100 [ 642.202977] ? apparmor_socket_sendmsg+0x29/0x30 [ 642.207728] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 642.213257] ? security_socket_sendmsg+0x94/0xc0 [ 642.218007] ? ipip_gro_receive+0x100/0x100 [ 642.222338] sock_sendmsg+0xd5/0x120 [ 642.226046] ___sys_sendmsg+0x51d/0x930 [ 642.230018] ? copy_msghdr_from_user+0x580/0x580 [ 642.234773] ? get_pid_task+0xd6/0x1a0 [ 642.238666] ? lock_downgrade+0x900/0x900 [ 642.242820] ? check_preemption_disabled+0x48/0x280 [ 642.247842] ? __fget_light+0x2e9/0x430 [ 642.251820] ? fget_raw+0x20/0x20 [ 642.255270] ? __f_unlock_pos+0x19/0x20 [ 642.259238] ? lock_downgrade+0x900/0x900 [ 642.263383] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 642.268948] ? proc_fail_nth_write+0x9e/0x210 [ 642.273438] ? proc_cwd_link+0x1d0/0x1d0 [ 642.277498] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 642.283030] ? sockfd_lookup_light+0xc5/0x160 [ 642.287520] __sys_sendmmsg+0x246/0x6d0 [ 642.291585] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 642.295901] ? __lock_is_held+0xb5/0x140 [ 642.299960] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 642.305495] ? check_preemption_disabled+0x48/0x280 [ 642.310540] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 642.316073] ? fput+0x130/0x1a0 [ 642.319345] ? do_syscall_64+0x9a/0x820 [ 642.323311] ? do_syscall_64+0x9a/0x820 [ 642.327284] ? lockdep_hardirqs_on+0x421/0x5c0 [ 642.331861] ? trace_hardirqs_on+0xbd/0x310 [ 642.336175] ? __ia32_sys_read+0xb0/0xb0 [ 642.340265] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 642.345623] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 642.351074] __x64_sys_sendmmsg+0x9d/0x100 [ 642.355305] do_syscall_64+0x1b9/0x820 [ 642.359184] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 642.364540] ? syscall_return_slowpath+0x5e0/0x5e0 [ 642.369462] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 642.374298] ? trace_hardirqs_on_caller+0x310/0x310 [ 642.379707] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 642.384722] ? prepare_exit_to_usermode+0x291/0x3b0 [ 642.389741] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 642.394599] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 642.399794] RIP: 0033:0x457ec9 [ 642.402984] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 642.421878] RSP: 002b:00007ff3402dfc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 642.429582] RAX: ffffffffffffffda RBX: 00007ff3402dfc90 RCX: 0000000000457ec9 [ 642.436842] RDX: 00000000000004ff RSI: 00000000200092c0 RDI: 0000000000000003 [ 642.444127] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 642.451384] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff3402e06d4 [ 642.458646] R13: 00000000004c4b4c R14: 00000000004d8148 R15: 0000000000000004 13:57:02 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:57:02 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) ioctl$VIDIOC_SUBDEV_S_CROP(r0, 0xc038563c, &(0x7f0000000080)={0x1, 0x0, {0x300e, 0x7ff, 0x0, 0x20}}) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) getsockopt$inet_sctp_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000000000), &(0x7f0000000040)=0x8) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) [ 642.483243] binder: BINDER_SET_CONTEXT_MGR already set [ 642.496480] binder: 19581:19585 ioctl 40046207 0 returned -16 13:57:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x4000000, 0x0}) 13:57:02 executing program 5: r0 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20ncci\x00', 0x2000, 0x0) ioctl$TCGETS(r0, 0x5401, &(0x7f0000000140)) r1 = gettid() r2 = syz_open_procfs(r1, &(0x7f00000003c0)='smaps\x00') exit(0x0) r3 = eventfd2(0x4, 0x80800) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000000), &(0x7f0000000040)=0x14) r5 = syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') ioctl$KVM_HYPERV_EVENTFD(r5, 0x4018aebd, &(0x7f0000000080)={0x1, r3, 0x1}) 13:57:03 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x72e) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:57:03 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 642.597113] binder: BINDER_SET_CONTEXT_MGR already set [ 642.602462] binder: 19609:19610 ioctl 40046207 0 returned -16 13:57:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0xa4000000, 0x0}) 13:57:03 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) [ 642.792347] binder: BINDER_SET_CONTEXT_MGR already set 13:57:03 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) [ 642.827579] binder: 19628:19630 ioctl 40046207 0 returned -16 13:57:03 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r4, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:57:03 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000, 0xb, &(0x7f000000b000/0x2000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000140)={r0, 0x10, &(0x7f00000000c0)={&(0x7f0000000000)=""/161, 0xa1, 0xffffffffffffffff}}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000001c0)=r2, 0xfffffffffffffcd6) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:57:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x4c000000, 0x0}) 13:57:03 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) ioctl$VIDIOC_G_STD(r0, 0x80085617, &(0x7f0000000000)) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:57:03 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) [ 643.051404] binder_thread_write: 2 callbacks suppressed [ 643.051418] binder: 19647:19648 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:57:03 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) [ 643.206227] binder: BINDER_SET_CONTEXT_MGR already set [ 643.234954] binder: 19647:19648 ioctl 40046207 0 returned -16 13:57:03 executing program 5: r0 = gettid() syz_open_procfs(r0, &(0x7f00000003c0)='smaps\x00') exit(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000001700)='fd/3\x00') 13:57:03 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) r1 = msgget(0x0, 0x100) msgctl$MSG_INFO(r1, 0xc, &(0x7f0000000000)=""/224) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:57:03 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:57:03 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r4, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:57:03 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0xa) 13:57:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x3f000000, 0x0}) [ 643.556933] binder: 19671:19672 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:57:03 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) [ 643.610304] binder: BINDER_SET_CONTEXT_MGR already set 13:57:04 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) lsetxattr$security_evm(&(0x7f0000000000)='./bus\x00', &(0x7f0000000040)='security.evm\x00', &(0x7f0000000080)=@md5={0x1, "484bc7f0cc2f9d01259071b2c290d956"}, 0x11, 0x1) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r0, 0x407, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) [ 643.634390] binder: 19671:19672 ioctl 40046207 0 returned -16 13:57:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x2000000, 0x0}) 13:57:04 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r4, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:57:04 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) [ 643.809288] binder: 19691:19692 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:57:04 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) setns(r0, 0x8000000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$sock_SIOCBRDELBR(r1, 0x89a1, &(0x7f0000000040)='vcan0\x00') openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080)={0x3, 0xfffffffffffffffa, 0xff, 0x1000, 0x3}, 0x14) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) [ 643.935859] binder: BINDER_SET_CONTEXT_MGR already set [ 643.941195] binder: 19691:19692 ioctl 40046207 0 returned -16 [ 644.035981] binder: 19691:19703 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:57:04 executing program 5: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) setns(r0, 0x8000000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$sock_SIOCBRDELBR(r1, 0x89a1, &(0x7f0000000040)='vcan0\x00') openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080)={0x3, 0xfffffffffffffffa, 0xff, 0x1000, 0x3}, 0x14) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:57:04 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1}, 0x0) 13:57:04 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x46, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:57:04 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r4, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:57:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x7a00, 0x0}) 13:57:04 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0xe00000000000000) [ 644.483290] binder: 19718:19725 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:57:04 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x7ffff000}], 0x1}, 0x0) [ 644.560922] binder: BINDER_SET_CONTEXT_MGR already set 13:57:04 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:57:05 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x40000, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$VIDIOC_SUBDEV_S_EDID(r0, 0xc0285629, &(0x7f0000000140)={0x0, 0x6, 0x33, [], &(0x7f00000000c0)=0xfffffffffffffffc}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000000)={&(0x7f0000009000/0x3000)=nil, 0x3000}, &(0x7f0000000040)=0x10) ioctl$sock_kcm_SIOCKCMUNATTACH(r0, 0x89e1, &(0x7f0000000080)={r1}) openat$vsock(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vsock\x00', 0x0, 0x0) [ 644.605956] binder: 19718:19725 ioctl 40046207 0 returned -16 13:57:05 executing program 5: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) setns(r0, 0x8000000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$sock_SIOCBRDELBR(r1, 0x89a1, &(0x7f0000000040)='vcan0\x00') openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080)={0x3, 0xfffffffffffffffa, 0xff, 0x1000, 0x3}, 0x14) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:57:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x300, 0x0}) 13:57:05 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0xf}], 0x1}, 0x0) [ 644.773045] binder: 19744:19745 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:57:05 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x3000)=nil, 0x3000, 0x2000, 0x200000000000c, &(0x7f000000a000/0x2000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x2000000000000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:57:05 executing program 5: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) setns(r0, 0x8000000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$sock_SIOCBRDELBR(r1, 0x89a1, &(0x7f0000000040)='vcan0\x00') openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080)={0x3, 0xfffffffffffffffa, 0xff, 0x1000, 0x3}, 0x14) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) [ 644.907218] binder: BINDER_SET_CONTEXT_MGR already set [ 644.925926] binder: 19744:19745 ioctl 40046207 0 returned -16 13:57:05 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:57:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x6, 0x0}) 13:57:05 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000000)={0x10001, 0x2, 0x3, 0x3f, 0x0}, &(0x7f0000000040)=0x10) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000140)={r2, @in6={{0xa, 0x4e22, 0x1bf6, @local, 0x8}}}, &(0x7f0000000080)=0x84) [ 645.132436] binder: 19767:19769 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:57:05 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0xf4010000) 13:57:05 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x20ba0000}], 0x1}, 0x0) 13:57:05 executing program 5: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) setns(r0, 0x8000000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$sock_SIOCBRDELBR(r1, 0x89a1, &(0x7f0000000040)='vcan0\x00') openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080)={0x3, 0xfffffffffffffffa, 0xff, 0x1000, 0x3}, 0x14) [ 645.181567] binder: BINDER_SET_CONTEXT_MGR already set 13:57:05 executing program 1: r0 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x100, 0x80000) write$UHID_INPUT2(r0, &(0x7f0000000140)={0xc, 0xd0, "efd269bd8a816d4ea286a1e4d13850b871ce1310c7e5066ac4d6f5cbda58e164fbfd6e40460dd176c864d47b9adfa0ef7e1817710f084db3d7d7ab478f396ea23a2b088c7d3a9c27dd41aa660f32012e55e528c15e9faaa80f2d4e5033832d219124f746e4545d5385a42747ee0a3fa43741386a24af01d212b8cfdb13e47dfa910ebb846a05d4696aac98d2076e1447b43d35813eeccedeabca2300e93fdef5f7f5041f985d94fd1d5bdaee047f14a06c0833e82ef2e170b9e228a1c0b0163e356c2e45db012414f241f6d1cf7b94cb"}, 0xd6) r1 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x4, 0x408000) r2 = pkey_alloc(0x0, 0x1) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x0, 0x8c4b815a5465c2b2, 0xffffffffffffffff, 0x0) pkey_mprotect(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x8, r2) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000000240)=0x6, 0x1) r3 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x10000200000c, 0xc010, r3, 0x0) mremap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3000, 0xfffffffffffffffb, &(0x7f0000ffd000/0x3000)=nil) fallocate(r3, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x200002) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) ioctl$TUNSETOFFLOAD(r3, 0x400454d0, 0xc) [ 645.222886] binder: 19767:19769 ioctl 40046207 0 returned -16 13:57:05 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:57:05 executing program 5: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) setns(r0, 0x8000000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$sock_SIOCBRDELBR(r1, 0x89a1, &(0x7f0000000040)='vcan0\x00') openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) 13:57:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x4800, 0x0}) 13:57:05 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x600}, 0x0) [ 645.409088] binder: 19793:19795 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 645.480147] binder: BINDER_SET_CONTEXT_MGR already set [ 645.494141] binder: 19793:19795 ioctl 40046207 0 returned -16 13:57:05 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0xe00) 13:57:05 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:57:05 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x2}, 0x0) 13:57:05 executing program 5: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) setns(r0, 0x8000000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) 13:57:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x7a, 0x0}) 13:57:05 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) ioctl$CAPI_INSTALLED(r0, 0x80024322) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x41, 0x80000000, 0x3) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f0000000040)=0x2, 0x4) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x488c962a9cf1cfea) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f0000000140)={0x0, 0xd1, "025858c4c05067b60fd1d88c03312709edeeb8e852d93206c7c30095c994f16d848d8c6f1e4a30744a2a750119c7980d91cd4e516b39b73a18eaab855310693c2a8c85e3d607cf435ef169de9eccae7d6724c6f5dea687cebd6e9004f77e13da87a314e9a0d0e85a9abdb0e27e3d6c8a1174a95630ae911018030073a4fd5d1710dd58be8423ee4eccd78a29e87ea417c68f1400646e323d4d9a1ec565659901aaa9af4c4a6d259f6255c64394b8092c50098496939339693d0c7a6577c597933fd1558a0a4cd722da4f4737e5d8166be6"}, &(0x7f00000000c0)=0xd9) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000240)={r3, @in6={{0xa, 0x4e23, 0x1, @ipv4={[], [], @local}, 0x81}}, 0x7, 0x2, 0x1000, 0x1}, &(0x7f0000000300)=0x98) write$selinux_attr(r0, &(0x7f0000000080)='system_u:object_r:systemd_logind_var_run_t:s0\x00', 0x2e) accept4$alg(r2, 0x0, 0x0, 0x80000) [ 645.650056] binder: 19810:19812 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:57:06 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x401200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:57:06 executing program 5: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) setns(r0, 0x8000000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) 13:57:06 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r4, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) [ 645.756655] binder: BINDER_SET_CONTEXT_MGR already set 13:57:06 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x3}, 0x0) [ 645.826368] binder: 19810:19828 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 645.832956] binder: 19810:19812 ioctl 40046207 0 returned -16 13:57:06 executing program 5: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) setns(r0, 0x8000000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) 13:57:06 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x5) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:57:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x74, 0x0}) [ 646.151793] binder: 19845:19846 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 646.183858] binder: BINDER_SET_CONTEXT_MGR already set [ 646.202822] binder: 19845:19846 ioctl 40046207 0 returned -16 13:57:06 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x7) 13:57:06 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0xf}, 0x0) 13:57:06 