) setsockopt$inet_msfilter(r0, 0x0, 0xa, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) [ 287.105136] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 287.107440] binder: 13925:13938 transaction failed 29189/-3, size 24-8 line 2970 [ 287.110707] __build_skb+0xab/0x430 [ 287.110742] ? skb_try_coalesce+0x1b70/0x1b70 [ 287.110759] ? graph_lock+0x170/0x170 [ 287.110781] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 287.135780] ? check_preemption_disabled+0x48/0x200 [ 287.140806] ? check_preemption_disabled+0x48/0x200 [ 287.145851] build_skb+0x77/0x270 [ 287.148837] binder: send failed reply for transaction 617, target dead [ 287.149320] ? __build_skb+0x430/0x430 [ 287.159871] tun_build_skb.isra.54+0x8a8/0x2230 [ 287.164565] ? tun_device_event+0x1070/0x1070 [ 287.169067] ? perf_trace_lock+0x7a0/0x7a0 [ 287.173318] ? __lock_acquire+0x7ec/0x4ec0 [ 287.177565] ? __lock_acquire+0x7ec/0x4ec0 [ 287.181831] ? mark_held_locks+0x130/0x130 [ 287.186069] ? print_usage_bug+0xc0/0xc0 [ 287.190140] ? print_usage_bug+0xc0/0xc0 [ 287.194203] ? check_preemption_disabled+0x48/0x200 [ 287.199248] ? print_usage_bug+0xc0/0xc0 [ 287.203311] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 287.208850] ? check_preemption_disabled+0x48/0x200 [ 287.213864] ? print_usage_bug+0xc0/0xc0 [ 287.217935] ? __lock_acquire+0x7ec/0x4ec0 [ 287.222186] ? perf_trace_lock+0x7a0/0x7a0 [ 287.226438] ? mark_held_locks+0x130/0x130 [ 287.230698] tun_get_user+0xc5c/0x42a0 [ 287.234598] ? check_preemption_disabled+0x48/0x200 [ 287.239642] ? tun_build_skb.isra.54+0x2230/0x2230 [ 287.244585] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 287.249870] ? rcu_bh_qs+0xc0/0xc0 [ 287.253439] ? aa_file_perm+0x490/0x1060 [ 287.257550] ? find_held_lock+0x36/0x1c0 [ 287.261620] ? tun_get+0x206/0x370 [ 287.265164] ? lock_downgrade+0x900/0x900 [ 287.269314] ? check_preemption_disabled+0x48/0x200 [ 287.274336] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 287.280145] ? kasan_check_read+0x11/0x20 [ 287.284332] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 287.289610] ? rcu_bh_qs+0xc0/0xc0 [ 287.293338] ? tun_get+0x22d/0x370 [ 287.296883] ? tun_chr_close+0x180/0x180 [ 287.300947] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 287.305882] ? common_file_perm+0x236/0x7f0 [ 287.310224] tun_chr_write_iter+0xb9/0x154 [ 287.314514] do_iter_readv_writev+0x8b0/0xa80 [ 287.319035] ? vfs_dedupe_file_range+0x670/0x670 [ 287.323796] ? apparmor_file_permission+0x24/0x30 [ 287.328660] ? rw_verify_area+0x118/0x360 [ 287.332821] do_iter_write+0x185/0x5f0 [ 287.336721] ? iov_iter_get_pages+0x1210/0x1210 [ 287.341393] ? proc_cwd_link+0x1d0/0x1d0 [ 287.345470] ? graph_lock+0x170/0x170 [ 287.349284] compat_writev+0x233/0x410 [ 287.353192] ? do_pwritev+0x280/0x280 [ 287.356998] ? fget_raw+0x20/0x20 [ 287.360476] ? wait_for_completion+0x8a0/0x8a0 [ 287.365069] ? __lock_is_held+0xb5/0x140 [ 287.369147] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 287.374695] ? __fdget_pos+0xde/0x200 [ 287.378504] ? __fdget_raw+0x20/0x20 [ 287.382218] ? __sb_end_write+0xd9/0x110 [ 287.386295] do_compat_writev+0x119/0x250 [ 287.390452] ? compat_writev+0x410/0x410 [ 287.394524] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 287.399981] ? mm_fault_error+0x380/0x380 [ 287.404142] __ia32_compat_sys_writev+0x74/0xb0 [ 287.408819] do_fast_syscall_32+0x34d/0xfb2 [ 287.413151] ? do_int80_syscall_32+0x890/0x890 [ 287.417740] ? entry_SYSENTER_compat+0x68/0x7f [ 287.422330] ? trace_hardirqs_off_caller+0xbb/0x310 [ 287.427352] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 287.432199] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 287.437049] ? trace_hardirqs_on_caller+0x310/0x310 [ 287.442071] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 287.447093] ? prepare_exit_to_usermode+0x291/0x3b0 [ 287.452135] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 287.456996] entry_SYSENTER_compat+0x70/0x7f [ 287.461415] RIP: 0023:0xf7ffcca9 [ 287.464790] Code: 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 0c 24 c3 8b 1c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 287.483697] RSP: 002b:00000000f5ff8054 EFLAGS: 00000292 ORIG_RAX: 0000000000000092 [ 287.491420] RAX: ffffffffffffffda RBX: 00000000000000f0 RCX: 00000000f5ff80a4 [ 287.498696] RDX: 0000000000000001 RSI: 0000000020000040 RDI: 0000000000000003 [ 287.505966] RBP: 00000000f5ff8168 R08: 0000000000000000 R09: 0000000000000000 [ 287.513235] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 287.520505] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 287.536093] CPU: 0 PID: 13932 Comm: syz-executor2 Not tainted 4.19.0-rc3+ #142 [ 287.543476] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 287.552831] Call Trace: [ 287.555441] dump_stack+0x1c4/0x2b4 15:56:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x2000000, 0x10, r1, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) [ 287.559084] ? dump_stack_print_info.cold.2+0x52/0x52 [ 287.562636] binder: undelivered TRANSACTION_ERROR: 29189 [ 287.564308] should_fail.cold.4+0xa/0x17 [ 287.564334] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 287.564361] ? graph_lock+0x170/0x170 [ 287.564387] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 287.564416] ? graph_lock+0x170/0x170 [ 287.592121] ? graph_lock+0x170/0x170 [ 287.595942] ? find_held_lock+0x36/0x1c0 [ 287.600049] ? ___might_sleep+0x1ed/0x300 [ 287.604219] ? arch_local_save_flags+0x40/0x40 15:56:45 executing program 3 (fault-call:0 fault-nth:2): syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 287.609044] ? trace_hardirqs_on+0xbd/0x310 [ 287.613380] ? _raw_spin_unlock_bh+0x30/0x40 [ 287.617830] __should_failslab+0x124/0x180 [ 287.622090] should_failslab+0x9/0x14 [ 287.625915] kmem_cache_alloc_node+0x26e/0x730 [ 287.630517] ? __local_bh_enable_ip+0x160/0x260 [ 287.631334] binder: release 13947:13949 transaction 622 out, still active [ 287.635200] ? _raw_spin_unlock_bh+0x30/0x40 [ 287.635226] __alloc_skb+0x119/0x770 [ 287.635249] ? skb_scrub_packet+0x490/0x490 [ 287.635273] ? netlink_insert+0x15a/0x3f0 [ 287.635296] ? __netlink_insert+0x13b0/0x13b0 [ 287.635318] ? compat_rw_copy_check_uvector+0x349/0x440 [ 287.642290] binder: unexpected work type, 4, not freed [ 287.646654] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 287.646673] ? netlink_autobind.isra.34+0x232/0x310 [ 287.646707] netlink_sendmsg+0xb29/0xfc0 [ 287.646723] ? move_addr_to_kernel.part.18+0xc6/0x100 [ 287.646750] ? netlink_unicast+0x760/0x760 [ 287.646768] ? aa_sock_msg_perm.isra.12+0xba/0x160 [ 