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r4, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:57:06 executing program 5: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) setns(r0, 0x8000000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) 13:57:06 executing program 1: r0 = open(&(0x7f0000000040)='./bus\x00', 0x0, 0x80) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:57:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x500, 0x0}) [ 646.322929] binder: BINDER_SET_CONTEXT_MGR already set [ 646.337970] binder: 19859:19861 ioctl 40046207 0 returned -16 13:57:06 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x10}, 0x0) 13:57:06 executing program 5: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) setns(r0, 0x8000000) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) 13:57:06 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000040)=0x1, 0x4) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:57:06 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x1800) 13:57:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x6c00000000000000, 0x0}) 13:57:06 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r4, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:57:06 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000000)={{0x7f, @remote, 0x4e21, 0x1, 'none\x00', 0x2a, 0xe4d, 0x1b}, {@loopback, 0x4e24, 0x1, 0x1, 0x40, 0x1}}, 0x44) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) ioctl$BLKGETSIZE64(r0, 0x80081272, &(0x7f0000000080)) 13:57:06 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x8}, 0x0) [ 646.538665] binder: BINDER_SET_CONTEXT_MGR already set [ 646.571868] binder: 19884:19885 ioctl 40046207 0 returned -16 13:57:06 executing program 5: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) setns(r0, 0x8000000) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) 13:57:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x7000000, 0x0}) 13:57:07 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1, 0x0, 0xf}, 0x0) [ 646.741222] binder: BINDER_SET_CONTEXT_MGR already set [ 646.757242] binder: 19903:19904 ioctl 40046207 0 returned -16 13:57:07 executing program 5: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) setns(r0, 0x8000000) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) 13:57:07 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:57:07 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f00000001c0)={0x0, 0x0, 0x7, 0x0, [], [{0x100000001, 0x2, 0x6, 0x8001, 0x5410, 0x3ff}, {0x3f, 0x0, 0x5, 0x1, 0x7fffffff, 0x100000000}], [[], [], [], [], [], [], []]}) openat$cgroup_int(r0, &(0x7f0000000440)='io.max\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = getpgrp(0xffffffffffffffff) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000480)) sched_setparam(r2, &(0x7f00000000c0)=0x4) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$VIDIOC_G_FBUF(r0, 0x8030560a, &(0x7f0000000080)={0x10, 0x4b, &(0x7f0000000000)="baef7a281cb0a7d6cee87b2a64bdc0c42a6ffce57aa2f5f55a861d7f0c23a53ddcc89ad6eb99e8fc6924cfad1856118c7119d05c4af56c40fa8f7c8e7d6e2dc154435f", {0x3ff, 0x8, 0x494e4f4b, 0x7, 0x7, 0x7, 0x0, 0x1}}) fstat(r1, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETGROUP(r0, 0x400454ce, r3) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:57:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x60000000, 0x0}) [ 646.980735] binder: BINDER_SET_CONTEXT_MGR already set [ 647.065669] binder: 19922:19923 ioctl 40046207 0 returned -16 13:57:07 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0xa00) 13:57:07 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) dup3(r0, r0, 0x80000) 13:57:07 executing program 5: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) 13:57:07 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1, 0x0, 0x800000000000000}, 0x0) 13:57:07 executing program 4: openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:57:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0xfffffdfd, 0x0}) 13:57:07 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x13, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) remap_file_pages(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x4, 0xa046, 0x90800) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)) rmdir(&(0x7f0000009740)='./bus\x00') ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400204) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) r1 = dup(r0) open(&(0x7f0000000080)='./bus\x00', 0x101400, 0x81) ioctl$DRM_IOCTL_AUTH_MAGIC(r0, 0x40046411, &(0x7f0000000040)=0xd8d) r2 = socket$nl_generic(0x10, 0x3, 0x10) [ 647.454903] binder: BINDER_SET_CONTEXT_MGR already set [ 647.474965] binder: 19933:19940 ioctl 40046207 0 returned -16 sendmmsg(r0, &(0x7f0000009480)=[{{&(0x7f0000000100)=@in={0x2, 0x4e23, @loopback}, 0x80, &(0x7f0000000780)=[{&(0x7f0000000180)="63b2124b523d1b411d199677e7c6bda63b34cd254a1460c007d271a094de60253bfc9ffbbd8f56ca7377ba1a444c36c9c9b0b1d27a59926a739be24f95f61b77bba650fdd6f848eee510dbd645a5d958e28b2990a8026c055c5a72ddb11e092ce69f67b20463b9c5fece6942b0836ba8459c2953a02d604b394c38d34c569d5c03ea816e4da261aadf0bd9392aba7e0a84f9d913c91d75610e5c429419246e6ea35fa8e038e42cf577a8ccbcedf38796a79f28c7416734d4", 0xb8}, {&(0x7f0000000240)="4740fb9585701d121c74d5970f7e854de5d9e50574dd6c80c772c22d5e9bdef223fb9fc83c5f529714fa271d5b1c4f80fc5d87ab40e787c38aa01f97e74eb7f6562a94cf436d2e35204e2c7519c5fbca0521c716e64f27005c1e7e0ca72dc4de113c853a339ff971b84708f948542ff4a4ca6edd94d78ea738641d91794ace6d3fb89715391c6a407ceb9acc366ac1997592", 0x92}, {&(0x7f0000000300)="c458bc0c5b04f8c5f216fd45e38236d29f554997576fffe1aa38af53b3cdb5a97ee621954aa3427f9032c818c5313022239131797f17cd63120b79ca0a47", 0x3e}, {&(0x7f0000000340)="ef6b9c12889fbc01802a5900749a88f15ab26056b2ca29fd1e25e573e14e4c112cf410b48340056860d132a888147e821f77bb50a206981124e7183884a86e7a6d51e521d3bf35a9bd218bd566fcd08b9cf23e6809f23a34fb71420b03dcce94dfab7665895ef2b408bae721d3330a83e8e9fd08edbf52f5918d95ef27e8ec52ea0fe60f61c2118478c1ae147a7af1a192bfa0f687e8aff6e42fb97489723ac03703dfd5263fcbfa21b33fa63bfc961c251f18a2bf161594f6f3fca4a0bdbd2abd8bd694f98b02b41a7a4ebf9e4e52f1d6a30f49774615df888de50ba12871066d7a94acb72f06b31cd8433213f3f0a61ee2df24a16eb6f74b4d0c", 0xfb}, {&(0x7f0000000440)="f9d3d564acd2128240fef45a0fc026be865e4ced42945a7785cddc566ffedacd7d141aeb5b62c3b8278370fbd6037d0e34eb78dff9736d493ed4d2a281b513305a1bab7218e9b1ee40e54af8336fd5e1ac59fcdb9f88837d9e4082f64c45537181ca65afbc5cde6a019777908a677a71802e3dbfe45b927ed69a81c5a7daa869daaaacb02b643cc2791188d8ce9184ac5909640683bba6714097d25e9b941aef575e215a326324e6838ee9082b583dc6d28d584bfd06f3825b1a7a1e11c7527be41ddfb0c0383aa765cd8a4c1d9074e32bec5fdeda03091250fd7e1f9c16d6849d7af133c28e561e73d9bd9ac96a45d5c86b7826c19ca5008336a7", 0xfb}, {&(0x7f0000000540)="0fa8ca7e4d5647fdb61ab885648b05a37a35176414514f469e49ec02986aeda4af6483de1b5848468c20699ccb213af235ad6cd25eb242ca61a4636032c3afa4b9268c1b0d0e299db6edda719cea68b2e53654ec4d25f230b614004b5f14037b3a8edc9cc498ed2728407f1e6bdcf7c0e0dc62dc7cc5066f2607681fbc5d036cb5c782ad234d74689b97e7366bb36d30ef27ecf9216700cd6bd5d39ef8a010523af227c65b4a28577bdb1afdb85d330190eb", 0xb2}, {&(0x7f0000000600)="60c33c565e1a7fff2c132f350c5ab239ceb18665e53664d5623fe4fa5cffcc07dcb8adf78c9df65b203b4479603515fb46ed3bc51a97c8bf2d341790c726303992294a7605155809760e53dd8095ff6e", 0x50}, {&(0x7f0000000680)="dc70fba5e9e767deaea5c4f09d66f90713ccafae78612fa661375fd4f0eae548d1a1fd067de6298bf202565a822ba1bf8da1fff22ab02cdb1ba6b3da4cf25efaf96758803876f6c397a9ccabfdec32ca0b6ce425bfa94f63aedf092950f9f705b2f712f5a66ed52939c0ed2989062c489fae0d5b75dbdad28e5ef07dc7d728c9284e8bd81b9360817ae9b3fb8c1dc1e2b2da6bb9d8ed6880614a43986c3951b2bcabba1d962c10e633e64b23a1fad3acd5191c9cf404a3867211b5e0a30dbca1a658f5910f8a938ea1b63a98721e2943053b80b7297c3de84ed506ac7c3241f56f719d25cf29b1", 0xe7}], 0x8, &(0x7f0000000800)=[{0x108, 0x11f, 0x5, "4d30fa94fe6034cf4b19af0ded4b6c5ef06a388b75c3faaeb95a92c3a4a15d9e33ae799939fa95f1a3898c24bfb3caedef5b219f7b2619fcff10907c478d44b9f7dd007bbd8cf31a72b0e3122b000e8f04fb7d9e0041dc28056b62271a0244e9e9e5c3f149b0c44dc999c5431d7aa03f964e9ff9ab5f9312858dbd9e0981d14db868094ad97db0cd0f7ffa314f2f0aa28a6e8baebe9cca371aa70704c009b6ba78cf8c4c08a441a04eb6b53790bd5f6908c6bcf619329aa74a74108210bb8f22fbec54388779ebc58462d5ed31a5aa7de3a90f77b2ee13f6485523635ee5e686c5dbec71eb6b96ac2d103ace28147d00accb421095"}, {0x10, 0x11d, 0x7fffffff}], 0x118}, 0x100000001}, {{&(0x7f0000000940)=@in6={0xa, 0x4e22, 0x800, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x5b}, 0x80, &(0x7f0000000dc0)=[{&(0x7f00000009c0)="5fca805a0b96c04b6ff55a35d96b04bfa12005a006b309f2ea5fa95b318cc736c0b6dab68f30fdf25984339b46f8f346e38183fcf66b74f62387e8a8bbd7ab3053c580fc4cfdb5947269aae06bae01f89a340860e911384ba676", 0x5a}, {&(0x7f0000000a40)="0487e41720342391db5a68fb7489aa8be8b633d57e428e049cf2c70ce73592", 0x1f}, {&(0x7f0000000a80)="74b202ad3c80c6e4b4b20bb2f3a54e2dc0de8889b5641cffd9b29c8708c3e10a62390c17e8d7c2a9fab0ae6353bd53e25352b509ce73a53234e893454f947032081ff07ba7c838a047a64ad9d4170e7853d23b62652fbc578560a7c2d6c6afd2fd3b3ac0b8f0ad968c64f86f6ae1cf63ef617f8465ef4fa4a1dc8a1dbd0204bc930cd365e53ff8ff5658c6dc16ec2c7e1c06dcfcc1507a085e713e1e0cf5ca3e6e5abda00734b3b9bb5c11ba6aaa3774ec7e4b23d004bf2b91f1b9b903e760a701332e", 0xc3}, {&(0x7f0000000b80)="60a3ff6ce6829762156a6ed4f4231e30fa764fce6cff9c84f43a25b84dfef64f4433d7c7cc908e892f95042ca465ee1b6fdcd5258868a41d3cccc95fd68cd192ff1990c84dc35d98f931eb8eb54797266589d6fe62d0ffbd3e1371de5928c94cb3bbf98411309a8d519ea86bbbde64a040cbf4d32e5e30633c4e13a282bfac59e230e0f3845e7d693c7737c929a6361f98c5ec4f4b8b7922cec3afe38f9acc6df6794e9f934169203bbf550ef6cae2b4dc02cf14dde335ee43a4502107290149985e1c53cb9d130657281ff1f2baebab1be57042c35d8943fc674d451b5afd6d1bbd19f4371e9af8a7e1d7343f", 0xed}, {&(0x7f0000000c80)="a47bbd25236c16bbe5b950622799cb1cb00aa5251b2d1c083fd40948ef2be0a5c301406044ea61407870ca39544e2eb5f046e64528a2d80788b4dc46beee05a959371e367128c11b506655bb065bf41e1861355a5923af9c1082b04ae2d3823d07f63c18b0f67e35442985b10eb19394dbfafb40a9433badbf36ada5e6b912da84ff6170", 0x84}, {&(0x7f0000000d40)="9f1535b5c99fde6f3ffba8c7695cd8ea191a702492e510c4484ba93dc72816eb4c2db02a39776627fc044c77f8013f30c7508ea1386d44ffe96dcf2bea269b044a2b9df96225dea1a55ed6b37d7731", 0x4f}], 0x6}, 0x3}, {{&(0x7f0000000e40)=@ethernet={0x7, @local}, 0x80, &(0x7f0000002180)=[{&(0x7f0000000ec0)="48106c9982244b628bba1b987497bb503988a7808ab9c5a01ec0b60ee44acba51d12f4f7f2251b30dfb5948d4de61fd41bd0e78c881bc052e73042d92f21c4d2e0ddadd56bd9a41959073d5ad78dbe9477a635169fa9bd4fb825633497a345f7", 0x60}, {&(0x7f0000000f40)="c523b962159330f0dbd3f9903de5a1ded65fb34aaa53ee135c0b0f4411b6df38c4c0e2e10762239a4758949fb3fd7ad42de18e0b2bc8683f45c730e8e5effba4dd09560e5cc62e00a4247f341a615a2e8dfade1cd1ce4fd101f526e6e3cffa1eb6a3c461dc728a8b86afe57e183fe0810e8c8c85da4bd9c901fc6edbc16cfa603790b2a467533d1bc02855e9d408b5408a7fe27052aae1dba894ded7e53a79c5d72f7fd75bc1cb0d16846efc702972b6a2b91ae938b1d64694ba425b6b34c82374ee80331340b1021f2f200a21b313dcd7abce27ea44bc99c97b918a6ff622fae8d5217adca6", 0xe6}, {&(0x7f0000001040)="e0874ae4c3d297998186be155b1d64c69ed3f50bd992013383ba67d643f043fe2d3e841d2b4d9b5e4ac7341f3ab69c0797b8b3e0a00c3aaaf210bef0cf6f1c30654ae44d59a60a186983e32167a70efb88d0056aec52c803e2d2d4f170f00a184d50e5c42badeaa986628e2c933757c2c075e689d568b523ac1340512b2873819d06a9962db2cda1f3abba9ef4228009bbf30f03c94d9114a36887811bf41d05aebca5886753b4731215b106d76ad86a5f3e8b9f9da893afca7b8b37bb07b9c6c2ae4efc771f898a1f7a291423e9e2f963b21e27aaa1d8dd9fbd676031b316765c0ad1fca3a10d225d5c505efe674c066a5abd0383d8f27e7c0aa5da68bced3a524d28817621f8978f50efc18b3fcdffda19e892f4306c1abecce84acf76b5d95e5a232e9481138bed495b8597f9fe2848f8e4a12f20458d8365f813d5cf44eaedb68dceb18798c2c5b362a52012484c522a1dc52b077c76f20e9c3d28a502e58946657c11226867ada0218c16d425a2bb9347f35e11730d63e977225c84132bbb50b3cb2bb33e15d7f7bd93403f857e91e217607665768d83d5b21cc28e6ad99e5ba60c7e9e7b73a2ae934fea5b3ae43697a194840c31bdca20717835d70ffdea9458ecf9cc368e8ee64c59878d08afeda8921ef695d62d4e81569b9faf6f91dee2ca5d072caf656a2498b23afab413e537cc3df704d99ed402c3a39c1928755c542ec6b8c3637260ed5c50bb446482192a3263fa3bf9271767acb08c9956526dd78a1204abd32535a8059a21160b701bb9c558f7b7f5020c205c9b3699192d48531997b50cf8f15caa503dd06e99c07c782684f1ab6f6ee33f8f0957ed6829d49c0fe197c3a1fdfcb023f75b8d6ba0b97e523e0f1255ec221477647c5ad353e040b07241f970bdd59709b2d9f98baae46e3153d8655e312595e78c025d70eac975307106807ee01067f61ac4d089f2a9a3c5925f46a25e4577a00440f57387351b5bcc426eb6b720584c04b08d9acf73d11e2e54afefe3a1ce377882fb0fa6b5963fbfd0c336c9d8081f4bbe20b92b84ede694ab994052cdf1a6b3a7580063cf8bc03491ab77ebb386089a0e748488b4e8f3cc6f4c732dedeb251857750a27316726a98284c518a2417cd0996e92ba048cfe35b3dd8973e39d08364d378d677becb668f904d9525e5c7f5a0283a0848806579d70a88b75fb0285b8f9bea9ec0da5fa9ca6e943ffbed3001b4925ed4342bc2f041204de5fcae5fbf36e1166cafaddace6c0239e42357d990f5e7b821c4bc5e2e0938686f323cdabdf821de37961713de2da712723e4883b079e4ba9c215e63a5b7882f671eeada51fbfc6b613390e1fd7b4c7ae4fff6704b7d865972f1a7c0eb9deb57b19a1987ba888c3b8551f269c49e293c4c6da5e6278b7077aa088cdf7b5254651ba9f8a25e2d928f957872bfa6433260ce3016140910ee13c36fa70204440c268410b25fe3e721d726e1c0cd4ed98a5da01133a45aca65f25f7cfc3851d3e58b11499f9dd1b7f0900719ccfea05616242f3977b504331024a739e482aad6dd3a2ae5421001b732af9fdd8b7cc1060d31aeb62585240fc5e40c2173f08f5d89f115b666b838db59f775a1acdce33b0e5291307cf7f1c0979818184c035a39eb525aa639118d0a978a9cb6f655d98ec8b77e39e730a7b4d1cdd5ff287f62e8e4adf0b63749193f507747e5e25c7d21e1980f32212a401ac2b676f918c4d2fe90ab4d16376cc8111acb8776fcbee50b24e7250b0aa4b54a1146e9cc4517a75ae40c5ea5cc1eb65d527f24315b83efe36a427622295a5e9b3631ba3fa4dbd59abd584525aa165808682687252553d62b3f77a889a572aafcb0cece63f3a3a299d87897cd04ab2c7a8b506da8e0f8356e17522891cb9449c3b3835845f8263959ea1b50fe43e2ff79b326519fe5e7cbc58e4be56355dbc0e90f8b2ade5cc833b5cd40008d78770a9b60785722a3ee88b799eb7b49de23b1dfb47597ce71802821139590cb11006cd5497e0fc6e3b292fa878088307e2ec1b544afc31d1c602cd40770072e5232c043af709ea04ec249c18d14a9edf6390dab8e24ab73a8d29d9d6fd794ad81d05121212f6624c3e720d52874ce94efd862afc94c8043d51ab81d63942951e5c89cd71858dcf0e023354e6d663aa7397c989b07fea072a5014b6802d16160fc7b565b0697655b11a2472215a2483ba5e583ee61db183ee610f1c172f101c211500b27284620c0cdc831dbd624e63da32c26acf22558ea785c4a99c3230c114429b1ec43590bdaf5ae696bcab84b67125d03ed9d868608a1fa3bd7fc126c97c349c2f2b0367cebababa1ce137d514421d341709dbfe5535af5b27e42bb251ad7afebb27fcb9f64bd11e64e5532cf088015438cf9e0a7f4599e896024b265da507fd5f464d47d5e89ed663a15a6363ca376429627bb9202a0ce1fc3b292db10962f1457a303d658509c1d9bf0011801a573a0f8b94947b2282e111c37732b07b67ce2fa3a65f376a9ae9980d4e1de00929d8d7ea4fe480570430c29fc6e2c71f052abe9025fd482df12233d001203828b3c8619018d908e1ff4a0d7cd52b88fa86e06aea9f95204eddb1c26b8a7fc1c76c69a2c7e020275d8652325d824daa24c5979891c1666b47e583fb4dc4945257ba2c4e82e0d88b0a6db3926c41fedf57d6a656c0424abab6c88156b4f94ac021a6e3673c18e9a609f5e457a46ab3a55ff4e5ddcc0fb68c64b8053d9d06b5cf0af2163af45c801878af67bd069a63112fb7f9f06a35b809dec255417bc0a15cba62168e57f9fb2da26cd93337a2623beb3be01a30e8ede35f13985b9bf3deca94457fed8dd4ac247d888cd313180dc29120258ea66c9103b64cb18a89ccfb3992678322799fd730fe6c672a100dc10204362d12cef33ae96c7ba04893ea64c12bafe0e3a0dbdd38d656cbf930494bf9562ec6db74877a2646540d9c95c9bf798581b1dcfeb3a4d272fa5e88fcae209e1d5139db2755b02e2991db3908c12cc042ee4f47177bc890bc5c9c042864daa31a0d1fddb8f8358aa52fe0d5ec90c5b83eb0158d7371c5381bc5e49985c5156bd5225855eb9f24f5838c12a1baf2cd8ed7225eb4ff229e5e122961a26fcdc8ca12a611db70841a30725f4524688b50d437fff5d2c8d2964228817fd402a18a1d9056914191bec8b5e85c88ba6b0cb6a4592052e9f62f3d2293bb3b7c864d448c459200a7e946caf8f69bec71273f0995c4e558f52cb1ebd69d9fe2b3d5b029a04190c7c970c175c0ced5cf098474718c39695f8f8e881364f64e78db72c19b6d231cf55b13de40624298308afa41ca6651903d526f09029da82865d014c8793be153b154835deb0e6c5c926cd6198e2ac7f528242b0cd507335a537bffeb884bc66cacdf6d14c4f581de8f6c05499c0257e36eb0f591011689f03d5cab1718c03e1e1a002c08921415cd8750240586dcd73fc41f360cc7827cd6be6f24079df2536fbaf075658ee6449524af67041f20843ef593bc480f259e26f1b265676aa8abdd56b614138d4c0baad834ce4c61abc373bece597a65d1abccb42c251eb216993ffd1ff8acbca2db99f8d8833b1d4f7e5ccdf504695f43a75e58f20b8a51394dbdd6c22be5bac998f3e05e74760ce302571e1fc26cef172da80807ace7b05cc71a8490777b6b72788ea913cf508b2fb2a309832fc003beeace6b43a307035c87761ee4be000db8ea59b2ee9d0f010ca264762af45a8ee97ad486a27a971c9360f408f71765f54183d3a2e76563acb3fba64f4dbb4a4c9b4c4cd8c0b65142f2301dbee33770b7476a978cd3266a919e41f0fb18b3d1db050e745584fe45a4a42d111aec74e63bf014580fc73150c8dfe0a2b7d16c3ef54a42e09a4d1341a83a2da41cae8bf1d3b5547efbdd422b1fa859c06bc927da4ca911ef445efae4b836cd1cc9aa6d7e70e95dbd6e6e1ff2ac8a38f7f4fd42970acecb3c3c68a64c062ff68f383d7a1e9ad1a3ed83c17d5c5f8839428f9e95c128e24b18c8e2fffe949c3a9498b0dd8a21d774b5637314638c097c1a047abfb59efe2eb30a306113dcd1c2b34af2c9fab8fa5ad63f9283ad9dc842e06b4b95aad6aa57cc0c879fc6af439c6a2ee6ec691b5dbe4ade0b16eb2455fcc084967f2acaec90fbaf14a801d1d0cff001632bfbac8e337dd7d20181b894826e702ded390e606fd068a19b9fa572f2f2447e769edf4761a1e02b9d8d6f6b9a563545f84aee6e4a68d30eb2b99b8e4c8d8224e631347729d24da097af43ff1d9c54113f8c085da591dba6f55beb5ec673c097d2baee62769940686481c08f76923cffb63401edc01c2d9276bce500f9f2e86a63d07d4f64f0eba36cc66c8a6eeb23f4868a4339f7959fe828e7050a668ff8a4b2230d338c244d962f60a95810f962f22b435ccda428e18892c67925497a3afd277b577998268c8e6c7e635b2d8fa84e5c283e6058b3c94b1dd4e6ea8518a396304f746f9d382b80feabaab29abb89f052db814806c6528af3c647ec708050fc12eb9d427a3a0e7e6534308374d97431232fba965d9fc17bd905dd3f0aa1532f2efaf2f8b922bf05b09dab48d6681d38d805875a1ce8435bc3b920d060a34e4cabee8b7142ed4f39725e6d96359bda3e6e32cc81c4019204f1daa2741ddb808c82f7d473f43264011186fa2d4ec18c7368aebffdd7cc1d3eae0826eea1907eb1e6f2251545cfe35ee23e9cc6a3b0c454a9591abf2ffe3effe415009a2f8a99afe6593f97b7f373e21448905ecbd159207efecd1f23d183477ae7977775d9a3d0719b2db98b1297017b3f50b11d3d777c94324923b6d48e32da72ae59eb65cd226df6fae14ddb7546a77c5c1f2d15b638575932c087651b2a7f9248e546336b677b74b3f5fe693a66ed7fd0c40674fb0fb1b0eacbf6856a70924105f237bfcb3e2bdc29146d9c32442876cd1f1f76ece8d905a44ac5c6a95ecb60e048b2044f0aa1f46346a5faf45a46e70f1d90e439cd7776da1c6cf201f83b432f3d8736fe063a1bc100ff9cd39485aa6e24e38d096dc5915744445cd400a1b7f8ec1f933f031248f6219eb8f7bbcb1d74c045d7d677fbd460707e19de95187ecde85326d5aa85ddd043917d9ed5af28151d36839cd93cefb7e529929a683d00a757d28c682cdb6d6143b8633ae7c93b770d09b1d85a047289edd6b8a50ebd603f4aa405a7da4c1181ae13a277fbf846fd1c450e5a53acb02ff276ecc49d2ead87c3af26b9695c658cbfe5d5fb4a8b29eb59dea92696aad742571ee0f2cc2c67a51a3e4071238b092a82f28213d6eef69d3282e00e2766693c82c836e84f190e615337c20c1d384e744182f047a70a76137b033bf5a2e5233d690cf785e7218ed3809ee1e04bb915b855567b70672c6bc7a316fb682235f4b21fa0c017ad9a62e978c636bd3867b88911660362849d4dffcf543dcb180899a2120ae213bb75ecedd463932482658746a35dcd5350f4851502842d6443dd525f9545248190af519c32f9b70f1ed11062ab188e94abef372df6185effd1da9a6a3810d6a1e8f0ef2a199e8762bf4c2a88cebdba17884c5a27e2fb685a503367d1b1ac52a15b10f9e12ca7dfbd40adec48e7e5eaced9e6be0b5394094637682984af90681c763223a0603281799732d891cd6ab6e16e0b7d18c357b5bd0655d52ce05680b5ed499d5088984f037b1e614b895d3d7c8fcc752e8e68eefb64766b0ffca69d1bc63a525b5aae6fa3711699193b", 0x1000}, {&(0x7f0000002040)="7267f252daf499f192fca3e1afdbc0eb03a9315efe63e13993fe5e091fbcd2044024678209eeb31e963d0c034fd70f612ee57d96b2d4a3476d0d6bdf470dfe3d59a385097eb99d619bf840a3b2955fc68e9324c29d3883339e5f9f535e", 0x5d}, {&(0x7f00000020c0)="063a1e767fc00324d5b02954a608ec8e3663e7234d8958611119d1bc09f007916c0564af6ff075fe5e93ad9a07e89b502f0619427a08d013e02e04ab632e4b275084251718b043b9f92f64d2727a80530cd98e16dddffd3622a4c96d3c13ca4fe5b2aa31aa120bdb7e0abbc5678610c49ecf4ac8bdc8ff900918d7834083ce7cae3446b99597f2a2b02c4e53c27622dbab3c5438deb4215857c9032af4d1a2e8a6ef26ab3903d5064d4959f1371bc6138ad90c0c911b66bd", 0xb8}], 0x5}, 0x6}, {{&(0x7f0000002200)=@in={0x2, 0x4e22, @remote}, 0x80, &(0x7f0000003740)=[{&(0x7f0000002280)="55a4221e4e85bbbacbfbd057e5b24d85401eb76ba4f8f899eeca452d904ad5ec3e92e65ee87605a75f9ae91ab1b096fa2e06c6f2fa5bc8d899a0a5699211bef31f49c6526924963cb57d3b8c8e393abbaa6a712b8362b7788a55716aabbce3c7eb04c30758f339130314f764e5d950f7d53bec44b41c1bc7a86d14f0328e99f087afdcd7a2215810cfc0628b0a9210eb000e2c424406852f3cdfce11bd0f027d13b4b240d5ddc3cf3275ca28a8938a82229d9811f9f62dc3252350c371e9883092252a8ca7157361755432509d743639ac", 0xd1}, {&(0x7f0000002380)="6a48a7cde7fb59c0814eb3bb5cee191bc99086debb7c6c3825da265beefc341e08f2cf6347d86c1251c8087c54e7dde1774acffc2fe2ec270248c43e0ed234ef947d1423a8c75f47c2f4aef4235be5f2beff52a709913b5cc6a985a8339c054d503a51fa41502ce6bd926071ba1a096f2458592bbad234a4c89b307ac62389eabaeb2d85efd4147898918912ca0c9957a919158b1bd2c27fd58b03f1c6285d668c6272f2b064b0efa5898ce6569bca806977b9544adc0b738f85edcb0840b616f5", 0xc1}, {&(0x7f0000002480)="13f49612b45e3919d88f448f2968540f889ef1e8e27918f285", 0x19}, {&(0x7f00000024c0)="a5854cb44431d35dd6429a721d72cd9f2b3b70369338037fc71c4db67bba75aeb2be2d24a42f4e62b46fe6b0baff51d550802687ca1d1dfe89ee8ac685acd4ccc6fb3a99e997fa77f4eb42ac6cb39b0369d0af9863d7e284ead5088b4bd095112831df66eed2921976560a3a61e97e7144cd5bc945001f294bede880970c02d4186a39567c0fdf84b5b7e1a06f4727df5a5dcb6c60ffcdc80de366926152f403b68838389cc37331dfa96d861ee842d87075a6f980c02cf9", 0xb8}, {&(0x7f0000002580)="c93082783d50a2b3045661ff53c9ab784284ac8745dd91", 0x17}, {&(0x7f00000025c0)="9a7e61a03b83bbec1d8dc4db314f52f5f0459e844d780c15cf93203b8c5457964e80244cef1ae38349bac8f2e1e0de64f9089ca5c64004f748ac7aacde9850c83c96b837273970ae0ab682bb470218a3a729350d610cd566579117cf0acffde407ba58f4c55be7bfe64195dcd6af6366992edb0e8b6b9e7b38eca9a989ca6c0eb3bfa30b7e6d644a04c494f997", 0x8d}, {&(0x7f0000002680)="b39a536e72059ab0755d3d279c9255bb20222f8dac90b67f5dabe8b9ec9a43c49fc1a077fea8446eb128cc659f49f4d3e948055fdc13cf9da3652fd22ac11245cd111e901560bb793e346c4d8584681b89eb767aa4e87b5953d8d65584994ec0e007efeed9db3a251574363da349bc9591bdc6fc4e53abde89fad8802e8b4c22ba803cf400ad3ed5f68db11c345c0a252a940d3ab5c83e309eb94d0b6811442babc719b6d601e4ef1da164e2076cfbb12778de28a8b7072d54af38", 0xbb}, {&(0x7f0000002740)="49b4792b3b42c40d900b788a1ff9749c4df4af1ab8bbfa2c15151c6e87307023e2f17b1a6fb72ede337604756bfd30e5370157821154267ef0439df0912ef63e0f9ee11196e5a6f18bd617a3efd06ace270ebe326270bc29805426230ffc55c037850983d79f745c4ab6d032fc69e0736461e29d4a8e02c52ef0427deec79f38328bcd613cf0a2897f8238a7cf0081c224ea2752fbf499a1ab8c0e4f5c9d2dec723baea262cc84de4964d8c41ca3b14dde4fdf0952dcd65a734728ea8ca177f9c6cc7516737edeefc3f2056954354c9aec4bef828d1f5b920e90caf94339556df9ce995c74b6a73ce72772772ac3b262920458a5f200cda03267685af106950bc35db07a4289a0eb3bb3b49a8ccae7ef5ee432dacb77c57ff9ad993d655149c7913d3a4d9f06330641e4a93ca91484c7ba31729f665fd112627d31cc674cde0f4a3109f427d7952b7539ef189c70c746074b349a48bd1f169f958d995f36d28371ce37f440c37c918fd8e63ef31acb52a53e3f61789cfa5b1c30f7660fd21843d9fd90bdabd6f9a04167ddec2678910c46e64b716dbb5e07d38447cca16693577ed7857bc16ef9335221ea4b77f83083a7935ede300e5c3b5ea710c17e083df5127d107f8151851bc8246ff44f2ceb6bccb0147a764f91ae8c6658353b7ef65fdfba5d0d13a380170c4cc53747c9bebe8982ba0fd6189f22963a0048cdae5d0022720b4793ccdb07c548dc9e98955052a1551b767790dd4cc9c5ad8c1bba55341118646ecfcc250355ef3b4b5999ad53ecbcd2478755ce7236e09ef7481225c9f365f98b553d61b6027f1e95af6eb9dac071aae81cd08e9c58cae828f5bb4211fa80766fdc0dcab022181fad93d4d3207721e9efaf3bf092a7ac476e6e643dae442058af18a67a2dd220a563643fb75044307fa112d254eae4de586f1b1cb6a1aa28f7e15613ace9ddeb27379d0b34bb653d0ae7eb7d977a887845f948ccb86708b016357da46ba6f22fda0c2a5e7ca156f41b5b0e8416b40c0ba15dbbef641df79a11516a18d81131c50e2835bd411a49070d5902ac452ca31a9c21d475b530f937251cdb5bf7e8876efe1deb7efc3b50027c5e246a274e4fed3369400f8e161e166b8ef55680a03fcf2e02c16855427f019bf28e2a5f33941fe97e85af07a622851846fe2e91b59aa957c8bafa75b7cd4b0bec8b22dd931d6ada109c447a7c3770ebec71bcbbca500c6574f2ddaaa1f52d5a42e7a28cc45ebb5684fedc9b655db26e89f5e341327650e9f182f32cf8e0b6bfbf0ee9b9dcab03ed0daf424e01814e24a678a8feca23d3f7f5e0e263bdecdfc3409e762a4c7f6b84876e6f8ea68a9c314aab680f27526eb73814131f5da648118ed2780088d6e995e9de43a1559fe6b2c7320724571beaf8c8d64dfbab03420b7e0cc81fac957891af8ec914bff2ce83cec7fbe0974d8e66141905f85cc35715552b38975590982f7c2628730eb96182fdafaa85ef73bee282952c7b5bc63390e2de86040c0697046a81b7c735fddd0faf960e426b8059563147436d9029dc95ef5e9d5128ef9af1247717fb982ad9939fb9672aa3dcf90972a5ec971bd152e7637d4e08848ffd99812f4812bcba5a9b2a0f0ca5e2b49907b01eac3088212ffaf5dec356781215473203a7bc1f5ed94215fd709fbb5bc9999c7c681c0e732c364076064556940cfcedb022f45d3d634fa04d69264c659f19175b419006c8738ce0859cfab6d399dc259d51c1647dfff82a354ca6d2a87c4cfa289693e6851f88c59a86f20936745913e58cefa6d4fb236292b9b2fd97bdaf2ebac3847afdfdb66e4c5e75680f9288aee1d26c010dd98d93fa97de89846ba45adba2caca03d5bd9082c65f92fb151c9e72f94972f6d885fbfbb79835d115c03a27c2d2113d0a36115cdb3be6861d7a2ba6fd7367c84ef9714a5686d996eeb8dda373534c9aa637b809e0b67a910f624a823403b6323de0dcb9fdee4854be005ae9858b92bd554d29556e4039029d178c5f2652520e3a76f8247079f0216ade022d795f8a6b69c5ce38da03bd2636d935e1f6e4537f5f18a7fd32d19563fa81eecb5bc4ea8b98a63642da2d8408bb2417f4f7a6edb836fd82c4c7ce7107bc8a5f19c949a21b3dbf0714ee2951d69689fc3c77981534aac5006d985115dd2e6939f5484adb86973bc2d8bc0631691c451d9e496a0e172e4862d75b85c8d7c6cb9cc20130134a1e685f0cfa1fb5721a54829d7cf769b1b59cef98a71e7b7cf3ddf2ec6da54db4015691c31a632eae63c44e033c82c4e0c0d9fd0c3c728874ec3194309f5a37bfdda324a9e2ab1771c66bde0517810dae1da4e7628fd029387392f876fe90cae9c21fbf63bd0af5e059288112b1bb886fcc05e33897d9c19358cf5fd0cdb77b2ea32ad4967598698b138f551a28118a63ff087e35637de0b72fa97f217912b6a667c295f606b76093fc7bb136dd177e4426c2b542e7bce11e0f6b43c42480c71db22bdc461a40e1874fef8e06d6e8a77b5d53bc77b3aa851b6f33056459850b416beb3c07b3efe621d91b195ceaa6883fd538892bff096cd18234a05e2e503282a30fcefed1115962b4ec68ee8465ae1342499dacb2cdc832bf147d1931637d88397b36768ab055efd606c37fdb147949d864e94b7618faec5d927f1288b67fc1972f255c82a4821bfc9b12679da167114c719ebb886b308215204680d0e185e26bad26aec222cb3f551104f1c07086a26fbd1b76fcf3dc0aa0934f43e4c2f992a5dd61be737d60de0d84765d43357fca2815752b1d4e2f5743f032c96e75ac309bb7125fecdd0fef197a2bb4242f44f487437c93e44e0b1e93576436c26fd5d4915018248221be7f369ccb6916778e0293ab4f4cbf0b624b65511c0766605411412b8c967a71d0bbf5a415fc49ad046a5a13e96fd84852e0a2c7e67420d43120e50b7b6358841227f59a2898041c08697f25d395cc431916ed130531382680ecd2495d8bd604a45ebcbb51f4b14698284e39e9cec7a08d83580ffc0ccab69b11849a3da552a88217317b31c87d96cdae09f90680e24a7c49e6985d1397b1eb8679ac7d99da3ede4ad698bec3783a933b7e5a45cdcc3d9ebf1d48fd72970e2588f9008136d92aa140ceee978bc6a9a3b96ca2ea9d31fcf24d10a2b515b77bf45c6d4cbe57d634bff6c221f64a4b7b23c9d5831aa12f1616828111f02a44ef19071446a73a9eda2e6546156a15f24adea2d97489affe43b4174e966c982092a6322c6842c5e5289676dbbb6c4519f0c35419c061ef145b28006474c68e0f00536c2df009ef2638dc4f5b53fec38c9f1858e39a4d62203aa22293385e4d18cc39bb945c6beed6adca68057b1adb1ae0a1dd3f8ec011355c1f1392c220aa7abd8803138b419cbeadc2669e726ce6b352f6704a0ec53cafbe79044bd1da6018b01971bed7f7d8923bad30354f87e27946c42dcf16593066a2719e5e54b1ef26f5c3ccb6b5d1d07e222c74c6e0c8d8871157feece24cf84ed416ffd34e011f42466b3ae991ff6c42b317eee8230953b61f8c41cd0b0747c206b7d51709a2c62bd05d8f76fc31dcc3fb556c948503b19acb9188c52fbca32d7ae5cef896584fd8ebdd83803a33fc2d5e22c29cc4f3b0cd9f5cce47a19360131580da660e84dabac5215f0b2c1f4ecd234a427a9028ebbe54f4daafa983ee3e315770a7c08ac0326173a9a8fcbfd084debad8be5fa275c4a7cecc67e4a82bf939f930ba2283803c6ff1e309cb253b82061814b8a7be6a577f27e216fcfa19e5108e642e85e68dbae573db7bc5711ec0c1e66f9f746ade7d21199996926dc31cab519a433b80bf08f93296762da22f340b012d59b0486336be1e12069f8498700ba58584c2ed928f2222dc9829889ea0d1eb477b05167fb510f47533f012e1b7befcfe874637a105a1a506ee4ba4e285a0518d6dd5cc1a01be0bdce9bccafe1962ba72b592f79bbfc0538b89476595cecfbbb4bd90221ff87ca549266ad864f81fab336451daab2bc2fcca1a06f86994d30b43fc5c58d056de8ef7e226cd4f64e4a6cb546bba6ddad75b082057e421c86d969e8511d67d0b11034c1e31acbd1438f5096e2bf7c2076ad9fa34aaaa8e5390afd4ec26679d71ffc30ba46bbb3a96aa067d897e36cd6aabeb55d21fec2052c160eab82d49732cd33d5776c928915962e37aa7fec182abb6ddaef502804471e71457165d179b9faad77125363ed88c541e93ef7a5ac320bfc1319d473b4246327244f7f0a9a0e585926dea5e66385d1ad6371955652f2fcf81b34d2ac8a41c64ee324d0e28b0e7c9cf751d477b0b85f73eb0e21fc5f210c48bc192bb8c482146d780537d6b7eac16be406ed53fb46ae5cf8e02bfaf646564b68fdb26d61a18100e94566ea591cab803cad6224eba704ba9234c9f2383a0b46d05f41402914aba503b51581c55386c5f2137ddfb119cad3c8f34de60af69e8958387522ed91b36fb91ce62dbc5626438219cc70abea3d46b15e271012262935ecf37c4b9895ee0ec810db269f4215e869bff560d2b52aa3207aa43ee7cd4a07de653359aac70133ba2d9497385297a8244929d2d7a7d6a17ce799ade530a908de13d4b72c0dfa469d73baee4b24248a1d82e98612153d597a0c9de7e648559610e325c7c26f9438975ab8334e25148681845baeee5506efe326ecdcd31aa1a6045a2c077b017862498602b82fbb12ed691611653fc53c6cc5b434010fba0cff2576af774e085562c4a94183e65745ad9ea7fed078ed9150e95db8e10aa336fbff1157b05d35bc1d916f918b92442ac9157c1be131cf4042d05cd49f3db168bf7e8689c73cae15861fa2056fd592b0f32bcee5fb627f9c76960e3a80d07885f2e532894319e91af1767723a415700f18b41f505131e6d05ac41edc81f43cb7d66a7f2e378d699e948b71981c1f98dd8ed9c18fff2aee5661ca9cdd10c7bf00375b7ee3d2b810a2c3f03f4e0375053ce9c324cf986086be621f355727b4f5e2d9d74f71bb9b4e3b3bf50ce1351aa37c3b0d7d75aeed589ddbd31736c06df992ef65d1ac5fe5fcc64c6158f85696cdb828b857ce0980305361a1413baeea3ba736074d99d599a2fc60bc44cece1f581333cdcb5d02fd2fa5b8d469ff9486d34f60d2614489224f2c7475ba4033ff87402e5dc3991878aca9a71bb36be0bcae8ce6d23124e073463cb85808339c89ff1d4cc66bea850ddafb0e764b9cfba63bee19e0ee2c579cf37075bc0cf8939d7c08b290476764fa1ea3bd2630696bee10b6ef67f55f7975dd8be40fe99091e57af2b9e9e84eef51584d5797c957a302ae2225c74ee47d90ee4e0f8ea0ba8966fdf2924117ff8fbcf5575422274f6039ae3b29dd3f60682e4e958672fa5be669daee4c89ccb05470c5e15bb6a94bc8f264ab5aa040d71075ee9c57f977ae7f230591c7389fb483f7ccae3323faf6ed974fd6863c9d1eea078a86e0d56c2f86d30eb5c4b8f0d3bbeac70c666d5a2ca51664ee2416e3832f7291584d039cad3dc99b69c0e53e1032de393f1fab5297234e912d448879cb0419e11ef32d1e7b9babdf9bf60cf3a664b5afb2f26c8c19334696ee42c375d3389d534dcfa7b7df8342fbe97cb1dfbe95352e4469d364edf346d477f7d3f807b4aaa63c452cb7cc0bb018d9cc5b83e68148b6106c40d478ce535e3a714073af7b8d66de6cf99d393d45b3915df4bd4a46ed2d54e40db9319b01fce0e7c4ca5b0978d7e6cddb55db64d038b6ff3", 0x1000}], 0x8, &(0x7f00000037c0)=[{0xf0, 0x11b, 0x40000000000, "e0f6a6ccd4eb55b61cff3851c304001fecc4056f4c688762e233ced362c626c94aa80ae72720e6be2c42999ab0c257f70c5ec96162c83d47cb5e89d143abc6efa1602f1735e8f475892affba19c927078106d3b544a5d0b276c8acfa2918e062f94859068a3b92de106c9e5ac46735b447d42c03468cd55c74305a33396c94017a2006f373b5a289b59cabc0e1088c068430c2229975c5666925ccbde0668e0e461a2ba1423a8dd8a86f2c5bb6d107051544d4808889878ba4cffbc0d807459d7756e7864747102bd70ab00dd3b08bd56886544a89688df6923cd823"}, {0x1010, 0x117, 0x3, "f070aaf813f2c2f45282c850cfe34b1c98597282ee498a7066fdae2a94325e171cb25db9b310a9755860b66f23614f1b7f993f5cac3f0add0e04ccbcf07bf5fef6420c58df525bc1f61ec0eb2d5c1e2380a2dfe06d91b6453ce064c6f907212fdbf5b026259c49f3d34eb61c9aabf2771bc03ed403c78ad085f147856a302c98000c923b35f571585c2ddd7b99b6f81407dc78cf682bb308ad5cb5e182c53efa0647d17cea40752b41714187dc963d0709d798de19f91300b51c0801fbec6c515e1c06341f9fe39372a13815e1cbb46f77eb7cb7b3f86713a5160477a66742434585632fcbfb3e52a098a67daf48db7b799abb36e76b073a61094481cfc7829dbdb52908f61fab64a058ed77675eef993a37ef2838936e0d9fb5461a1b4ba4071d26f6383b2cb29ffcc8047238dcbe444c005972c1ee07624bc5468508f6f52376b9af1ea780e479b0e4530d988394a51dc45089a58503f34e748a9da08a126c270c11d273469adb352676fd1bf1cb2461f60a3ce2a6df25d3c9f583f08500a8941bf8909808c7aabc4af7b6d2d2b88f7b34db659dfb1c3aa30538c4a3ba9cb7414a76137f2a83aa140c2617444b0385c664d0a2c0960765cda1a158bdc48bb29033d752f7e2201b81bcefbe46a1bd1fc827c8005d387f468dbafb3f9f1c5d937fe389d67c1b2d1b5a7a4208bd333c9eb875df9769388f40cdc09e9af065ea643116457c17eff70dbe92cb661a448ce807e381e7e85caeb9aabb838eb9a1ecc841a9644bdf099a7322e38ac6a3a5d32fabed22b61042724f1653af8bba7fecea1b56b067457279ddcad21a900f7184ebb5b392d2e0b7ce58208b15631dfe508415c8bd637c6879557517c45a81eca7aac5998e001cfeb601d9e3500a307a08e8d6bfafbd4c8c1b3885893918e53fa18042d377a5cfa2e6d6af8907e731c7d1aed1878cbbb8f9bd125863f06521c1dd1d59202ae3a4366fc08a79d21f1e667ade7b768bf63f0989dbb384bd3b04af3ca673ce08db1a82b3a60cc8425aef7239be2c5a62fef5ce91db736a3594f59730646ff8b3f2022f23db78105cc5cdfb2d43e689f2cad8de64d0b10e487a302e6cf33cc9f45f752af0ad29c793c7538796eb040d17a086ccf0205be3d065596e1064b3bd611743461d408a265b312ee5e918b40f1cedb14f9412e7bdd05fd395fa6685d68c97d24dacdae60e53e958920f42a1debb88f28b1c6fb00d037dc10d978abc05f1f5f7ea75190bbc31e0a626f3c4d1bcd1c92dce9db3c9dd5688e7efbe54e8303171ab53ef67fecb0f420fda63183af1f21f25b41c96bb03979f6ac56def7322103140bcec0c86e30190f0332d05296af29d293f12a5e60177ed10ea8bdcd585b36d9d1f2e5da4a807aec10457d0c16b5ea0e3e22c6ff0037f142da701b4f207c000f9110934e1ab2ed84e924f71afe50b331c86d938e79e27a110d181f4a7b72cb260df4331725267053fbbe1fc26131beb429646726a1985da6810a75e12cd0e74d906127dda56227081b70190483d94dd32716277bacd2e19646b83a18e94a68625418f61d38657c1c5bdfa2b7ccb52a387ca5a6a6db2756e2ee57a172522c6a4e5a045c62b349cbd1fadd5d9342151d0ff915e97fd9682d48579559eb1f373e20b9f1eb30679681107d3d9d9ab989777e32530b939185c1fb493c518ccccc4d2d7f40c3c21d166b59eba4a82b830868d9aba1261234a3d827d97def39fb86a0f9be040eb88360ba76719d2619b8543fff9b857b4e6dec1ecee62859aa339102e43c9b8dcf9f7eab0dcff55d33c7fc379f9b7236198d1114f992cafa891d9c9b06a8c4664b1babd45088ab0fc6b32ae6bbceabbf7b6308e6bb57b6254cb2fee356df53c523bac73744ca1cfd3b975cb03436ae186e710ea1808b21c7088fb2f970c564dda871693fc1492ae6a2b815e7e64891141701b0188ef31b036f5712bc8ce777783310079c8f5c5d07f253cc34d70d5c1a1aafb9af62b30128996963895161cd1e8bd58c8b1b96e920aadcee02532a0b10671d6d93ca702395fb0373069c48f0017c88d01b4b1c3d567f78855b65ef363bd49244e28c235450788a9267d770fd31e1d552be3a8705cafaf718297de39930ac9dfbff296266dba92cdf6ef53e81f5580f620d0c6517abf8c965836e25f6074e09097557649efc9f54db10335e5c3a94499620183c731d9138477f2ef7c322c6528a8ce30936785821e9f4b8aea47609fbdde4f6f0d4b24c02acfd2179a652d56bac1a11b4e56c1db7975c5144c9fc23116e839aa5724cb56932f4c1de68f3578afb7a3cd968655225833bf5ea8bb8394d7214044d02ed74a115d6d5f14