287.646789] ? apparmor_socket_sendmsg+0x29/0x30 [ 287.663082] binder: invalid inc weak node for 623 [ 287.663450] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 287.683174] binder: undelivered TRANSACTION_COMPLETE [ 287.684615] ? security_socket_sendmsg+0x94/0xc0 [ 287.684637] ? netlink_unicast+0x760/0x760 [ 287.684661] sock_sendmsg+0xd5/0x120 [ 287.684698] ___sys_sendmsg+0x7fd/0x930 [ 287.698824] binder: 13947:13949 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 287.703070] ? find_held_lock+0x36/0x1c0 [ 287.703099] ? copy_msghdr_from_user+0x580/0x580 [ 287.703121] ? lock_downgrade+0x900/0x900 [ 287.703142] ? proc_fail_nth_write+0x9e/0x210 [ 287.703166] ? __fget_light+0x2e9/0x430 [ 287.718278] ? fget_raw+0x20/0x20 [ 287.742374] FAULT_INJECTION: forcing a failure. [ 287.742374] name failslab, interval 1, probability 0, space 0, times 0 [ 287.747727] ? kasan_check_write+0x14/0x20 [ 287.747749] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 287.747779] ? wait_for_completion+0x8a0/0x8a0 [ 287.747808] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 287.747832] ? sockfd_lookup_light+0xc5/0x160 [ 287.807756] __sys_sendmsg+0x11d/0x280 [ 287.811660] ? __ia32_sys_shutdown+0x80/0x80 [ 287.816083] ? __sb_end_write+0xd9/0x110 [ 287.820157] ? fput+0x130/0x1a0 [ 287.823452] ? do_fast_syscall_32+0x150/0xfb2 [ 287.827954] ? do_fast_syscall_32+0x150/0xfb2 [ 287.832470] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 287.837929] ? mm_fault_error+0x380/0x380 [ 287.842090] __ia32_compat_sys_sendmsg+0x7a/0xb0 [ 287.846887] do_fast_syscall_32+0x34d/0xfb2 [ 287.851220] ? do_int80_syscall_32+0x890/0x890 [ 287.855813] ? entry_SYSENTER_compat+0x68/0x7f [ 287.860402] ? trace_hardirqs_off_caller+0xbb/0x310 [ 287.865443] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 287.870313] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 287.875162] ? trace_hardirqs_on_caller+0x310/0x310 [ 287.880213] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 287.885263] ? prepare_exit_to_usermode+0x291/0x3b0 [ 287.890291] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 287.895152] entry_SYSENTER_compat+0x70/0x7f [ 287.899562] RIP: 0023:0xf7fc6ca9 [ 287.902937] Code: 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 0c 24 c3 8b 1c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 287.921839] RSP: 002b:00000000f5fc20cc EFLAGS: 00000296 ORIG_RAX: 0000000000000172 [ 287.929558] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000020000240 [ 287.936827] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 287.944095] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 287.951366] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 287.958638] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 287.965941] CPU: 1 PID: 13956 Comm: syz-executor3 Not tainted 4.19.0-rc3+ #142 [ 287.973308] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 287.982662] Call Trace: [ 287.985267] dump_stack+0x1c4/0x2b4 [ 287.988916] ? dump_stack_print_info.cold.2+0x52/0x52 [ 287.994125] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 287.999676] ? ip_vs_in_icmp+0x289/0x2ad0 [ 288.003840] ? fib_multipath_hash+0x1090/0x1090 [ 288.008535] should_fail.cold.4+0xa/0x17 [ 288.012619] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 