eae19db7dbe2d99d24e34c33b19c5382539bf7cc6c1bad2cc05ac62b736b0779948bb6ec712c1c3d10219f54540666c101848dc9989ef9a12eb62a03dbb8331ffa6dca3efb30992bdbfb89bd2c3a57a3ba8ef2e6e16dd6980e7a28d979260ed5a6d0b4a029b15dfe0f0da322538e37fdec9a8332f0c6c670ff19532945da1584a2596ddc16d4648c6a468c50682f2bef9b824546453610c1cca7fa7bda4bbe4747e7f4821cdf9862bad0927e9413d33068ba6371d010e702f5020ac61d9904e29f2e3e60aacdb1f5a7ef5dd159139bd0775e25416a9da0712193419ff26f7c38ae3894436682655affb6a51f4499d9634a40ef36f5bf2e7d93f288d0c3efaa199f71b32242d6bca725f9063947cb639b67258e112c2883a871dd591736f50735093aabe2e474ceca9d4855f6c280c254531ca249e886bfcba83ca2fed2b98f770372a08e5187cfaad8232856cbaa30aba22b6e4307f1f56aaa00374d0a9d101845648a8cdc0d9de822a510616e9042e0be64297c52e320f009bddc8347852ee8035d715c6e98c800cfaf5084930969159b6be66f91c7983af361cfe107c7228fade5a7946f086b55c8545120f9525a9165653c1f65c54ff41269421416724c673a329a2264663655bd87d001b5708224371f255e30711f2cb43385b6083b72fb4557efbd96e1e6903a17e1f2a2285540e1f3d1f644e9499734123b1c1234150b90af699804255295031610281c4edaf2793e2f9271b2e308cbe524d60b5f66c8c9bddf4fb24776da6a4d57cfdc4b41a7f73b50941b8fcbf396f3dc8542df675189cccb59edb61d4620ca94d6be30614bfa9749c1cf9658fe81223485c32abf1a8d3fe34926e08e1a4ef733e9ea5d2063b43c31f7a88a395d42e9d184cd7509d76c74509ba96e213011a8113089ad47306c902609fb6839f6b6fab32c3cc628648366a9e1a02af373357d1efb1c5e6bdd1e9fcb890245a17ad0f12ecb46072701621a0666d0c3c45f02b58b95a34d6f3902be648be92ad7366e10b015dbcbf4247da5fb3b3295fe89734183eee5332b0e7e8b9e35f3a6a2b2373493bc3e60709c27d675eed5dd4b0368c690cf2fe6647ec5f32139a8eb2847980ddc2dc120307a21b79fd95f22a78bf728b67deaa72fdd27eeff4aec53b9986eacec4a3e5983f0df8c7eb61681eacba93b13201e1b43b1927903c1191b33b038a99b58c6684901bcaeb98b988b3d7df8885c7b5027c6263f1b500f71a989fff7a70e6adef192299e601f166b7754d6a698df93058fca5df30ebd39226939c96cb4a7e3ea19254aa20c1f7891cb12121ade507ed66d71cb8ff1aab0d296959e746dca29992d77b041a82ca896a02ec320e0539d5b89e8e6658c965849f0b3cd1cdf38d31bd1357396731bd323b22aa7e6be94431f45e0908f64148c02cacff2ea42238bb508c2d8f325200d3e5ffc6b0789558c0e98f2d50263f6dbb325d15e6caadba6427c4e9fb0601685a0de40e5ce680f929e434568994616d04b7f4f5cbe7ddfbeb95ca3753417ac952bd3e3f4af4f9f8e72939965e3b182c2a05f191edde45825553426d361fb1107e66cb136c748d1b7a7a15ac340eb402b3e7c9308631c5f67dab6ef90e41e6a0357e884f44c4e76ebb520998a64eff43ba5376aeaca821d21736ce1542abf68aaef3faf5a94018b65144c6420e2ebceee0fe9c993344e6414a99587ff0b733bd09161b0e395a756b487b9912bec729fd532cffe70acf16420136561545ab62840c66b21c5762d0fc2806202a103bd7c163b5ca9e1a299ebd10a48a963f73946b4b7f63e046f093e40e920e5e078bfae2253dfd9cc5c36549c94369955ef08c9c79e7784d413f8407ff3b1b5505d15eb00af7814aef67f7dea5d9368c20d958248654908c29d426bc4f2e46a2100d24c9f3ccd861b29420bddefe230c13c599f589fec6381e56eb4880cbab3ecc78235b9f30fb44944a37693d8d81b7c7adfc5a04ee5078b311a9a490e0a93177fe36857571080f3a13899b54439107817e2a60bbc8f021326dda23c3db71e73ce2d8181c622f0e804305952ce5e4d21ce9c77677a4c67c11c90cab43b70bcc71a5c82ac7a1b60a78aa41135a61ae22f8c0b880b4c86a6a4098c8569b0dec3546218ef4aa900358e791d11fadba6ada5ae23360ee14d6ec3c0f217c13e7c133955a1e9194b4c94b2723a32d76d61d02689a46744c381a3faadafd3b0257c1cffe2866013b85145a0b34ccb5b5129254cc378e90eb2da1ffa6d8bc29c303d24f82722218513353bf305c0cd21cdb4bc5d4620e08afe39388ea47ece1975e2b833243234537e714acf2cc115f6045a59634cde08d69833f483b2533615d71d40b4c290b0101f9d42c60810d953a6b27fc82e2b79942a3a052f4240c70b49de9ef4299aa5466bd5aee0f87e03f871638a7f6fdf3568ed7859b831d5e801f329218e0c0fc7b6e30e55cbdd7cf8a46b2b00a1e68560d994fe10adf6018fc7553fa5471f80472e42b671702627adf9d69132ee14cac3de8a595bc9900583254640c68f917d1245f7aae1a3122507c157c67b1fac90717b7afb2f295ac8efb990ff8dbd9929799913c2f150eb12d0e71586d077b50ac7277ed917bbcec30e4cbd53cb2809408f246b5cbcc194585dcce4daa11b316dd7d97b5239abfc4300b741b294351df443336ad80695c4f81b62500f38a83beef9d3ca02465ec86c4009a8b9aab77938deb74eade2eb022f3e93a83fe04e4944d9155a2860df0874d5cb3710d3809b7bcbb661b0562e714d1db7ee7a9fda4dc9f24533ce57934ead060fb224505202a4992877a1c19e5ba868c0d90fa59c6dd2af159ceb9987e577c507afff4380854fdcb7ea15f1b1e590b7d40066b8bc2ac58c03be44ca984dc964eab0f404001b954c8a017b425ff9ea5752849361952c09e48d925f6cfe34dcd94332138e957c2e3deb96dba3bacd6bfd96d4732f19c92234c620b967fbdc717c80c5d9db338fa5557128b36890d9dfbdeaf26bf8794c404e7072da1f7db4ac1a9b48f813f6bc1b8722250f04abe52f1a6e1812d91ed9843807b40dd2b34498a840de6c0f1a2f9b01b12510a3f9aa93c79132cd056e2f624791926da85076c5cc6fd1cd3708716bc9ed4a951b65a0d695a27ff46e19a07c05c9ef9a3ffaad40679399a7adc40d821c71b67d9e835564a30a6a0c889d300b7b325c6c2473f291bd3fde1ac4682d1ee3cfb3deb2a298becb6bb92ec771abffe307f1ef4434f1ad9c00b39e5be156cf0bf7d96c24c21650c1d54e3b7474e051fd39025b337335e1eb4b7ba5216ea4f3bfc89be72b4a7a2d80446e33b5741bdc08d2eaa78899bc5d3253d579bb4e9a1050777c92298e228a6a5212f7c7f0fd5283e0cb837df8965d05032ab9fb8af65e85461b547e31a2bb"}, {0xa8, 0x101, 0x9, "021d55395e74d4e9ab6da6d07347531e4cc9a65ebec6147fbec7afe3c525f6c3808b3ccc72bdb8e085e5fdf60faebe87b2ed4e2f3ca9d392b14973e869764944453f844017a8a08ed75514298b0ee4af70a2f62f03f3c8a2b7a3d24fe8b30755e773fcdb66ef956d4cc415c302d50ec2cadf3e5727a33125667fbf690dad07343df713bdbb176e8a027c8cae63ec76b545b8481eb682"}, {0x60, 0x88, 0x7, "143ec63100736f1d6074fa9f8d7619797975dbc3f98f1b9da2c45a20428f4053095bb4356f10c13f342f43b1b33ac4f893f2e7dc586e2a733133b98e35e51326140ebb462a77578675"}, {0xb0, 0x19f, 0x7ff, "85f05a94efc41a2dddc11006ca726abd1f9cbf99957c193e0630a13b2f42954598a3e2726a7a68eb34f4cda6517aa2d3f0dd774250fc2ff98d0dcbe3e8c36fdbaa5d6aa584fd6b6a5444302646c30fa7ea2f33031047eb647e74a9749b9c098124b2ec7e84b4b87af717f686fab7279f1aca83f2641ca05537888fceec70a0f633b7c7da7976f47ed312785e91ac100af7eaa64fdff240a4dff743cbf6eaa2fe"}], 0x12b8}, 0x100}, {{0x0, 0x0, &(0x7f0000004d40)=[{&(0x7f0000004a80)="d71327ca80833cbd8194acd5e10037eb21d9dd81df1e8970ae2423bc3966d807cf8dabee5e0b235f39a7ff84e22b104a1bc674e4d1146f8cb41f1dee7be00941c8195cc456ba8bd8348383dfe08f811859cd392b2f", 0x55}, {&(0x7f0000004b00)="1b52a38700d1d2cce08ec06dd33a657570f89604d5655bcd64fdc54036daeb59aae5f396d130bec4c59a94a73c5f94e0c5ed5a336fb1ec6303577ecd8ceb686ea1d5434b4d0b3f6d9f5635d29fc21df1d41bff89c08ea3a5fb306f7c4dbaa27a572e93b40bdc3270881b5bd13107771175473544b7c389b33fdb3c0c9d10d932b1ebcf8da366c438a27e21ea691c203e23bebc3403142a21fe1f84661e2176b4348e63e29a0ffa369399a245d08110ca8d81ae2ec798cba4eb4460ecdf438612cc445e8b143827db1d463f5c40482c3677e2611ad0f721ef765990277a0d6e10d5eeedb8cd00e293598050ee384bbe1ad5c9", 0xf2}, {&(0x7f0000004c00)="7b53795e298e5763e331a452adf85fa2d91e9db6fb92934b71493a4624ae58", 0x1f}, {&(0x7f0000004c40)="940c14be041f8774296d03ea7de12ed4854095307fce6cc0fe7fbef4afdcfba8164b3bb5dabe35421a2aa272b6405329ce51b3e01658da13fb498deee9d3a0be4de99ef6bac3f9560db5ee49dd4ad0956e1766ed8e190c5437f7716d9ae5ac1762b21e60f375137ae18cdd3369388469db2ee2ae2de91453292ee1e55c9b6f4aadfb1159cb47d3c2a53b8f291079343a71e50dc76f95522586fc1ff3e157448396d39c1bc6f8bdff947f46fca645bd1fc65b12e47ab66336ea2f6c9a9614a307134bbd3c73140823a6ac6c61352c4855b29c86638712215d4d031593cdaf10cbd9", 0xe1}], 0x4}, 0x4}, {{0x0, 0x0, &(0x7f0000006f40)=[{&(0x7f0000004d80)="1b48d3d12b8c86f30edba0a1b338fe83da5fdac54076937d72b2d4e1f75e69e1e8be9477b121b7021d1042e6aed16d88cda9f278ef4bb47a02943ef8751e9dac6f90e53c7030a7ff0b95490e769eae815345c16c829c8ade10cf51cd2e4eed14eebaa56c9edcaa0bcaf4296fc6054cf21e43a59ef96bdca724690465ff1dea073ecaa471ddfc47c59d5209f440cfe710a31b25e7", 0x94}, {&(0x7f0000004e40)="af3b195282f5ff722c3367dadde90331e4f98d65c596c13b19e99e1cd936a1548a142938cd7cb58fd4febe8ab40cb22f6e4cce70cf75dcb58bb369cf715ea1981e818b9095e8d6fffa3efdd8dca9926da8a68f3446466468a06449576a54d220ed82a988d691dc66f82edcaa465f721f424f03261a606b90bd5bb31378bd6fed72d35261b26df8978a981387b5e286b6f0bebade0a59d9c084b1dfdf84ed0ab1df7d2a7e52bb9cbe2555ce8c85d26f9ca3b24e5259cd3e7c80cbebe35e9b99beff63eec6ed6024970d242c645e227e2f1e2a81198b1452fc45d15d9c3978b39bae2b516952ddc9f0cad44c172bde8f9c5c76902903e5bd129ae33972bbbc19b12284d295231ee3429d51f644f4392013c307152c4dcb82ed5b00d32628c687f9eba7f2e4727a840a1863ba338af09d8ee2a4207e70c4ed222abaabd6ec672a1222e36049525b52101ec437d3aa9f4050c50895dfbac4c9bc5b96ad4786d8bbec39ef7951da82d68e79199984c84f62998f83d4ce0fd2b1d0474f735f411afc8ee63b0c03bb9aa667360319d2dad3cf53682837894ce2da922d9e3b1a9b01a0c32904c6de85b7c53af5b1fa359220746e38f29e88cc56d1308cd5659a6502cfee1eb902203c3a5dd297c99fbd0eeb218dcdda038f7a265fa8716cfff2a5d5b6fba1d0fe6310ea7e34e40365d44d5a30b5b8be6d3717244b51bd73c6c50776930a9ff0b4889e21826a822ac976e3ec6418bcb7cee00cc2cd6595e31262c690c3fe239359e35a9bb996db15a53fc4057193c4e0d162aa78c777285c09582df6cd44b24ca9867d8eaff560f45e1cb3e8aef0af75ec5589224263b339e91f41dd4cef8bde5a17d4b936f6efc3718a3189099fe5c7553ee89bbeef77183672ba69a3edaeb9bba14bc46185ce05d9286bf3496adbb4abdb78974f321aa0d38b317b6beed5f3b8cc7122e1d5d02a7717c42d6e4869b9390d25e920669f3e086489654061f1e27b7419a9bcca5e687facf9d822113e22e01d80a7cb1b2e4bdc177a7ed89461203bb6fd72bdea4084f3b5d52b8ba6b95caf09bdeaaa02e5c4e3eac2580c1033e33dc0f3b4e370a68c004b98771237bcee420d56dc9e03366e0e28117dab637cab7ebb413059da8ac248718544c0e128a5ace5f7ad97fe6739b2dfb877a01fbe154a233f7368914b75733437bc9329ba4375ac6c3ba049d899671ad9cd9ad074820a10736d64e0b4aa7edd5861f00ff6a10aa8e356a791f7c2e99951b983f447d8abc8b96da5d753324cc06357f88691cf372b6639e78c4079dbc68f95056b4e3bfdfe37cba76ef652737e2a71cc30f66ad272913bdf3d6b7d72fdef7f1aa838e30b138ffb779a7f38c2d0b4ecffd0e4c5b08a47cb79041ad2c7c1c6f666084c4b269bb8270e011e481eb7eb49d241bc98a98799d704eb897b9f8eb676eeb4ab803a34c182249fb3dff9750a36c74502d26b0a16c5e46f460b26654e676531f0bf0e7e48b3af35ccd52b1d13330b783e803bf8e2a0d9ca4789b5ed473b3f62b22709bccf76e17b02cd0eff3ae82d58de2c4d61488ac52605113a7aabcbc6331a6fcb14ceeea52374a2104a063de55787426316d240d2fac3c70c446e1b6013a24f8465439cec83a79c02ae9ec34d47d5183a554081e4ce335d8b79b7319cabd23b56b5b9152e47809e968faf3d85b5e13b9087207a2e5ba8e071b55b7760570f5182a72cc732ce01dc08a487f81fff6f8e22f3af4deaefb2b5ab7d3a57d9ad89a067fc4fa9504809f4fa33b4106141bdf8269f32085929a1f2d34f335638a73475651baa7bacd516009363bc25bf586ee48d5f1ee2e8c3debb4483da4b98b8277d4785b3d38f43d7c6b81f3e7079a454d1dd8f2613cedd81a9eda59becc76c997936386aa08b194f3a3e8a18d2e2f9be6231c6a77978c63fe5b7d05846f9603c1ced40162cfb6cb2055dd2f1bd0283215d7d22f16cf2db9182ca22c8b2a1620205fea5472b1b5dbc0c3892892ffd89b84e347c12da9b54bd597cba253ee20c5c1f3c7ac9a9133043a691c3354a5b56ee48e8c2f05a5f07e1e8b96f5c490efa38ec4b04f4845ae20526bdc9164b8657f81af965fdd4592991eb765a5d0aed67d71b56dc6054243e22fe760ed532de6b7cc1cccd35363590c1e5ba8ac9b97caf7dbaf65e6ada76507c1570fec1ff872f1107e8f65689b8185389fe83e3d6cdf73b79f81d5b967c68fca08cf86fd91b7d7ed8078e502dd7aa159f877e16a479c6ef7b6c95b63515ed26a060d9ef6e2d84054201d0106f8b1495efc9f50107878d79f997f348cb192ca6395ac1071f8bfb32a8260406fa9b4178d86bab3a57eff34230dbc5d5a0a2beb1bca0de55d32bdfe23efee04521f662e671f97fcdc991b0b1c10b04f2f3569d21cb59b7a35297c138a98185048fd018427d213d8efb7e75c5ba5db6b1967dd3a9f133c0ad42a1953c9c031e45c77e1ea9126b2ce5775f28a77d7f3c02ea5800c69399141daa51c3801271975d4523589bad782d4071ddb1a6d27785e2647eb62f58756ac74f6f5dea0e4116d899351f30eecacb752156978093ae15bd8958b9f45c2d867c02d63d865e6ca76b46862f1da71ec6504986a51de5d45737a175e19e0fd33b8e77e636be161a9e9d105fb7dffaf09330281562fa6b5dac4bbd44a2152852861ac060f5720658b6d5318ff7e7ebbd350ca0d8b378792edad7963d730730f8a91cb3fb44c41fbf01d9a47e24689f623bcb1d3fc45919776881d03a469d25fc1252b0c24f12e387b27d6bba9683d99cb1fe9cb3d4de26ea97b100fb821e9f5012fb917e9fd242dc4e23a3710f567413fb724ea5a49b3b414a4960243b2ae2a4f45ce3011877dbfa91179d3e1559434ebe5300b6aee3bd8c3b41717666fe2d70ad789bc7ccfa8e9467e0426b5f9ee9c8d2b3d649a8493612369b337c3a46eeb7e117fb784fb17af9ace917b3e9a56ab68a906a6aae58dc3acdfc8f84a82e94b5f3f82eb40367e9b20a8e6c3237c7589a9cf50a2764f1b57485791461dbcc4ff8b193b7572769e261b43603d5972b14ac365ce8b89c6e6b23b34c52998b9873e32c0e281e568b80087f08ae4053138faf0f4e9579eabf31b57637ef92a5c4c87852aaf9a145065ae987d80de5cf35661afd1ad93e3b48aad7d07e979761d0de9aa4d18a97e57c042af0924c41745b8a4b8a6aea85c1cfae08b2efc56123ccf65369ce9d2e87e29a1c866b40c30bad246272bded93b2d983e0ed856e3b60e0b3faf211ebc2ef58644291ca118ab8e4206affa8f7118d86574545fd5e161550d1a97515546b86444c5458fd1a52264cb11b9d5876241fcd30b7fb964217797d3e7fd435e22deac0c974981320e81f56a6c2f664d6e05bd5de6f956e0c22628f3dc261ec6568127232cc4d1fae3491c9971b6ed2ea4fd7bb18f81f3d8fbdcaf3589a283832253efadb138ff9d381b733b63a347695cd3c3b60d73f207e90de63e6ca3d8734cc3800d9cf538796a6719fb45ca87abf5b9cb0640734451caffaf888ed34be7acfb142a160ac020e8e7f4c8d13a745aa3d105faadf0287d0c049a45434673d652e4ae08fb0e2576eeacac32e321e870e6187a059029d57a6876030a937b5227f3da69661355e583f05be397d65f88ec4bfa01542fcf391c693a958353365912796e4d063a668e96f6d6c8a64cc1cc4baf907c185979eb921557d09f0a57780598f9cfbc7c1cf99d55771bccbfdd2d5eb9110a74d04b5098986e64cc7533b912ca2dae96a4550d8da6bc04c570f7637360db149846967819be87a808178326a4b390052b4c4e236f0786234aae32a92a3e07d1a35a9101e7e7cb04ce8aa32632b983426ee6b66ac53b55737fd83c048ae98bded755f4967e87172c19765ef60d1e7c57e11183d371ab3db0ea4be4a1c76163e1c6655adff9b9926f330ba22cf6300c990682ae8b0c723d3d8536382fdb750ee7b9605e7d1e913ae933c81dc17295367e289e1daaa3d75bcc74aa7528f61bb85506d32b4f5f0a0d59cd422368226aa3ca540338e40d23aef33a4bf9d5016e86693d915962e4b933963ddce9bb9f342dba1dd0c03df7c2c03a26b626264130c691fdbb5463dd4363824b7bd0fbe98dbe975e9decfc693426b06b6c7fc32a3ba29322eb043afeef0bc92f5cd25cba3bc51fe9ddd6682d3c1352b9b1ed1a98e6a073009b05b244e6af6a1b47f180dc08da1478fcebc30079dd2560edf0f0943866e129684da72ceb64594fa5f6f25b1c10befb9c27ef79c793b0adc0538d9afa9a2dd773156cdf5e5a734a8cdf77c42b4111930f54f808153ccdd2d6430b79c9f3c2968a74a6640a686baa391eab7c9ef50c84be98c7e775bb263efe4fc9c72c504cce9bd27f75a376e45b47f65cc5e12fe27b11a34c28370ed63b07b67e0c0360ae78542ba5e011cdf43670bfd037f60c9f644bb6d051815566895fb55a91a7ae235a47b64a966dd5dadd92185e2a1baa2ca55390e86439370b689af4cd37d39f02c72dd6f955a3c9ba0391c5823c9878a8dd99799b21c5a7a205f1192e0c4ab7ed6953c9688d850ca26d0129e2b382b66cef2d849317cbf27c19e8654049ed134ee4b44d846b7edea9aaa49703bac1e70d958e65cb4de8f029ca47197a632630a8f5921431ae016f9bd820f708313b0fb57a259674745581a5117d3609a5dc0cf47c34014cdfc319fb58760c85c50d1c52a95ce539e1b98dd843d63da985086ddc527945175f0ea1c4ac9df45cd83384416e427f541aa35451304fe9cdce39c2f657c5e19d05caa631d1dd24bcae189c772116df38282d4f533a6e908b5536ddb5ffc2c8d5618c7a892e972127ffc825d6c177f25a11f23a4a7542bb0e69e270b0ffd092efe27193044d8c032737ebade315f011e42d049703f60d76c6e0c301b63a370c5e44556bd58effacb8522a04d5be2991b13b5dbf236893377b237a14a428339161e68b4e4de7fad45eddf87471ecd1a0a6c8823f4a061a67b14f6d5519f899b954ba59a22f86ac93d3a628361a86dbfa316db154195db54b8feee1ae00508fe7db6b13bf9ced02fe02027ff075e1580701b6acf88ae9597690ce2bee45baf6f412254602cd8e3ad888b5a5b769788a68bedee2bf5f95001b9f5772616bb473bf4eb275169eee0fb7bde90f5b65f5bcbde9b24298791824e8ae8691db32f1a5cd33428098e98c490a1d2a5a435264989aa05b1cb2a9877e50e8544014e462a3e7680d88d685926baf80ef89d4ebc2a32cbb26e147ce0c03fa1f2aa89a264731a601f5faf8cd74a5edaebcfd6265f1f1075defa9cbf535345a3e60005d6f1d7464282f01288cc570e16186cda6c9f7b91bf59b1d86a6e8dcb81c326d0b3b9fc3cb064a923c42ebdbaca449c80632b36234eb2a520bb810afcaa02e6e159f7e403477b67a63c12a77a7ff12a55e9d2dd5130f975d8fd985525347ef25ced53a2edc62809546a32f705d3162a53973c410c231fb257fdd1497a54baee64ebcfb8ccc06c03e8e87808c085cda5737eb814af823a4341a381c14196d99f603c7aa06f99dbccc4df0ff14aaadab92e4848fe6efaeecc058dccfc9f29f15882695cba9afe9aefce15f477bdb392bd8817336e208021b51ea16c58c396dcab2802cb1a4302285cd2329ab30b09827b71fcb3d1669ce2f454e232c153132d58aa36228bac668ea5a22ea9c566c4a0685d72ed71fce762a594badcf707f5b44077ea69a9aa90e773e11c422ebf3e007d050113ba1a7f80ad196224052928d775b7e4", 0x1000}, {&(0x7f0000005e40)="0893086378aa7bd582cda2333d3c900017fd565addc5451e2db79374976d0bf46f98ae5ab67c469a121406397bba6ead594f4bfef5ccd8731ac9ec7cf221d7d757c9b9d450689a86b5b63e500c588f5be39c82457dc4ccc1bf73e7867886b7926534763d0f73b1a162bed8a6be51fa108b03aa557274a65b568d989d8af7b73f914f4ff9de707a852a834dcf19f2034687ecc6e5c765f531b22bb9d4445e6e630ba7731f0c8268d3a127d162875d97f9df2751e463b4e83df472a02ea11610a49ac4eb82eda7c26326b9d18dd17fac35b11859d03aa58ed4ec08a1b7a39c2be77dc0f00eeee197f016ee518f34149c745dfffbefc1dd82d0b1e8891f", 0xfc}, {&(0x7f0000005f40)="1b3ade3039f1ad83e015f8ad9b16031611da0230c7b6ccef1ebb82d278251482d382070fde2634d35c379991ff1413ffcb4e207019c84448c85d39e4b9f378f71f1102720f2cb286a3b8b6494fa829452589fde975565a6445899b989848f15cd7d74a43be58243e4bb3e9c8d15856d8e78cdb0d73d66598e520541ac6fa613fc03995581587697a797181e030dacb03db5e43a74dca27eace4019e8389ed2bec4b38bd5af5dd0267afe589e378d590ef19e4fe816a0cec3feac40880ddc27cd30d4abeb30f454ff9317ada1e8779f850b9366ca784fe946ec557e3b3bea8c19aad0a1e66fc4b2624266aa91b8eb12bcab0933de917a46a42eccc216545a4e589f9dbad12d8a74e98b532d5a86d33bdbcafd2e33136cb301970d6da3e3bea2af7d9f7fa55e707c33b3be24df446696116a36279ccabb1e3cc91078117c69bdbe8fb2c1028d5cf70487c8db3ee6cdae9377a0bf1cd53432dcaf7a2d6d2e5543254db99260621fd130e6122bced5d4d8f173d42ea420839e436b03465d603e644a48803b35c4f01cffabf9268e9681690e980f84934ee160dc94425dfed352b1a35ba41818f7b565ae9f857e6af5912d2ea16035d152732991e5eee5de17bd44eb7325148df88a517025bc85e7475fd63859347f015da49bb05620b04b2be02edf165be35fa8e9ca6f7170a24d552deed3a1979686aed5bae3156e1f7ed5165976c8537d52eb13e31946569e259db1f24737c6ee9e34e273b1ddfef45cfb9ce4e0768fe9b121ba2f162750dffb74626ad86195f950df04ff5020bc60dc83e1917e8e2a26358aab530e53b76207459005321b8faeb1c46adec8b56f52fba85bfbc9cd56d0f90d83b713f1a727c984326c55ff50e95a172e0ff0ec69e4a4f3e956ac747ae40dcb5557fa7b05944572733d309869f054fe0838e45ce4dee0810f7888209b8293c0016703944a8cada6fc97d72d588e8d6e511aaa373b1d16b2e7ee0405eba4f32977b27544ceb7b7376d962c784f3288635d2337907ad74be2a89e9771ee8d9488c61e1422d801e025f7e4093d5a02302ad0d398af8b58dbec28ecb2862d6c45e37efb35e16d0c570b2e244b14183b94f3b9d7e1c686deab01c57f221ce3b11e9389e206c98b9fddd39b22ef73dd5962000b001b6ba68c1be6017c15a8027c6915926642b7ca4d18c7959d3d87c109b7b0d04f82db16cdb66294e9a4cfd560dc3b3854691be3cad8cee337c6c7fb89e365c0844e215f4a0b8726e2e9f57ff548cb9362c2af1148290a89fbc1e29b17aec8e992200af41711af2f32cde25a6b7eb0f60cbfad3723c4ae2fa2ef28dfb758c7f3dd167ec2b8bb02ea21e591c0b8f0ad408201bc6309f3ea8bd961d93390c577c7bb1e788b2c18f59cb8deacb384f6797f5cce30b7086ecc4bb737a7f682db75e8a3b2577fd7d433d79a3fae5673f9e58f7f731e2df54e6c1a568d13bbffbfb90d10e024c74c2415501a987029a5341e4529fc9e4c6e250bd8fed8579be40fc32e3a382779d6cbbd017a394b573c024bcb7a718c0df4e249d4d51eac3f892a3ecf757cb0d649232f210c66900414f5cb93ea95d8793b6b6855dc206bbd7495bfaeea31670f3fc675b3c3ad55b1acaa9d94d7ac9f005bbf6df2fe437fefcfd54ccbe4827f0fedcb0a9c0789eb08d1a1591cf8e6d86dfc5da2b4614d5d910b2fe98ebec22fff33cb20a9f96f45f9d8c5db7f06cfbea68b3ced6f3f20357b1bd01fbc306e6aa108fddc41374ddcbd405b1acec237230dd09e8b33cc51479d0783ffb264b9b30e98897d45d4d7d2298a42ddddec38fde42d7dd0caafc8983de4e14b0039b7ae3c43a7355a1e5b79b7af28366b8255afdb7e8391ab7d92e7a3b20891417cba76759850cea9706fc6e4306cd6e1435c112859fcc2a20bb8934d8866d21f6329fde4e8e00a35875b4b19856ca9390557e9bd2e5552546c207ecc9907aea275b11cb6253d31e777f8041ddc071ea1b5b3bc07ed126197a3378aaf13adb59eb042522b1c42c1e907a746fb58e467b30e9b4dcc27b461a8d98f4bf5c08271a99ed3fca6235ef18b593123bd6d47683df8daa5fad701af5770c06bcfdd3e8660ce272f08b11263cf58359f2bc3e664817fdf7fb2ca1387d7021ae9f36b0945acefcc2b3b1e7fcebd01afabb21cb8790b7211f1d6d346b91f35fdb789825236baf46afab5a02f68f2b04088502e9121cd01f51ab82f2e330ebcf88f097c26f0f289fae0dbf474204a8929466c9a2b88ee10ac727ee3649c85e0176649bfa65579949bdce8fd8dd35de2ba0f06476df551938256f23355fa60c29a174ad83e79b91a291e36e143a56cecdc4a2300b74cd89f13fd8bdc30152fbfce93e92c9f3658dadc2c93d2aa14dcd1ee8fc7b15f782f103c50470d65179607b4e7cf2596b3dc2fbf7296f057d66d0e6a945fea8c155c3e764c37118bb4ceacc5ee97522cf6526e60eae4c04db57205c571187a7ad35d0c6d288bc81e056212d7246e000fb24804feee6d7ed5af8f61ee22ba95c5263d92c73a2798c034300b5e40b7e1054738cea11024a2f3f0b28f7bf6904f5dd13c8ab21085f18d9fa813e5bba3214d4d523c6b9723b60b706a5c98b5d06597f4b329ad08b17a7fa7ec9bd0c74def99deeda8c4bb0a0861aa715db241f08b9c8341b291800965ce5782257af7f3e8926e2f0841be9a9a68af19bc3b52c6730fa9fc0fc9059dba73ee22ffd480fc2c91f9c893168995dcabd9869f86b3c456028179b5eb05868f954d2094643c172e847edc590d213927189a9ef153cd6c3cced0b833197ca0ec42ab428e8c362d67992f8b0d5b2d717543732bc6b0e2cb9f71ceab062a68d7f721e558aa907485c6301983a05f9944cd89080d0959d37c5367c2c0e351cb1621df7d891face3e33d076ec4108f6d5d868a4b8e612e1baefe49423f13739ce826514a6072fb4ad3ced5bd9f64babbc198555df7ddb2117f8a85cfcc31bc1e62363ee37285458c21d9aa44e38055e82631483da99b4783e40569a550fe9a9b8e50c180df6e153cc342c25778acad462039cdc008c3aecb26840a606f2523faedc9cd776c114b45cfed640133f7efa5f912dabd784c45401a28b5800a7505946cfa7831b99e05d0736aab7c151591d3021363f22fdaa36b838524d5115faf00548f22785d38089ea6aab688ebe2524f5ee391af981fd8b036e5b471ce9e0ae60aa28b7233fa5a990f6ad5caa88733be3a820bfdb647395726e43f602ac0f1a6a7aae41f10c2f128f9130744f27f55e8bb6ef74c8cf3b30cce705263ad3b5dc77fe93a58f85350c66edaf49cb1a0fd585c36dcc45025e413c44ea232ca0c8d4584e09eb76fcf0121118f3ccdd3cb20299c37e6cd4561a80021e6ffe7d7aaba7d81e765794907dcfe65e94da273f20fbf3d814073105a65a68b2114ffe22abd3338aed876d3ed7f52ec73d25c9ddabc46b1f93938d304c71bab66e1172be0ffa12079b9c65949149230b406a228ce300f9dcea4ea8e6cdff65b10eded2fa6959a39d06be618aad2975416f353de531d4a9bbd3e3c35998bcf12b554b297b5e7f009d1d2b4ae6d9fd5ddc8df7d05e427a0c2b57b1112b9ae1eef11eb4f7f938dba4dd0cf2b921b835086aa621cb937e12bcebf45831163905d64c7e4c0780bfcf6d4fe1a3ada1829e173679fde700869cf3cc25c661fa9361b65e0a89fa3dc08d54f7e1b346fe09a69daf56825d32aa6d2120de9acc1c8a27e757952fcb12596374b7bb56fedf1458b3d2854c4f8661817030c33f4da77238afcae2c8cb5e78ef8e58fcca1e60ba5397560dfb3649ce67ecc8d0bcf5386fffedc71439f8e5af81f7defdcabbd1891e8f556aac59780c926d269b66362a0ccf8989a5957a1c269be605f4f8458a4a9a3391e686599dcedb6d3079173aac775f81b5e776278014e0a136834aa4e81df5abc76b787a9875ae002e48f4a01f3aebafe9248eaf20a79949a3be635af188a21889b8e016510668fceb1c3ff06368606d5aa80747b683836baf138a2bb1a0236081b50d0a2cb5a5ad966adb259b2c95fc727d96e7c7bee7471c7358f61794245863bab5127d79a43575a7cd17ca937c14d195592e5c4d14d7cf72cf96eb2f19b927cbd447c070d51a543c74163a1fd13fc908c0100552d97013e652b482b3e9265f04bde2cb33fea2ec2541cc7ca1f6a881793aac0f1e16a5f6a457b9f55a7108e193f166aae83955764bd210d6619b2cef53e817052fd4b0d38e2006a3f9e31e2e53dcd49b082a740a1d25fdebe4a35c54d1d4a9056102664ab7d6461291a616ceebb143d3548ff044ca108af159d8ac09e8ee268a8297b59bcaae9931686df6e043571b9231a17623f2575a18f0ee5317688bda7fbaba0603a97dca9d9cddb1dc8fe5ec898b3d3f3f92d6d3b47e914ec5ccde88589bb642cab1b5b20f988a627a7a4de53a41bb129ecd848490f973257728b2be4b491e81327860eedfff9bd6bb0350ecac7efa00cc27a3e5dfe0f5663773c364f78fde24fbf7da25a8c82717a9b6efc0a692469595ea584d47e46a3730e90efba35888f684af7c3fc6234f95ff03d66d466c4f4774816064441d31d89e016f13b00e5cf100cd3aa1352f156db23ba36e888690157402cbc778ec99ae00e72f2b4d7a967360c42b96b84f7bf95a40181e777d5dcb46f7bd0eb6028f6d3af8d496f3654c6efe0f85f2140fd92e16b64266232cefbe4101f0d895f0e1f7ac75cd63422e17a76b1c37e1a4b33470499db229a95b17ea7f1ad41a31ed1e93a942b776016a3c63c28a47bee1ba1a68ba3e47670e06abe48bcf51d4fceb38639709197e8cc39b6ec10228860d33120cee673f03c4b446099d6268c457306cf68ec24b17702fda991446436585f341771b447de01aad2d748fc72d75524ec4a98530aeb78f8de96318fed06fd17c4cddf1e5fb8c65578dfeae51c736d34238113b482222ba6b341eba44285b835dd6699472492f949528a13d84e364b1165eee66724ba8c15206b3fbc6c74e7b5202f8b2ced9fa5f4c2d82a8b2909848aee7fd7294ec173c8e13547f9ea1a259371b61013c6f8f7f2cbab2aac0205c53af3cb881fedd578607ddc33c6108a4c2791f005b795a587b6ca211b4911a23c6580f89521e46c79aabb152925560f6bbd803ed7f5a968aca916a713dd3053918ca6624519854d1f995bc37bf3a58933d5ad218b6ee14aba02e49cf51286c4186fb9629657a41bece7eba49a31b2d065124f2398664bed4a2ad5f0a2bfb2a07d417421743e9ccc67bd0fff82645892d0ddca14f13d325d8f93aa08820ad73716954a1c3f6b49446c583d8b0670f3097267f28f3148c34cea1a46c00366e29f83c88c41ded57d740af62ba24a917aa9c3ce82e08954642e24b17f79c9e54141f32e59933e1c1ba7d42d832a23214f266cb8844d701490232837bd597d5dff2f5cf9b0fb96260501f8ddc2dbb8fe561657b790cfee4255d55de261d51c6083881816c271ff78a9497c301e012e5e027c263425169c96a3cbe34f866f85a4f5417093b454ed653f189e016f05880b3d51948e1f87cea93fe87fee943fd49a012ee841f427e9e744156d9b7d5a4eb891a10f4bb7befc72793fb09d659396487256ee37fb89b7c3ddab03eef11118463ba1bb1fe8ffc459b50dadd27b58bb7881a7618463038482d41a29c9499718a492370b47b51802b25c858fb1b8d7612dfd387d78365b7b56fa3a4fe7c4d805679c3bffb8e0fdf525b37f1fddcd749fbc68d0cdaf18", 0x1000}], 0x4, &(0x7f0000006f80)=[{0xc8, 0x18d, 0x7, "9dd4e1fd4d0d6d0f3f94bc5a8f3a9702f237bbc9dc78a8fec0e2b7643a604942bbb8fe4b4b68d5b40735a227bda5763613fde2eb7d4da19289d56b3e39464e9dec174f3d3e08488c5768870714b3fc3fea571694c584cd6970bf1bd4e149c467b35d370b69ad9ab18b11038c885aa7a6bb7eb848fdcac806e4254e567932fadf7e8ccbcb37bd98a35f5acd068f434cdfe0def3e96cb38fb8ed57dd136f75d37e602b8a551a9504ef499acc2d61812e1849a6"}, {0xc8, 0x88, 0x4, "7d0fa6ef7165cd8e1d0d653fa99f68aaa7c5aa4b70a7ce486c7b56520814fd634bcc9bcfc2c644446524d86697b708197d73d9543c92f21b3c2fdc50d9f74f39ad97c3095866f0cf6fd20acabae0ef03d4a3d43ba5fce241393bd814de034907234d1f6ce0c53f21d50f9d7b0ee15f6680f07b3e1ec030c3f577edb2662eb0f870a99d2fcb9a4221936bf71686d3cac89a98cd846ab894ec7dc1692b69db7dd43f8c622310d00d804e511e022b689f1b1584dce0"}], 0x190}, 0x200}, {{&(0x7f0000007140)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x2, 0x4, 0x0, 0x4, {0xa, 0x4e23, 0x2, @empty, 0x6}}}, 0x80, &(0x7f00000073c0)=[{&(0x7f00000071c0)="71c8c36339be79ca8cc51f1e102c9b2f5a4ce950d7583226c43b486a914d8eeaf6713790d6b57b3a2a9a68b3f73a4078f65e83a7bde9e67ee5d20fec9a7b6aec9b47555393a07247325636f1add359c43965729dadf29f9fedb88798c95a9fb0be119b488c2c811a98b969236f4d18fa4a8abcd7ee018272f2f2123a41db3cc67f5aa99bc2da008e0999e8a2e3ab1c5e1e60ee7164d23f4fa1c2eb8c6fceff7ea889c4d1c30a766924db1c00ce7313238196d17f223f9a92398a2f796bfe97d8647a236516478bd7", 0xc8}, {&(0x7f00000072c0)="1cc20e20045576ce1f9ba36b00a27ca2f96ecdabc92660938d5ce7de7d5ae74b6570fdf4ab77ab67881f89d806480431c5425f2de495b527e5cb3a994087c63e45a9f3c903a9ba8c2b1697f584333a5fd1aa212f27b7b5f48f0c56107b238e034e4fb79be564286c160f63814672e8330b135208460839aa63879cdccfeb9961c7daf2597e5c101ad4b4be2bc761c85a253a479f8725ba938ae754c845a883afd3f8ca0f1cbf64000dae59bb9e28fef913c2d8f8bfc0f5d62c7ebc4aefed48451a4e3f3f87931b296b62071e65b3e100805aebc599d2f8b52b0356ed7c7e7e13c584be08ac166c931d37b4dae63b2fa5d7e0bd76e7c655d2777c", 0xfa}], 0x2, &(0x7f0000007400)=[{0xf8, 0x13f, 0x1, "fa4209fe2275a0f5d1b4ecdfcb6760778f2f08281ec61b73c3905e289e0972e852fed2393bc68e43442fd241b37655c8b2309ba1bf336d70f8d937b6d9bbe791a5c96aae480fdf88869a7798cbed095178a1f8d94c8aea440efede8b9d33aa25f6752cd7bcf500fe4f5ade9fd76c7c2fabd32ab2efd30a71ae198de6335e1f40c8d1957508baca46207353922d89b78c81e76a52d677fad30f0b6be31a7a8c81f0ed412087b5058ef7f5d7c32994e53991b1f14d0350ee1d439c9415643b30c1fc35e096b92cdacfe96fbc0bd44e51bbe9d2ae53b4b0feff4495621da3f6db350616dc1f236fc6"}, {0x28, 0x100, 0xfc8, "24f8b7c172822cc178fe7673c6df4ce0e9ba7b84"}], 0x120}, 0x1}, {{&(0x7f0000007540)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e23, @multicast1}, 0x3, 0x3, 0x0, 0x3}}, 0x80, &(0x7f0000007a00)=[{&(0x7f00000075c0)="15c45211db46b0dff72b9b99399897e8945df07f41b018ae8cc28b79ce4d655556a5361b04", 0x25}, {&(0x7f0000007600)="f4710fc58416b04bd79c5ac66a1b8e92715be62acc676cab65d87a6877deb48161701689e0d469c09994e5c78074e5e57f0d7a893f0c6485d34b8aea88b1bcf2ec52918c81fd2eafc89e17c2f3959e1a843e3cf8bb6d192dfa0d043a446f06cd6c9cc444564a5828c8a72430f23427c923c40fd2ef3788ebe9bd237b369cb019160e0df6f33b", 0x86}, {&(0x7f00000076c0)="cf7db7e5e89e5fe5d90fa72e3f2f2bbfbe62790557f87199b815ec1db878b648afab7dc3ed64bc0bfa9b2028420ea03e3a81b0fd909953fb4ff71279b3538bb60f456fac9b9a863629a05de0d4b3da3855cd084385445df2dc3389bb34259df78c405692af13c27e04a9509ef4bd1bce988847e8a29713f195c0adee6e43360a4385028264441fb6fd992d8ca08a74db35c4", 0x92}, {&(0x7f0000007780)="04e091439522f05babb1db38192ddfcca667b1fc11d6bd4e45629ad14abe8367068baee9bcc3981e94ea204ae456d891033593e42bde166c423daea62ab5f59eba9490b116f9eebc6b6988d8acdca6c19fb1a1964fb41761bc0642558d588f1175ef9ab939188dba7da85f3d505004ee2932008160e46ded0fe5c4feb29731716a8f4d26fa975c34cd262096828b0deb9089228b06193d0bd5bc53ddc50fb9f3af61f1eb90554c0211f70ffa4556ff4e4c8226aaa3abc277b29821192ce86688d1a09d1349c3cda792658f579f86d7b726e9af07002c417da6a8cab8", 0xdc}, {&(0x7f0000007880)="0576f20f5fed63cc23098d3a7776b32c5b9d67b0174ada2e816f27782302a41d8a87a83c55d5c0cbfb45c20a2f9f6302fe2909325d89e1813880c1762d49f4748fab9d934d954a6e5436d9bf8b508b6e9b16924d3a628a11fd74eb905666e8236918f7a6a2aab0f5c7b819da096d94d084302bf077dbe3615b67d141024123ba5b420022b8202f898121559a271d0dcd74f7f4fd15427925f23f50f4e928d802c1e01584920ee2e29c9dd783dbc0a62dcf8ceece8a1fb6047562c73324d0c6fb14b9fd26e7cf5c6396339e6378", 0xcd}, {&(0x7f0000007980)="e0bcd22501be808cd4eefab532767cf3b067629134a096e7983045679fd012d105e8b67aacba7703fcd25224f2d1a4decf28c0a2c5f41de4ba33ef577536c82c32c182ed", 0x44}], 0x6, &(0x7f0000007a80)=[{0x20, 0x11f, 0x41, "2636be93af40b811bed1dcb3b5"}], 0x20}, 0xfffffffffffffff7}, {{&(0x7f0000007ac0)=@rc={0x1f, {0x5, 0x3e000000, 0x3, 0xf0, 0x1, 0x7}}, 0x80, &(0x7f0000007d00)=[{&(0x7f0000007b40)="50f954337e2e1558e84d6789cff440d036517f3c934f9f023d71d464c16f859acc3e0c0c42095a3020ef61c2f4fd348edd7ecee4bc26e5e5a075d3ffa6deb9d9db98badc5f9bd940006a05f673fab071244f24d94b7dae90b644e7641c9fe4830d726fdeeba0e00077879ac65a94759ce7be1f9c75f3f0d19dc9b9d0578b5f1a4c3a0a7d4d3805837a6a1ce268e4f2180d84f67df4441a3701833b9435dd744317acd023f3e8a67dde906f584a4ba8de3129ba7687cd1c85efbcdb93b36d7e00cc19b6d2d3420d1226c28f48d5435a53ec3b411a2f3f62a6f9371159aed11aa0805c27e365d5b7", 0xe7}, {&(0x7f0000007c40)="0f310c24e69329c2bc50a03053f551e11a7a608a8fa06a5748b9aa7ce8fbff94cc6d5f1f72e816d2697baca130ba7673d410c524c9019b31964246c3ee03053c9bde971ff9661b04becd8370534fa4af9bfe5542937ffd32b4a7a4477770543c8c654de04144ebd90ca56db501c1636a83fc9d15a46067ec073db454eb43613a751354947bc7e469d94020ede204bbd2ca9be813b4a52569df74", 0x9a}], 0x2, &(0x7f0000007d40)=[{0x70, 0x0, 0xffffffffffffff3e, "713660de853b4b3266fbf2d5faa921cd01d005c064d10f2a63bffc2a488d0e985717b96c78f3496c7f321a0541c85c58d9ffdad4cad078adb9b52cfe8ca107b18806b88a05d72af2da09e3f13a856c8781cf0f7478ff1fc7d35b"}, {0x50, 0x29, 0x100000001, "dfc2d0d3d1180378e3f6aca816661c2284a39d670b0aa645451b908166a45c3ec54365250749367798e08fb26a35dffa2e8593e2a2d87f961907145a"}, {0x110, 0x6, 0x3, "073e7cc3db361b3af42ff32c01c6a192e0c7be2aa2b919ec19b19e5aeb938d5ac8913d400c8bd3820eea0fcbf352f1dee6dbb2e7289b8c535728b4369f3783d92e4706f1761c4a7a1e02f41c95bf981da29223f34d9b9b1c82b2737111678c8747a970fa1bd9f64a7661488b32bf2c166c17241e836d4baf60bc054b352cca47420a9db76cf939371830f413b9a401f4ce01c36165d24ccad1789e83a0d03918cf7838961e54e98e8a33f421b992d6cc21f175310261cb9c0610f8b49455a4489fa33f74a02262aed584ecac370d1b7cb04a2d32597e79c59c56d8fd17560ae50cd7bffc17eed28e78cb1fce0e19a97f5a3672b9b210ce15102e170c87"}, {0x80, 0x110, 0x9, "e9127d096cfc7ea4dca991300138137c676e2f46110ea6625030324a1e06e44d3502e719466ac84ab30043de64a7bbb92d043d845ee3dcb877badf810c49296f5e7b565d65501436577c404a4cc5bef98c9dc9c3b28f1beb012b9da0c4d89af1e3128dd6efffd65e47cdcb3282"}], 0x250}, 0x3}, {{&(0x7f0000007fc0)=@ethernet={0x307, @dev={[], 0x11}}, 0x80, &(0x7f0000009380)=[{&(0x7f0000008040)="7376f88ce71b3cd403beaea2b7b69af36aa3d59c6e5ec86f895f316e3d06f10fb6b2f1908b496c", 0x27}, {&(0x7f0000008080)="541f8dc9a11b9b96fe0432d05d6ae108def714a173e7304d0df83a1c1b4e783519b63f3681f212898b327e5499662651abd00b37e49878c6aea0f58b187da249c0e8228d7095bbdf4034dfde8a892e36d35a8ff190e7d60b3806c58f6fbae82fcd5276f4ad0913f8e4bb93ce8b52cab4ab0e6d5ad77890399765b3da5e25de89d0ed51fd36bb7745366e2362e337b2e377be5a4f39769b145d848e584e43aafe08d7345ebbbc0d27fcda3381ccbdefb356bc7de1f25bca6792b4ddfdc32c30da9364b9105f08738f08730b9de31ba5be1e78adbbab2abb2cc7e88b195fa7f796b3e363ef8c1618e9934306061d30f1997d46bf5948bee6b73e70b9f0103ce09bc6bef585b06109d18ce8da02abb59aa1ff8036fae1c63a1e0449b3928c62b61735a93f57ac109f9c47462f534d0f6131da1aab0d384453775cd7fd4fcc38eac721e4e9dbaf1d2f971b972e7fbe0d9f5bdc97b5447ee6c7be400cd0e5ee823dc28b78a32e95cf5b772d9bb49a145b66203ce8ce263fda3b6d765d812f246350e20ab6f37a329674a72869f42ca57ef3eda3796dac34a9742a5505833490fa433a17dcbc9ea91534998246970b62ba4028a2e481c58ebdf520a3634963c7ddcc9615a6edaf2c1162aeb4c8b6c4160997f9254765fdefc4af2f483677482241ff817696338d3cb873e59c2564e176c4f70ccc0a60a439d8dbd7e320e0cfc9cfc00d847f725df90c9681a9228347c7ff3cb7f90e8bc0b832dfa95a1be0e6dc76812270d451aecee4f29656c680a65483de16a0f6ef4f7e1f8798282e616b2750ce10d491d04600a2e72814ca35c5be55971b355febdaeb66d02027a6e19a8f2d4df37b69615760197dc5c272dd2d50d08b1cb9a01a1615c61d696f67b7d0e98c917fd77b1f4f185164c6a0f4b11a954bb4fbb216edd812aa5d22471df40caa47c7b4d5c507dd42ef88b55e35e30dbdbe311795a6cd4c8580206d9f47d606c54bea0d7b19d92ecea2b5d9dc3631d4b5929277a48301c428bc4bf91368a215eaf59368e677449bb86609e69d6b985a80d5247640d1e66d03d8cdd06a2a7eb22521c2ffe300691c614600d7b116a1ad8db98316c9026165b8c4742935861f4673f8dacf1cb21eeac92bc1e81c65b9c3018234a09b1e8ffdd88911ba7fe1dfdf4e4c1992f904e67b6597091adb2f347f9c19e94c5694eb1904e75a2699cebb46029ef15ed92ae49b3cf5385c0902a88c502ace4d74b264421e9a38810f7605699006e8c1c5f9f7c626b56364af9fbb05df4abe6b9a838957946bc9c09e9d437d537f12d6e09cf29df5414278ba769db31a49a2a34b8b0985c309aec9c12f1bd290fb81bd9038d5631ce1f74e0954e2eb622b6c26f6494018090a0f2b375d66563805749d2e98fd335b9c64736307954793dee236e1542379442d905fec209f2954c40f3c52fc6f8f8338714f170135e16d654965e365c6f7d95667a43bfa79698b595098bdb7b28d761b7229f1eb4a36500af1ff1781b00eae785a091e93aedc050104ab36ceabccb64b6fade0e4c256a44558e69d59a81f54406eec3bbcfffe4f5c266ecbc9f1e5269b6804481c1583453e55ea6c65ea9dcd1b9e9278e9e98503d14c3e21c660322711308e478f1d5aed6f1c88b7b44876e6ad4d8b92110be355ae5a92fd6bc989fa7c94dd8bd36302d3ea9b4835cb76de04c5626a1f9c102ce0683d1d0dade2699f41cf713c9e5c6ba31b173a5daa4eea29394a67b6c124cb77f4ab44a2159959696ed0af20e978fca1ec0127b41c7010deb8bfac9158143f8e5a92b8fce9316668cce2ef95cf2d5de886dca4e32049f40fa4a51097ed08fa2d5772c47fbc94959a8e3043db6dcf2ffb1dd1f41bbe7cda4ac21586919300352be373d8765c1c6874b85ff775b6ee2eb12a77447d1c3cafa4831cd9d85e96e77766453ce706750a6655182003dd6a8cb8d272f0702c2ea9a99ac49e8a6863897b200d729d8b4fb3c88f03bbf832adeb073772e75db1c439bc38cbb06f276e6ba70701168d9d30ad0df0c828bbc790a7fc3ffab126e884cd7055a22eac471965a0c44975731a67b2d33c226c6cc8286056aeb5b1cf72ef0004d7c2dee84108ed728bdcdd335571759f8c9dfa0771c60416366045c82b6c2dc4332f6f4c6366cb7cb4c2e1c3a6ba665221317a222e0b2e8831fede44056ef5701795a41eb0a2be5869436cddb88365d607f2ae6579d96b269a7e680ebfd59d9fa9ba68a141c3073470bbff8d19f2d776af35788e27db93130e1a552c9ad5619605174b1815df43f2c166c941ecacbfe816d333db0d40044dc1cc28a2aefe4f60cdf9531b7c46f5e5086b2fa722baa5c51cc3b689d59eb4946c1f25f34d99fe2c2398224ea60eb3ec0be3a8b6097e7a852be6ab94327d13b100ee9e7036bd85ee7cdc03e5bac6df0322aec57b17ceaa68d959eb4bc1ca5fa3f6afb5da5eb734cd72ce9a55554d2b32a3edd77830a416113566096e059cf65c8f1494927ccc5723ed18300b13541cb271c85eb191b566a95911ba42af653ab618fdf8ad3985be2bb58b5016335beb97c64e0c8b266f0e363f88d1437a1c45d96fa4a1172ca3ac9e206fa87089455060d1df217ea7183e0c7058da51193e65f436976f1cfe29d190365bc7d0a26669eea6c7163e5e003e2e79f4ad1b4672c7c9ce6649e98ae1bb638e266a21e3086d5cbf864be5364398dd9111d4c1eaab4213b6fd86ee23fc0467daa255498a0aca980744968110b60eb68c1b0dd93cd4c0dd635060c5f3b823fea104be0a2b1af479f63dd5a4e54024da069cdfe04f467eb276131ef2aac177442d77e354af4a4580b1684d412a1280c3d12dc7cd03405563a48a4a893c69614edde5d630dd7143fd5da5a132c229da47eb15d3f89bbb515bac23ef47355f26bc4c88bd025c1406ffff8d701214eb59fa4e21f8183f94b1994d771e7e7a2774e5f91e71134b688ed1b64dd8f788a142393c1a761a368d5c87c017a74cead4dd713bdfa53eb8e5ba19b7175a16d6647bf2c1b07ef6dcd1ef9aed840b1cac547155c41d125dbe04cb300d3b43016cefb8c3563d8be4fa4f2e08db28940bbad4e24198f9b21684f2e0b2ceb68ba0e1fb73b39d53307c251e1ed9b25c703056714c13ced83322b87fc781432c914d71b2a039d2d5dfcc4a2f67b5461fdf83a235a0f1d45ab75c27442c871da6ba40ac50879308e301b9f263dfb1a0d65b9bdb283ea35cf47c6ddcb62d61464d415307b6ef8c35887909aef02243ebfb15d7f048185624eefa8dbe7bbf7309729e0715dfc8ff1538d37fccbcb8fdafb568ceca48b9ccc9e9774e666bc6548724ef4e239039a94c038c77b042c41de54bdf54c3dfc430516c258a6f5240cd501ec83902517e3782f62255a4f29bd216afc4939b9490307e12c6b151c768b5e9fa10328cbb8bb0de96608d7904de3bd5ae526fa4198ed832ffad15294baf00e7fca63b23f9e0539a734acc54e9e616493ed289c9b28ba90f6524d2e28f0dc4a0c99acf3194a0c5087cf37995804995e88d161c2f2d162f603cf7c3d4b88c273c910515c73a133203a81ca2076958e385a495de3db0b862355d2d8bc4bdfbe6f636576c51e9dfcbbe6acdb9429c9490b1a712340c2ab59191f493a523a2691880c1a0fb1714231ff304cf49d43d2e3586286549c88c24f677f98c82ca113c6965fcf792e04b0c8bfa90b67a8fbbce6adfd2ad2cb884df168f223369e8f43f21c3877da27e9e27b0452564c145c0adedf13f66fe99280dcabf40f87f6aabf29b6086c2d87ff58ede51762b06450361b52d08788a5a00a184ce4faaacf508d59588ada6db11e752caf3a919e3a286d270188e499110016b1c3240b103b10e039d2da454a8ee45a44d5a8d5b00a4d229fa48ace54723a2e964e31ad9b27e60b156d12b8f820ce7f06d6ceb21f21303c06850d09cbfe9aa7cab2bb5bea094e81b2799104476d9b06455b566d952aae296ae426767addd9efdaea3f28d8639091ed8bd43f484e7ad63876771c0ddd58b58b03760454330b805f77aab60f68e01c44bdc4169119950202cd978b27fe6a9c3dd3fc197d2bb1fee697f76fe9231bc1d15b72125b5e2a811159f092be2590b372b1dd95f6dea96f54b9e40b3223d0434b76090467bdd6127220292bfc43b22a8a150c8548c2138c158c7c8c591710c57e8da1d569c1b93aaed875bc65aefba26bbe0670169bbd517a33619338835e353238fe1c84be28e38ee12559556f54ce1194df237f03d7e76235f213facc80d8713f459df7102ae53c8fa44a853b65c9b8604239b339c9ac0236c19014b3ec204a764f60cc0b9cafd161e7681128a7afe65656c990e28655a73bbda39bce1b7a63777dc3699427d64052a976c2206829f0665d35f23b1fedcc4c45e35959661b395413c750c7d43eb09a0964d685fe7e44af07120a6c251b256890604763ce28fba13962de8bc9beaadd44c30402ec54dcebdca5632e09739a30932ae4f85c323b8edbed477810eb5e84f6e8a87606b39bbe0c5d90f0702579f1c8f1589d6788b0e9d475b35d82ec4bbe87e43544d407637ba88490f21fbaa390fbbc4af4e2fdbe9425e097f08e2855dc89bdb7849e3d04562f5df6174f059f72f0ad40001e8e842a00fcab7e5cb5dc8998a2785af29c3b51b6de43972a3322217a5f19e5c8cf22333aafeac1bee64b3cc86fca4d111331d36ae881dc125e63056d07933218d182b09ba158854cdb2b40116dadd8e0bb2efe45c23593c2be247200449ea83b8d87031f4566b0ba26c48afe551489956ca0366defc5fb6f9ef17bf5e36e2507b0e7e5a34e7f95726a767bc6359ae59d390d1217b440b87ba4a8ea061d2694a4d9e0a12b14e3ee0441fa015ca1083dade735b193301052f87053094b064198925b715fc49d6725f282e3117ce0efb329a55cbd0351a1754c6984332e61075106a562e58e03e2cb733104a423b9d1eba865af9c2a2cbf416fd2e249e7cbe187d7d9b30d5a970bdc29c135c8aeecf1023a989380bf59cecf0a72325905e1c999107129dd2720affcd1c90ba7edeffe0588247d28b3514b98133929bcc000f32872534c3fefefa6bacf914f985ec266f8003a7651e41ab5206caf012d541c3a2ea161fa748c3ce260790f4dd8cc95800471f3edd94cc28f206cbc5d862b1308f0b9efe2ffa729fb629b4100e8d4171c15d4ee074eaf443105fb19a6241f51f3a66ff0b08ae57158689ebbf75250c84d9ebe95303dd72d5003dbd08e3fe4a60a6e58e73b5988e3f7f491b91a5c6e218c4006d6fa7871df098c4117eb8371c454bdec2546961fd1dd7b33e746c9062273f3b5d3913f9ae131ec4f0d6197df08a22e2de3f48b897194d02cbe67e9329041e84b7397bf5afb878bf1a3b2feb9f78a588afb72780672a741ab4620ca3d4b36ad9083ecd261c822bfb7855a075428d4e0f346c8a3094b41d9c07905b36a7795815576a96b9dd5f6e5b05f143035aec275768454874e8f8901e64928a9dfdc773ccadcb3a142cfd40c93ab20c827d67b48c39427288937944e06b7f925e5e5501a03fbb35dd829060db10e466de0774934e757ae92e007c97de12669c781cd3ae4618eef065d2b151b26c33e0796ff60791c45a85f834dee0a3a906b8c84f93f9fdaf91d99494edf67839325004fdc4693f0eecc9dc6e1747bf6b793b1b91ca9e1f6e9476e5a509a591fdcc14cd62cb718cd9684cc547edf362e391ebe48e746500563a587bb99d49d508fb7a2ef7428d433bcd36c4cb22", 0x1000}, {&(0x7f0000009080)="4b52fefa9bab3fde7a875c9b7e7e3bb2f895f3b449c4d52f3797ae64483a5e0bc298db126148d46a2e2e2cfc88ca1aca2c2fd7f5c0f6d6b0884040299b220a6e617b31d26a10d1e1a1503d11d5e938418923e9ba96597bdf4b9dad1f2cca5c5af430ea825dbf36d30ccea79c4cfb7773064c926e90dc26d402b934d8ee3c5aef096a530577f496f5db982ad9528362cf253cde3cbfbdc465bf37b333f8b9e2a649bfa9d16f3e26cfa1ee522126e4ac68816869f9df9e97fcde8c4c334b17aa8947c09176be21b72083d6be207e76f959cdbb313acb319d2b7742cefa2b93905172f221513bb75be0dc46be9a482a", 0xee}, {&(0x7f0000009180)="9036443559f3740bd2e6bb38e66466adc25c47bc42fab2e35453b464e62a1fa6836f43457a6d9448db857a7232bdb01e88f71af384220e433046c1820c2b352540886635432613b3e6c6454a8b960148bf58db1344ad0f2b7deff8a25a3d459e4d1ba978f3bf880821b86885ef9d9a4e2df79d247061b9ac71b9304a2742b2fa697378d06df3a25e3d625cbae90208ce3df40cc6a634916bbb97944749424c320cc4402ccf5ddc3d5081236a70e7f559c23aa5af8b6b8fa0d464b074c1f395b2cc3c1086fb77", 0xc6}, {&(0x7f0000009280)="81cb65074f2bfbe0c6bffb7fdd5332bc0fdc9427278fef25c705090c97320ab1d73ab75c8960f646d7", 0x29}, {&(0x7f00000092c0)="498c1bdc147f4cddffc431ec611759cc7bb5", 0x12}, {&(0x7f0000009300)="9c7bebd3b6238fe0c93d3308854da067d4b2b11f96b6b2bf21b0fc51e67cbfc26afc2351a35bc1143ae165e8010a2d818f1f032f8ac4eceac38c805e8a5a087833b5e5efbc2109cefdcb369a616c2e9f638f2093927c77b79a6856807a45f0491211444889989c47b755b8d2391064bc36e7c0a2952f41e14161", 0x7a}], 0x7, &(0x7f0000009400)=[{0x60, 0x0, 0x6, "d67cd5c0a5d821d18a39eb27d4b32f38a532b4029d56bcd1abe532b751b8a4c764df2e50fdb0fe2d7b61560ca2b27118437dd0fe2a6ab72d4ef3907bd11ce7c69d4e9ad0bccf8437e9c6"}], 0x60}, 0x3}], 0xa, 0x0) 13:57:07 executing program 5: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) 13:57:07 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1, 0x0, 0x2000000}, 0x0) 13:57:07 executing program 4: openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:57:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x1000000000000000, 0x0}) 13:57:08 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1, 0x0, 0x200000000000000}, 0x0) [ 647.757555] binder: BINDER_SET_CONTEXT_MGR already set [ 647.802397] binder: 19962:19963 ioctl 40046207 0 returned -16 13:57:08 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0xa00000000000000) 13:57:08 executing program 5: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) 13:57:08 executing program 1: r0 = open(&(0x7f0000000000)='./bus\x00', 0x40000, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:57:08 executing program 4: openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:57:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x700, 0x0}) 13:57:08 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1, 0x0, 0xf00000000000000}, 0x0) [ 648.249450] binder_thread_write: 8 callbacks suppressed [ 648.249465] binder: 19979:19980 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:57:08 executing program 5: open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) 13:57:08 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mbind(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, &(0x7f0000000000)=0x6, 0x1ff, 0x5) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:57:08 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1, 0x0, 0x1000000}, 0x0) [ 648.399519] binder: BINDER_SET_CONTEXT_MGR already set 13:57:08 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, 0xffffffffffffffff, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) [ 648.455005] binder: 19979:19993 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:57:08 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) [ 648.505275] binder: 19979:19980 ioctl 40046207 0 returned -16 13:57:08 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1, 0x0, 0x8000000}, 0x0) 13:57:09 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x1000000) 13:57:09 executing program 1: r0 = open(&(0x7f0000000040)='./bus\x00', 0x141041, 0xfffffffffffffffc) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x3000000, 0x10, r0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000000)) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r0, 0xc10c5541, &(0x7f0000000140)={0x7, 0x400, 0x7ff, 0x0, 0x0, [], [], [], 0x3, 0xecd}) 13:57:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x6800, 0x0}) 13:57:09 executing program 5: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) 13:57:09 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0xe00000000000000) 13:57:09 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1, 0x0, 0xf000000}, 0x0) 13:57:09 executing program 5: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) [ 648.919492] binder: 20019:20028 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:57:09 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x42, 0x0, 0x8) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clock_gettime(0x0, &(0x7f0000000040)) mq_timedsend(r0, &(0x7f0000000000), 0x0, 0x7fffffff, &(0x7f0000000080)={0x77359400}) ioctl$KVM_SET_TSS_ADDR(r0, 0xae47, 0x0) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:57:09 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1, 0x0, 0x2}, 0x0) [ 649.030158] binder: BINDER_SET_CONTEXT_MGR already set [ 649.064919] binder: 20019:20028 ioctl 40046207 0 returned -16 13:57:09 executing program 5: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) 13:57:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="05630840000000000e630c4000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x0, 0x0}) 13:57:09 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x80000, 0x0, 0x5c0d) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) [ 649.297172] binder: 20049:20050 unknown command 1074291461 [ 649.333515] binder: 20049:20050 ioctl c0306201 20000000 returned -22 [ 649.358752] binder: 20049:20056 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 649.398593] binder: BINDER_SET_CONTEXT_MGR already set [ 649.431462] binder: 20049:20056 unknown command 1074291461 13:57:09 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x40000) 13:57:09 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1, 0x0, 0x8}, 0x0) 13:57:09 executing program 5: socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) 13:57:09 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) [ 649.471718] binder: 20049:20050 ioctl 40046207 0 returned -16 [ 649.483232] binder: 20049:20056 ioctl c0306201 20000000 returned -22 13:57:10 executing program 4 (fault-call:6 fault-nth:0): r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r4, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:57:10 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1, 0x0, 0x100000000000000}, 0x0) 13:57:10 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cpuset.memory_pressure\x00', 0x0, 0x0) setsockopt$bt_BT_SNDMTU(r0, 0x112, 0xc, &(0x7f0000000100)=0x4, 0x2) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(r0, 0x28, 0x6, &(0x7f0000000180)={0x0, 0x2710}, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f0000009200000000"], 0x0, 0x0, 0x0}) r2 = msgget$private(0x0, 0x40) msgctl$MSG_STAT(r2, 0xb, &(0x7f0000000140)=""/16) r3 = getpgid(0x0) lookup_dcookie(0xdbb, &(0x7f00000001c0)=""/24, 0x18) r4 = getpgid(r3) r5 = getpgid(0x0) tgkill(r4, r5, 0x41) ioctl$PPPIOCSMRU(r1, 0x40047452, &(0x7f0000000040)=0x9) 13:57:10 executing program 5: socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) 13:57:10 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) setsockopt$inet6_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f00000001c0)={0x9}, 0x4) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000040)={'filter\x00'}, &(0x7f00000000c0)=0x54) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) lstat(&(0x7f0000000000)='./bus\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000200)={{{@in=@multicast1, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@loopback}}, &(0x7f0000000300)=0xe8) getresuid(&(0x7f0000000340), &(0x7f0000000380)=0x0, &(0x7f00000003c0)) prctl$PR_GET_KEEPCAPS(0x7) setresuid(r1, r2, r3) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) write$P9_RLCREATE(r0, &(0x7f0000000400)={0x18, 0xf, 0x1, {{0x4, 0x2, 0x3}}}, 0x18) r5 = request_key(&(0x7f0000000440)='rxrpc\x00', &(0x7f0000000480)={'syz', 0x3}, &(0x7f00000004c0)='\x00', 0xfffffffffffffffa) ioctl$VIDIOC_RESERVED(r0, 0x5601, 0x0) keyctl$clear(0x7, r5) [ 649.712043] binder: 20079:20080 unknown command 15 13:57:10 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x11) [ 649.759680] binder: 20079:20080 ioctl c0306201 20000080 returned -22 [ 649.760399] binder: 20079:20089 ioctl 40047452 20000040 returned -22 13:57:10 executing program 5: socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) 13:57:10 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1, 0x0, 0xf00}, 0x0) 13:57:10 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_SET_XCRS(r0, 0x4188aea7, &(0x7f0000000000)={0x4, 0x5, [{0x34a6}, {0x4, 0x0, 0x3f}, {0x8, 0x0, 0xe80}, {0x200, 0x0, 0x8}]}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$KVM_GET_DEBUGREGS(r0, 0x8080aea1, &(0x7f0000000080)) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) [ 649.806067] FAULT_INJECTION: forcing a failure. [ 649.806067] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 649.843608] binder: BINDER_SET_CONTEXT_MGR already set [ 649.879175] binder: 20079:20097 unknown command 15 [ 649.882347] CPU: 0 PID: 20085 Comm: syz-executor4 Not tainted 4.20.0+ #396 [ 649.891203] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 649.900571] Call Trace: [ 649.900888] binder: 20079:20089 ioctl 40046207 0 returned -16 [ 649.903182] dump_stack+0x1d3/0x2c6 [ 649.903205] ? dump_stack_print_info.cold.1+0x20/0x20 [ 649.917894] ? __lock_acquire+0x62f/0x4c20 [ 649.922156] should_fail.cold.4+0xa/0x17 [ 649.926255] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 649.928204] binder: 20079:20097 ioctl c0306201 20000080 returned -22 [ 649.931364] ? graph_lock+0x270/0x270 [ 649.931381] ? graph_lock+0x270/0x270 [ 649.931400] ? __lock_acquire+0x62f/0x4c20 [ 649.931421] ? __lock_is_held+0xb5/0x140 [ 649.953860] ? ___might_sleep+0x1ed/0x300 [ 649.958016] ? lock_release+0xa00/0xa00 [ 649.962002] ? print_usage_bug+0xc0/0xc0 [ 649.964278] binder: 20079:20105 ioctl 40047452 20000040 returned -22 [ 649.966061] ? graph_lock+0x270/0x270 [ 649.966077] ? dput.part.25+0x26d/0x790 [ 649.966110] should_fail_alloc_page+0x50/0x60 [ 649.966124] __alloc_pages_nodemask+0x656/0xde0 [ 649.966141] ? __alloc_pages_slowpath+0x2db0/0x2db0 [ 649.966152] ? find_held_lock+0x36/0x1c0 [ 649.966179] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 649.966196] ? _parse_integer+0x134/0x180 [ 649.966218] ? mark_held_locks+0x130/0x130 [ 649.966232] ? lock_release+0xa00/0xa00 [ 649.985725] binder: 20079:20080 Acquire 1 refcount change on invalid ref 0 ret -22 [ 649.989621] ? arch_local_save_flags+0x40/0x40 [ 649.989642] ? find_held_lock+0x36/0x1c0 [ 649.989658] ? pmd_val+0x88/0x100 [ 649.989679] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 650.000298] binder: 20079:20080 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 650.004255] alloc_pages_vma+0xdd/0x540 [ 650.004276] __handle_mm_fault+0x26c6/0x5630 [ 650.057310] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 650.062177] ? graph_lock+0x270/0x270 [ 650.065985] ? print_usage_bug+0xc0/0xc0 [ 650.070055] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 650.075602] ? graph_lock+0x270/0x270 [ 650.079405] ? graph_lock+0x270/0x270 [ 650.083229] ? handle_mm_fault+0x42a/0xc70 [ 650.087472] ? lock_downgrade+0x900/0x900 [ 650.091627] ? check_preemption_disabled+0x48/0x280 [ 650.096645] ? kasan_check_read+0x11/0x20 [ 650.096663] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 650.096680] ? rcu_read_unlock_special+0x370/0x370 [ 650.110996] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 650.116535] ? check_preemption_disabled+0x48/0x280 [ 650.116559] handle_mm_fault+0x54f/0xc70 [ 650.116577] ? __handle_mm_fault+0x5630/0x5630 [ 650.116595] ? find_vma+0x34/0x190 [ 650.116616] __do_page_fault+0x5f6/0xd70 [ 650.137800] ? __ia32_sys_read+0xb0/0xb0 [ 650.141878] do_page_fault+0xf2/0x7e0 [ 650.146042] ? vmalloc_sync_all+0x30/0x30 [ 650.150201] ? error_entry+0x70/0xd0 [ 650.153916] ? trace_hardirqs_off_caller+0xbb/0x310 [ 650.158931] ? trace_hardirqs_on_caller+0xc0/0x310 [ 650.163861] ? syscall_return_slowpath+0x5e0/0x5e0 [ 650.168794] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 650.173642] ? trace_hardirqs_on_caller+0x310/0x310 13:57:10 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1, 0x0, 0x0, 0x8}, 0x0) 13:57:10 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x14104a, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$bt_rfcomm_RFCOMM_LM(r0, 0x12, 0x3, &(0x7f0000000140), &(0x7f0000000180)=0xfffffffffffffee7) ioctl$VHOST_SET_VRING_CALL(r0, 0x4008af21, &(0x7f0000000080)={0x3, r0}) madvise(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1f) ioctl$VIDIOC_TRY_EXT_CTRLS(r0, 0xc0205649, &(0x7f0000000040)={0x4, 0x10001, 0x5, [], &(0x7f0000000000)={0x9b090d, 0x7ff, [], @value64=0x2}}) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000001c0)={0x71, 0x0, 0x1ff80000, "b9d80265c3e984628061c913bd0d8dac131f6dbc3677983bb95850c2dac41365e8943b81a2f00f6c9e4ecc10b1b4085ad9c14f8acac01aed81cf8499f9f9d034bd674580b74f917d21026e5967026396089a50ba224d522acf8acaea7706832726e6ee5efed34c1d1870b38b9d3599704d"}) 13:57:10 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0xeffdffff) [ 650.178664] ? trace_hardirqs_off+0x310/0x310 [ 650.183180] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 650.188209] ? prepare_exit_to_usermode+0x291/0x3b0 [ 650.193236] ? page_fault+0x8/0x30 [ 650.196791] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 650.201647] ? page_fault+0x8/0x30 [ 650.205194] page_fault+0x1e/0x30 [ 650.208650] RIP: 0033:0x40740d [ 650.211860] Code: 0f 1f 44 00 00 c6 44 24 0e 06 48 c7 04 24 10 00 00 00 e9 56 ff ff ff e8 91 46 05 00 90 41 55 41 54 55 53 48 81 ec a8 1b 00 00 <48> 89 74 24 18 48 89 7c 24 30 64 48 8b 34 25 28 00 00 00 48 89 b4 [ 650.230781] RSP: 002b:00007f302a7c40a0 EFLAGS: 00010206 [ 650.236162] RAX: 0000000000407400 RBX: 00007f302a7c5c90 RCX: 0000000000000000 [ 650.243441] RDX: 0000000020013000 RSI: 0000000000000008 RDI: 0000000000000003 [ 650.250712] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 650.257978] R10: 0000000000000064 R11: 0000000000000000 R12: 00007f302a7c66d4 [ 650.257987] R13: 00000000004c6311 R14: 00000000004db0d0 R15: 0000000000000009 [ 650.278224] syz-executor4 invoked oom-killer: gfp_mask=0x0(), order=0, oom_score_adj=1000 [ 650.295308] CPU: 0 PID: 20085 Comm: syz-executor4 Not tainted 4.20.0+ #396 [ 650.302342] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 650.311775] Call Trace: [ 650.311800] dump_stack+0x1d3/0x2c6 [ 650.311817] ? dump_stack_print_info.cold.1+0x20/0x20 [ 650.311845] dump_header+0x253/0x1239 [ 650.327001] ? mark_held_locks+0x130/0x130 [ 650.331249] ? pagefault_out_of_memory+0x19d/0x19d [ 650.336190] ? mark_held_locks+0x130/0x130 [ 650.340439] ? mark_held_locks+0x130/0x130 [ 650.344680] ? __lock_acquire+0x62f/0x4c20 [ 650.348917] ? should_fail+0x22d/0xd01 [ 650.352813] ? print_usage_bug+0xc0/0xc0 [ 650.356886] ? graph_lock+0x270/0x270 [ 650.360692] ? print_usage_bug+0xc0/0xc0 [ 650.364771] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 650.370317] ? find_held_lock+0x36/0x1c0 [ 650.374393] ? mark_held_locks+0xc7/0x130 [ 650.379092] ? _raw_spin_unlock_irqrestore+0x82/0xd0 [ 650.384208] ? _raw_spin_unlock_irqrestore+0x82/0xd0 [ 650.389318] ? lockdep_hardirqs_on+0x421/0x5c0 [ 650.393901] ? trace_hardirqs_on+0xbd/0x310 [ 650.398216] ? kasan_check_read+0x11/0x20 [ 650.398236] ? ___ratelimit+0x36f/0x655 [ 650.398250] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 650.398264] ? trace_hardirqs_on+0x310/0x310 [ 650.398278] ? lock_downgrade+0x900/0x900 [ 650.398298] ? _raw_spin_unlock_irqrestore+0x6d/0xd0 [ 650.398315] ? ___ratelimit+0xaa/0x655 [ 650.398332] ? idr_get_free+0xf70/0xf70 [ 650.398344] ? kasan_check_read+0x11/0x20 [ 650.398361] ? do_raw_spin_unlock+0xa7/0x330 [ 650.441896] oom_kill_process.cold.27+0x10/0x903 [ 650.446663] ? graph_lock+0x270/0x270 [ 650.450470] ? _raw_spin_unlock+0x2c/0x50 [ 650.454627] ? oom_badness+0xe6/0xaa0 [ 650.458445] ? oom_evaluate_task+0x540/0x540 [ 650.462866] ? find_held_lock+0x36/0x1c0 [ 650.466946] ? out_of_memory+0xcc5/0x1480 [ 650.471096] ? lock_downgrade+0x900/0x900 [ 650.475250] ? check_preemption_disabled+0x48/0x280 [ 650.480255] ? kasan_check_read+0x11/0x20 [ 650.484387] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 650.489666] ? rcu_read_unlock_special+0x370/0x370 [ 650.494591] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 650.499588] ? oom_evaluate_task+0x302/0x540 [ 650.503983] out_of_memory+0x8ba/0x1480 [ 650.507962] ? oom_killer_disable+0x3a0/0x3a0 [ 650.512455] ? pagefault_out_of_memory+0x156/0x19d [ 650.517368] ? __ww_mutex_check_waiters+0x160/0x160 [ 650.522367] ? kasan_check_read+0x11/0x20 [ 650.526511] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 650.531837] pagefault_out_of_memory+0x178/0x19d [ 650.536589] ? out_of_memory+0x1480/0x1480 [ 650.540812] ? up_read+0x225/0x2c0 [ 650.544337] ? up_read_non_owner+0x100/0x100 [ 650.548743] mm_fault_error+0x1bd/0x390 [ 650.552713] ? find_vma+0x34/0x190 [ 650.556239] __do_page_fault+0xc56/0xd70 [ 650.560282] ? __ia32_sys_read+0xb0/0xb0 [ 650.564330] do_page_fault+0xf2/0x7e0 [ 650.568136] ? vmalloc_sync_all+0x30/0x30 [ 650.572280] ? error_entry+0x70/0xd0 [ 650.575979] ? trace_hardirqs_off_caller+0xbb/0x310 [ 650.580976] ? trace_hardirqs_on_caller+0xc0/0x310 [ 650.585898] ? syscall_return_slowpath+0x5e0/0x5e0 [ 650.590823] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 650.595653] ? trace_hardirqs_on_caller+0x310/0x310 [ 650.600657] ? trace_hardirqs_off+0x310/0x310 [ 650.605155] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 650.610182] ? prepare_exit_to_usermode+0x291/0x3b0 [ 650.615196] ? page_fault+0x8/0x30 [ 650.618723] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 650.623551] ? page_fault+0x8/0x30 [ 650.627087] page_fault+0x1e/0x30 [ 650.630540] RIP: 0033:0x40740d [ 650.633717] Code: 0f 1f 44 00 00 c6 44 24 0e 06 48 c7 04 24 10 00 00 00 e9 56 ff ff ff e8 91 46 05 00 90 41 55 41 54 55 53 48 81 ec a8 1b 00 00 <48> 89 74 24 18 48 89 7c 24 30 64 48 8b 34 25 28 00 00 00 48 89 b4 [ 650.652605] RSP: 002b:00007f302a7c40a0 EFLAGS: 00010206 [ 650.657953] RAX: 0000000000407400 RBX: 00007f302a7c5c90 RCX: 0000000000000000 [ 650.665215] RDX: 0000000020013000 RSI: 0000000000000008 RDI: 0000000000000003 [ 650.672478] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 650.679738] R10: 0000000000000064 R11: 0000000000000000 R12: 00007f302a7c66d4 [ 650.686998] R13: 00000000004c6311 R14: 00000000004db0d0 R15: 0000000000000009 [ 650.695971] Mem-Info: [ 650.698506] active_anon:123491 inactive_anon:187 isolated_anon:0 [ 650.698506] active_file:7673 inactive_file:38032 isolated_file:0 [ 650.698506] unevictable:0 dirty:242 writeback:0 unstable:0 [ 650.698506] slab_reclaimable:13223 slab_unreclaimable:106402 [ 650.698506] mapped:55378 shmem:243 pagetables:1402 bounce:0 [ 650.698506] free:1240384 free_pcp:576 free_cma:0 [ 650.743448] Node 0 active_anon:493964kB inactive_anon:748kB active_file:30552kB inactive_file:152128kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:221512kB dirty:964kB writeback:0kB shmem:972kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 108544kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 650.775594] Node 1 active_anon:0kB inactive_anon:0kB active_file:140kB inactive_file:0kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:0kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 650.801515] Node 0 DMA free:15908kB min:220kB low:272kB high:324kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 650.828634] lowmem_reserve[]: 0 2537 2539 2539 [ 650.833231] Node 0 DMA32 free:1159308kB min:36092kB low:45112kB high:54132kB active_anon:493964kB inactive_anon:748kB active_file:30552kB inactive_file:152128kB unevictable:0kB writepending:964kB present:3129332kB managed:2601676kB mlocked:0kB kernel_stack:7680kB pagetables:5608kB bounce:0kB free_pcp:2356kB local_pcp:1136kB free_cma:0kB [ 650.863377] lowmem_reserve[]: 0 0 2 2 [ 650.867278] Node 0 Normal free:1844kB min:2080kB low:2088kB high:2096kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:786432kB managed:2460kB mlocked:0kB kernel_stack:96kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 650.893986] lowmem_reserve[]: 0 0 0 0 [ 650.897855] Node 1 Normal free:3784372kB min:53760kB low:67200kB high:80640kB active_anon:0kB inactive_anon:0kB active_file:140kB inactive_file:0kB unevictable:0kB writepending:4kB present:3932160kB managed:3870184kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 650.925521] lowmem_reserve[]: 0 0 0 0 [ 650.929336] Node 0 DMA: 1*4kB (U) 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15908kB [ 650.942940] Node 0 DMA32: 1575*4kB (UME) 3357*8kB (UME) 3052*16kB (UME) 1663*32kB (UME) 1129*64kB (UME) 230*128kB (UME) 37*256kB (UME) 21*512kB (UME) 7*1024kB (UM) 5*2048kB (M) 216*4096kB (M) = 1159268kB [ 650.961747] Node 0 Normal: 3*4kB (ME) 5*8kB (ME) 2*16kB (ME) 1*32kB (M) 1*64kB (E) 1*128kB (M) 2*256kB (ME) 0*512kB 1*1024kB (E) 0*2048kB 0*4096kB = 1844kB [ 650.975899] Node 1 Normal: 67*4kB (UE) 247*8kB (UE) 255*16kB (UE) 72*32kB (UME) 14*64kB (UME) 7*128kB (U) 4*256kB (UM) 7*512kB (UME) 3*1024kB (ME) 1*2048kB (U) 919*4096kB (M) = 3784372kB [ 650.992751] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 651.001629] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 651.010548] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 651.019462] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 651.028098] 45947 total pagecache pages [ 651.032080] 0 pages in swap cache [ 651.035582] Swap cache stats: add 0, delete 0, find 0/0 [ 651.040937] Free swap = 0kB [ 651.043949] Total swap = 0kB [ 651.047011] 1965979 pages RAM [ 651.050108] 0 pages HighMem/MovableOnly [ 651.054061] 343422 pages reserved [ 651.057554] 0 pages cma reserved [ 651.060913] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=syz4,mems_allowed=0-1,global_oom,task_memcg=/syz1,task=syz-executor1,pid=14146,uid=0 [ 651.075034] Out of memory: Kill process 14146 (syz-executor1) score 1005 or sacrifice child [ 651.083580] Killed process 14146 (syz-executor1) total-vm:70796kB, anon-rss:2224kB, file-rss:33744kB, shmem-rss:0kB 13:57:11 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r4, &(0x7f0000013000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xf5) 13:57:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x3, 0x40a000) ioctl$sock_bt_cmtp_CMTPGETCONNINFO(r1, 0x800443d3, &(0x7f00000000c0)={{0x8001, 0x10000, 0x8000, 0x4, 0x10000, 0x9}, 0xd67, 0x0, 0x2}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x0, 0x0}) 13:57:11 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) 13:57:11 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1, 0x0, 0x0, 0x100000000000000}, 0x0) 13:57:11 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x1c00) 13:57:11 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) sendmsg$nl_netfilter(r0, &(0x7f0000000740)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x5000}, 0xc, &(0x7f0000000700)={&(0x7f0000000180)={0x558, 0x0, 0xf, 0x300, 0x70bd2a, 0x25dfdbfc, {0x7, 0x0, 0x3}, [@generic="6ab3d24f43913689ec2bc9d277160d3bcef65c7da6f034d3bf48426692810e437ae2170c3d5b8356144b9046ddba44b1774164e697e99f8ec3642bf3f888345519a1a7f0e918787238777a6639eb69b2f4251fd1f119e5110c9319732437665b4c9cba30652d3e6036f7bcf5c093229594dc186acb5b165c1b1eaa65d50f9d5c684b3a66e307b83e2f23601d1fa802c5198addd41a72183b6c9bb370affb76186af3aedf9205c9b6029cb8cd", @generic="64b43bcd82bdf15a4c6476183d9feb025e71544f810c3b21af26d53b62f2e6c73799aac75a4b6a4395e558629bb3833d06c29a25ab6d1e553998fbfb36831bca140b3b525420aa0dabe3a6507072dc647de5b40701b02d1aef4f46e50f889e935d31dacc7cadd8308ca1b2cf8d9545a564344cbda088481bb4fc7dc6ae535b0a8e42a40e7ff4eccb917061aa680f22c84e171e06bad77ea7159ba53fa3688827403e2877f6a521c2095b11b81e758cd07823aefe2137b5026974", @nested={0x314, 0x82, [@generic="a5d79cef500cb79a5736fb7c7053ec6e4b26c8ba6d767587c3a5b6410c8af0aec8d32cb0f2e5b718a2d2f9d6f22355d2c2aab98e9d22c917fdd9ae738dfe9ab5531be1d12682b8d9213e8bdb21bbe1bcc5a76a7ce6ccc83d209bcfbf4310517f18b2a487236918526eae0503cdd725d783c7b842c7df0adfb6eab41cf028a53997908a1f0785d69abc0c1dbb18bd93dad0ad371c3d7b70fe69207f", @generic="775da7aea837319b667cef8f9c4f791bd41358b838dd86d63c99de06fa2a1b8445a7b94f1cd98569d4e820f3b44a1f8c5b84c6243c03dafbb35b3b8b255243fb030001c79c9dd0b13aba3491f31178bb87dcaaae3424e3303482c79e6e7f2ca5126b89c2b2b6f386659625bfd61f6cfa8471f2b9222d362dc6fc4cce785f63073d8bfc0e8af4ad66ffaadcdc465e31f5a26820004aa7172cd021cb96f818a8e43c3ae4ce3dd202c15930734a7669a4f22cd91689139dc6e616db6eb51aa445ed16f719e0c514e1bcdb669a88e70a2527180abe47d605a542121b188738e3d7e84a3d13f0626bb276da81f721de63fc822e6fef992c42ec", @generic="ff7047ea3ed6aeed273424505add66735ddb74cf7d9033980ccd83e39923812eb3893a63aac58517a93e119a783a5a7aa0a1a01fd589a39ae1524b180f08859efd2b2f069f4036682faaca8c744dd718d8213f2d54f4291eef510e82ac594fce17666bc08e2593b7684b6104b27875dae6fbea2c1fb4ed2d208540786547e26f256764e49f61e64f03631bcc9645508f", @generic="7e1a3a86e4a098b4ca9816ef26ea1b05be54d71665727c1103c58cb8a199ee45f63adf993fa4585b32b689a39e247aaa3291928ed2b0b27864aa7e816d116a328af7325b611ee19a338b57439f0c51caf39415d5e0ddebf8c8ea5c5bb4ed125e2a062dbb0ce8cc7e008d7c8ed85aa6946c629738818ad16b52c5a543c1ce8a4b69a61f92749491b10a1c231b870e2c9ab8dfce0f4b4bb155a74db276f0dcb98c083bcf9c08df6280d8798319106555be90487bc23a2a6b71539de5a341aa1be748c3321b071666c70808e44b4139581dc224cb51d0cc97883f1d13d53f5eb4b6e5db6239ec70a128e8daee1154"]}, @nested={0x4, 0x89}, @typed={0x14, 0x21, @ipv6=@dev={0xfe, 0x80, [], 0xf}}, @typed={0x4, 0x8e}, @generic="7cd2d124b8de2c7d79dbb4c114a6a1f434fa0e8040086e719b4c4b2301560f4eb91b20c85dfa9a162d1503818cd3e0af91717ace3c89c9969235bd5770a8d548998a01207b52affce9377ef6e0289210f5bb7e264be52b060e43689fda269f80c2e7ac0122d110395f8f704e0b9e6e3139db80b277e92e9156bc17ab545aa692c7f889b5", @typed={0x28, 0x4d, @binary="b6fbe95fcd8f78149c64f1850daff842ce334f5404113243b8bb1376eab2d457ae"}]}, 0x558}}, 0x40000) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$VHOST_GET_VRING_ENDIAN(r0, 0x4008af14, &(0x7f00000000c0)={0x3, 0x7}) ioctl$EVIOCGABS3F(r0, 0x8018457f, &(0x7f0000000000)=""/186) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) [ 651.096782] oom_reaper: reaped process 14146 (syz-executor1), now anon-rss:0kB, file-rss:32784kB, shmem-rss:0kB [ 651.175469] binder: 20122:20125 Acquire 1 refcount change on invalid ref 0 ret -22 [ 651.207714] binder: 20122:20125 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 13:57:11 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) 13:57:11 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) [ 651.236745] binder: 20122:20136 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 13:57:11 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1, 0x0, 0x0, 0xf00000000000000}, 0x0) 13:57:11 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r4, &(0x7f0000013000/0x18000)=nil, 0x0, 0x14, 0x0, 0x0, 0xf5) [ 651.305400] binder: 20122:20125 Acquire 1 refcount change on invalid ref 0 ret -22 [ 651.324932] binder: 20122:20138 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 13:57:11 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) [ 651.420722] binder: 20122:20125 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 13:57:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x0, 0x0}) lstat(&(0x7f0000000200)='./file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0, 0x0}, &(0x7f0000000180)=0xc) setregid(r1, r2) 13:57:11 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1, 0x0, 0x0, 0x8000000}, 0x0) 13:57:11 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x2, 0x0) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f0000000140)) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x2, &(0x7f0000ffd000/0x1000)=nil) fallocate(r1, 0x0, 0x0, 0x5c0d) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000080)={0x0, 0x1c, &(0x7f0000000040)=[@in6={0xa, 0x4e20, 0x9, @mcast2, 0x1}]}, &(0x7f00000000c0)=0x10) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r1, 0x84, 0x6c, &(0x7f0000000240)={r2, 0xe4, "d1191a5eef24736e5f89b0ec3b801104d3009cf072f22c589cae5c171590dc65e6a8820cf73558550a6585d07ccd04a2cbed612101840218b0bb49921caa7326c3b11e358def8d31e90a979506daeacad4b5d8b6b88beaa1584414bba1d63ea291ac91f57c77425bafdd2d5fb7c6b01b524cf875833fa9740301ff452dfd5cac44b1e6b4d4ed45d34501f666d5b666076962a3b00ef3f7c8d4d9901d4155a0522f47685945ab5ab5243c45ce07b3124878538e2ba96b1cf25471a8824915daa383dfaf797b1f47d4bf8fe09bd1ca1cc1d7767309c162fbddf4b30bff9d41087a1ddcfa04"}, &(0x7f0000000100)=0xec) socketpair$unix(0x1, 0x804, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) socket$inet6(0xa, 0x800, 0x2) r5 = getpgid(0xffffffffffffffff) perf_event_open(&(0x7f0000000440)={0x7, 0x70, 0xfffffffffffffff7, 0x1, 0x8, 0x4, 0x0, 0xb4, 0xa0, 0x8, 0x3f, 0x0, 0x81, 0xc22e, 0x100000000, 0x1, 0x2, 0x80000000, 0x0, 0x180, 0x6, 0x7ff, 0x2, 0x9, 0x100000001, 0x8, 0x6, 0x8, 0x7c5, 0x9, 0x2, 0x8001, 0x3f, 0x25, 0x200, 0x0, 0x200, 0x1, 0x0, 0x655a, 0x2, @perf_bp={&(0x7f0000000400), 0x5}, 0x20000, 0x10001, 0x7fffffff, 0x1, 0xfffffffffffff968, 0x372, 0x7}, r5, 0xe, r1, 0x8) fsetxattr$security_evm(r3, &(0x7f0000000340)='security.evm\x00', &(0x7f00000003c0)=@ng={0x4, 0xe, 'O4'}, 0x4, 0x3) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:57:11 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) 13:57:12 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1, 0x0, 0x0, 0xf00}, 0x0) [ 651.689754] binder: 20163:20167 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 651.752435] binder: BINDER_SET_CONTEXT_MGR already set [ 651.783302] binder: 20163:20171 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 [ 651.805976] binder: 20163:20167 ioctl 40046207 0 returned -16 13:57:12 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x700) 13:57:12 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r4, &(0x7f0000013000/0x18000)=nil, 0x0, 0x600000000000000, 0x0, 0x0, 0xf5) 13:57:12 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) 13:57:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x3) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$adsp(&(0x7f00000000c0)='/dev/adsp#\x00', 0x8, 0x10000) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f0000000200)=0x9, 0x4) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000100), &(0x7f0000000140)=0x14) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f00000001c0)={r1, r1}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="051a5ab8444ffb6304400010363b93ed0fa2856427bb"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000020a4"], 0x0, 0x0, 0x0}) 13:57:12 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1, 0x0, 0x0, 0x2}, 0x0) 13:57:12 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r0, 0xc0a85322, &(0x7f0000000000)) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:57:12 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) [ 651.954143] binder: 20185:20190 unknown command -1202054651 [ 651.977424] binder: 20185:20190 ioctl c0306201 20000000 returned -22 [ 652.017703] binder: 20185:20198 BC_CLEAR_DEATH_NOTIFICATION invalid ref 536870912 [ 652.076877] binder: BINDER_SET_CONTEXT_MGR already set [ 652.094893] binder: 20185:20190 ioctl 40046207 0 returned -16 13:57:12 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$sequencer(0xffffffffffffff9c, 0x0, 0x4000, 0x0) 13:57:12 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1, 0x0, 0x0, 0xf}, 0x0) 13:57:12 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000040)={0x7, 0xfffffffffffffe00, 0x0, {r1, r2+10000000}, 0x6, 0x8}) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) [ 652.131873] binder: 20185:20206 unknown command -1202054651 [ 652.170081] binder: 20185:20206 ioctl c0306201 20000000 returned -22 13:57:12 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r4, &(0x7f0000013000/0x18000)=nil, 0x0, 0x80ffff, 0x0, 0x0, 0xf5) 13:57:12 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$sequencer(0xffffffffffffff9c, 0x0, 0x4000, 0x0) [ 652.264798] binder: 20185:20190 BC_CLEAR_DEATH_NOTIFICATION invalid ref 536870912 13:57:12 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x100000000000000) 13:57:12 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000000)={0xffffffffffffffff}, 0x117}}, 0x20) write$RDMA_USER_CM_CMD_CONNECT(r0, &(0x7f0000000140)={0x6, 0x118, 0xfa00, {{0x3a9bce84, 0x0, "9e9a16cf22a18252658791ea2b9cac69176364bde147d74afcd7f8e9c2bc6747263c5d0ade70814a3e693274d8de708e873887053ec2dbc171b7d889a32ccbcedb30104158d1fb80aafd57f7d9f905862f397e0eb3b0ffced2bdebe205510659380c537e293808d1fb43f105d0e0affbbdff7a38a748201715c7206995ddf1cb47c0073ce35ca2b6e9a711ee3961e5e671e8bfdee59194cbf69948f7dd7d37fb3bc6e1b77995e43f7d9278620584c8a8d308dd784efa3907ab3024467dcce128df4ceb8f3eeafa84b907f71b9e33fc19bce3a526a50ba6cd1dc03c7a1d5e4112c85ed5a3cd92849c31964fdb31936bf7e4bc570d05f2f5e5f5c1ec684a2587e2", 0x80, 0x2, 0xfffffffffffffffc, 0x2, 0x0, 0x5, 0x9, 0x1}, r1}}, 0x120) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) chmod(&(0x7f0000000080)='./bus\x00', 0x1) 13:57:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = open(&(0x7f0000000140)='./file0\x00', 0x20000, 0x20) ioctl$KVM_SET_TSS_ADDR(r1, 0xae47, 0xd000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x0, 0x0}) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x480000, 0x0) getsockopt$inet6_dccp_int(r2, 0x21, 0x10, &(0x7f00000000c0), &(0x7f0000000100)=0x4) setsockopt$inet6_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000000200)={0x41}, 0x225) 13:57:12 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1, 0x0, 0x0, 0x200000000000000}, 0x0) 13:57:12 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$sequencer(0xffffffffffffff9c, 0x0, 0x4000, 0x0) 13:57:12 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r4, &(0x7f0000013000/0x18000)=nil, 0x0, 0x40000001, 0x0, 0x0, 0xf5) 13:57:13 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1, 0x0, 0x0, 0x800000000000000}, 0x0) [ 652.652546] binder: 20231:20232 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:57:13 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x0, 0x0) [ 652.721984] binder: BINDER_SET_CONTEXT_MGR already set [ 652.754820] binder: 20231:20232 ioctl 40046207 0 returned -16 13:57:13 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000000), &(0x7f0000000040)=0x4) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) [ 652.794455] binder: 20231:20232 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 00000000000000a4 13:57:13 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x0, 0x0) 13:57:13 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1, 0x0, 0x0, 0xf000000}, 0x0) 13:57:13 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r4, &(0x7f0000013000/0x18000)=nil, 0x0, 0xc000000000, 0x0, 0x0, 0xf5) 13:57:13 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x900000000000000) 13:57:13 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) open(&(0x7f0000000000)='./bus\x00', 0xa00c0, 0x20) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:57:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440000000000e630c40000000014e25df72282c661667136b0ec1655913773a532b6adf7ac3b8409e"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x0, 0x0}) 13:57:13 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x0, 0x0) 13:57:13 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1, 0x0, 0x0, 0x1000000}, 0x0) 13:57:13 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r4, &(0x7f0000013000/0x18000)=nil, 0x0, 0x1010000, 0x0, 0x0, 0xf5) [ 653.309557] binder: 20281:20285 BC_REQUEST_DEATH_NOTIFICATION invalid ref 16777216 13:57:13 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cpuset.memory_pressure\x00', 0x0, 0x0) setsockopt$bt_BT_SNDMTU(r0, 0x112, 0xc, &(0x7f0000000100)=0x4, 0x2) r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(r0, 0x28, 0x6, &(0x7f0000000180)={0x0, 0x2710}, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f0000009200000000"], 0x0, 0x0, 0x0}) r2 = msgget$private(0x0, 0x40) msgctl$MSG_STAT(r2, 0xb, &(0x7f0000000140)=""/16) r3 = getpgid(0x0) lookup_dcookie(0xdbb, &(0x7f00000001c0)=""/24, 0x18) r4 = getpgid(r3) r5 = getpgid(0x0) tgkill(r4, r5, 0x41) ioctl$PPPIOCSMRU(r1, 0x40047452, &(0x7f0000000040)=0x9) 13:57:13 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1, 0x0, 0x0, 0x2000000}, 0x0) [ 653.367152] binder: 20281:20292 BC_CLEAR_DEATH_NOTIFICATION death notification not active 13:57:13 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) ioctl$BLKBSZSET(r0, 0x40081271, &(0x7f0000000000)=0x119) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) [ 653.442012] binder: BINDER_SET_CONTEXT_MGR already set [ 653.472643] binder: 20281:20295 BC_REQUEST_DEATH_NOTIFICATION invalid ref 16777216 [ 653.481955] binder: BINDER_SET_CONTEXT_MGR already set 13:57:13 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r4, &(0x7f0000013000/0x18000)=nil, 0x0, 0x1000000000000, 0x0, 0x0, 0xf5) 13:57:13 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) socketpair$unix(0x1, 0x8, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendfile(r2, r1, 0x0, 0xe0a6) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000200), &(0x7f0000000240)=0x4) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000000)=0x7, 0x4) ioctl$VHOST_GET_VRING_BASE(r0, 0xc008af12, &(0x7f00000002c0)) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f00000001c0)=0x0) ioctl$DRM_IOCTL_RES_CTX(r0, 0xc0106426, &(0x7f00000000c0)={0x9, &(0x7f0000000400)=[{}, {}, {}, {}, {}, {}, {}, {}, {0x0}]}) ioctl$DRM_IOCTL_NEW_CTX(r0, 0x40086425, &(0x7f0000000480)={r4, 0x2}) ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f0000000280)=r3) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x399e2cf21287b954}, 0xc, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="14000000", @ANYRES16=r5, @ANYBLOB="000328bd7000fcdbdf25050000000c128c7c0a7fb4cf49cd76c301d34e7b17c2a5ed370ace9269a842018837adb5685ecae0203aeaec6df164021ec41d34b9a32123f272f4d609ebb67b0f3c586b59acf3f5dd2e084a41677d6b893d12f2ab10b54fd4d8e09652a5cdcf8c2d9252a69d734f879effb6b2026dbe2601be637db898bad619d46bf3acb0f33bba14c084f5c5b274ec4502c84387de0bd8c282ce3ca35d7004d2391dd5efc236bfe8b9b50ffcc93028de992d1a5b7113aa85ecfca8e4ab8d668165544b183b0b1f21c3d69910f7f22fb0af88386cfbe540bb7efdfeb61a9b20c62636"], 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) [ 653.534462] binder: 20296:20297 ioctl 40046207 0 returned -16 [ 653.536027] binder: 20296:20306 unknown command 15 [ 653.547810] binder: 20281:20292 ioctl 40046207 0 returned -16 13:57:13 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 653.614328] binder: 20296:20306 ioctl c0306201 20000080 returned -22 [ 653.677197] binder: 20296:20297 ioctl 40047452 20000040 returned -22 13:57:14 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0xe000000) 13:57:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$selinux_attr(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/self/attr/exec\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x10000, 0x0) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffff9c, 0x84, 0x73, &(0x7f00000000c0)={0x0, 0x8, 0x20, 0x7f, 0x80000001}, &(0x7f0000000100)=0x18) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000140)={r2, 0x100}, &(0x7f0000000180)=0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630000a401004e39f5a040004100"], 0xffffffffffffffcc, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYRES32=r0], 0x0, 0x0, 0x0}) 13:57:14 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) prctl$PR_SET_UNALIGN(0x6, 0x3) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:57:14 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1, 0x0, 0x0, 0x0}, 0x0) 13:57:14 executing program 5: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) open(&(0x7f0000000000)='./bus\x00', 0xa00c0, 0x20) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 13:57:14 executing program 4: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r4, &(0x7f0000013000/0x18000)=nil, 0x0, 0x101000000000000, 0x0, 0x0, 0xf5) [ 653.996470] binder: 20328:20330 unknown command 25349 [ 654.002444] binder: 20328:20330 ioctl c0306201 20000000 returned -22 [ 654.021721] binder: 20328:20330 unknown command 3 [ 654.030792] binder: 20328:20330 ioctl c0306201 20000080 returned -22 [ 654.040590] binder: BINDER_SET_CONTEXT_MGR already set 13:57:14 executing program 5 (fault-call:2 fault-nth:0): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) [ 654.052164] binder: 20328:20341 ioctl 40046207 0 returned -16 [ 654.060543] binder: 20328:20341 unknown command 25349 [ 654.070790] binder: 20328:20341 ioctl c0306201 20000000 returned -22 [ 654.079634] binder: 20328:20330 unknown command 5 13:57:14 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) mremap(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x1000, 0x4, &(0x7f0000005000/0x1000)=nil) fallocate(r0, 0x0, 0x0, 0x5c0d) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000140)={&(0x7f0000009000/0x4000)=nil, &(0x7f000000b000/0x1000)=nil, &(0x7f0000005000/0x1000)=nil, &(0x7f0000003000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f000000c000/0x1000)=nil, &(0x7f0000003000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000002000/0x1000)=nil, &(0x7f0000000000)="0617d93ecb109b66e1201418d35bea075883afb34472921f90f74e4e3c27797a64def4215a5dec513d22e2dea88021fae53b5ad4ec7a06ef1874c7c4f757a3a359d3c1b2d52bd65fb154a62569b6b5d50951a87d55fb38a8555d3668c5fbcdf95b34bacb4f7fee63c0964f79585643d3329b1a1fe982ea2df23bd6003ca82fd2067f2fad3c6d4b10f6807917bf50985f50062b41b106ee66879549006895c07a114ea3d70d1d32811b1ea8", 0xab, r1}, 0x68) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r0, 0xc040564a, &(0x7f00000000c0)={0x8, 0x0, 0x2023, 0x7, 0x5, 0x1f, 0x9, 0x1}) [ 654.097351] binder: 20328:20330 ioctl c0306201 20000080 returned -22 13:57:14 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000180)="b7859cb8eec705f2288a933d6e593ae164c990a016726640c522b60bdfedb810", 0x20) r2 = accept$alg(r1, 0x0, 0x0) read(r2, &(0x7f0000000bc0)=""/93, 0x5d) recvmsg(r2, &(0x7f0000d43000)={0x0, 0x0, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0x75}], 0x1, 0x0, 0x0, 0x0}, 0x0) 13:57:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0xfffffffffffffffd) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000180)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000000c0)="2bd3ba1e72ead268f153c8ba21881109e5fc2f798ae2a56099415b599543f438387239b23d4eaed9fb50dad8ff930520ae2aae4df76a691fa20e16a1ff7409fb9508142a09b572075bce39493f825e796316061ee71b19eedef7cea11e65e4727b8754ce1936bebfa5af08b762da74c60c6a243807e6d5363d87f1f7d85a7ab9bb8cbb33035e8069e60c9c", 0x8b, r0}, 0x68) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) fsetxattr$trusted_overlay_origin(r0, &(0x7f0000000040)='trusted.overlay.origin\x00', &(0x7f0000000200)='y\x00', 0x2, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f630c4000000000a4"], 0x0, 0x0, 0x0}) [ 654.223721] FAULT_INJECTION: forcing a failure. [ 654.223721] name failslab, interval 1, probability 0, space 0, times 0 [ 654.266305] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: udp4_lib_lookup2+0x7ea/0x7f0 [ 654.277121] CPU: 1 PID: 20340 Comm: syz-executor0 Not tainted 4.20.0+ #396 [ 654.284151] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 654.293507] Call Trace: [ 654.296099] CPU: 0 PID: 20351 Comm: syz-executor5 Not tainted 4.20.0+ #396 [ 654.303125] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 654.312467] Call Trace: [ 654.315064] dump_stack+0x1d3/0x2c6 [ 654.318690] ? dump_stack_print_info.cold.1+0x20/0x20 [ 654.323874] ? find_held_lock+0x36/0x1c0 [ 654.327934] should_fail.cold.4+0xa/0x17 [ 654.331994] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 654.337091] ? lock_downgrade+0x900/0x900 [ 654.341240] ? check_preemption_disabled+0x48/0x280 [ 654.346251] ? find_held_lock+0x36/0x1c0 [ 654.350327] ? find_held_lock+0x36/0x1c0 [ 654.354397] ? ___might_sleep+0x1ed/0x300 [ 654.358537] ? arch_local_save_flags+0x40/0x40 [ 654.363114] ? wait_for_completion+0x8a0/0x8a0 [ 654.367692] __should_failslab+0x124/0x180 [ 654.371927] should_failslab+0x9/0x14 [ 654.376149] kmem_cache_alloc+0x2c4/0x730 [ 654.380314] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 654.385842] ? check_preemption_disabled+0x48/0x280 [ 654.390859] getname_flags+0xd0/0x590 [ 654.394655] getname+0x19/0x20 [ 654.397843] do_sys_open+0x383/0x780 [ 654.401554] ? filp_open+0x80/0x80 [ 654.405091] ? __ia32_sys_read+0xb0/0xb0 [ 654.409145] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 654.414589] __x64_sys_openat+0x9d/0x100 [ 654.418644] do_syscall_64+0x1b9/0x820 [ 654.422528] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 654.427888] ? syscall_return_slowpath+0x5e0/0x5e0 [ 654.432814] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 654.437651] ? trace_hardirqs_on_caller+0x310/0x310 [ 654.442659] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 654.447666] ? prepare_exit_to_usermode+0x291/0x3b0 [ 654.452678] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 654.457520] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 654.462700] RIP: 0033:0x457ec9 [ 654.465889] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 654.484794] RSP: 002b:00007fb774b6bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 654.492502] RAX: ffffffffffffffda RBX: 00007fb774b6bc90 RCX: 0000000000457ec9 [ 654.499759] RDX: 0000000000004000 RSI: 0000000020000000 RDI: ffffffffffffff9c [ 654.507025] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 654.514284] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb774b6c6d4 [ 654.521546] R13: 00000000004c406b R14: 00000000004d6fa8 R15: 0000000000000005 [ 654.530017] Kernel Offset: disabled [ 654.533792] Rebooting in 86400 seconds..