288.017731] ? __lock_acquire+0x7ec/0x4ec0 [ 288.021977] ? graph_lock+0x170/0x170 [ 288.025807] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 288.031373] ? check_preemption_disabled+0x48/0x200 [ 288.036427] ? debug_smp_processor_id+0x1c/0x20 [ 288.041108] ? perf_trace_lock_acquire+0x15b/0x800 [ 288.046042] ? graph_lock+0x170/0x170 [ 288.046068] ? perf_trace_lock+0x7a0/0x7a0 [ 288.046104] ? ip_vs_proto_data_get+0x12e/0x170 [ 288.058807] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 288.064366] __should_failslab+0x124/0x180 [ 288.068631] should_failslab+0x9/0x14 [ 288.072463] kmem_cache_alloc+0x47/0x730 [ 288.076541] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 288.082097] ? ip_mc_sf_allow+0xdb/0x930 [ 288.086174] ? lock_acquire+0x1ed/0x520 [ 288.090189] skb_clone+0x1bb/0x500 [ 288.093744] ? lock_release+0x970/0x970 [ 288.097736] ? skb_split+0x11e0/0x11e0 [ 288.101638] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 288.107206] ? ipt_do_table+0xf41/0x1bc0 [ 288.111278] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 288.116830] ? __raw_v4_lookup+0x1ed/0x250 [ 288.121088] raw_local_deliver+0x8fa/0xc3a [ 288.125352] ? raw_rcv+0x550/0x550 [ 288.125722] binder: BINDER_SET_CONTEXT_MGR already set [ 288.128901] ? check_preemption_disabled+0x48/0x200 [ 288.128929] ? kasan_check_read+0x11/0x20 [ 288.128953] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 288.148645] ? rcu_bh_qs+0xc0/0xc0 [ 288.152210] ? ip_local_deliver+0x511/0x750 [ 288.156556] ip_local_deliver_finish+0x315/0xda0 [ 288.161329] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 288.165567] binder: 13947:13966 ioctl 40046207 0 returned -16 [ 288.166618] ? ip_sublist_rcv_finish+0x3f0/0x3f0 [ 288.166640] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 288.166657] ? nf_hook_slow+0x11e/0x1c0 [ 288.166681] ip_local_deliver+0x1e9/0x750 [ 288.166703] ? check_preemption_disabled+0x48/0x200 [ 288.195452] ? ip_call_ra_chain+0x730/0x730 [ 288.199788] ? ip_sublist_rcv_finish+0x3f0/0x3f0 [ 288.204552] ? __lock_is_held+0xb5/0x140 [ 288.204586] ip_rcv_finish+0x1f9/0x300 [ 288.204613] ip_rcv+0xed/0x610 [ 288.215737] ? ip_local_deliver+0x750/0x750 [ 288.220069] ? pvclock_read_flags+0x160/0x160 [ 288.224581] ? ip_rcv_finish_core.isra.15+0x1f40/0x1f40 [ 288.224610] ? lock_acquire+0x1ed/0x520 [ 288.224632] ? netif_receive_skb_internal+0xaa/0x620 [ 288.224658] __netif_receive_skb_one_core+0x14d/0x200 [ 288.224679] ? __netif_receive_skb_core+0x3b60/0x3b60 [ 288.224698] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 288.224718] ? rcu_bh_qs+0xc0/0xc0 [ 288.249570] __netif_receive_skb+0x2c/0x1e0 [ 288.249596] netif_receive_skb_internal+0x12c/0x620 [ 288.249613] ? check_preemption_disabled+0x48/0x200 [ 288.249631] ? dev_cpu_dead+0xa80/0xa80 [ 288.249655] ? rcu_lockdep_current_cpu_online+0x1f0/0x2d0 [ 288.256769] binder: 13947:13959 got transaction to context manager from process owning it [ 288.258457] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 288.258479] ? rcu_pm_notify+0xc0/0xc0 [ 288.258515] netif_receive_skb+0xe5/0x430 [ 288.258541] ? netif_receive_skb_internal+0x620/0x620 [ 288.308034] binder: 13947:13959 transaction failed 29201/-22, size 24-8 line 2846 [ 288.309243] ? find_held_lock+0x36/0x1c0 [ 288.309270] ? tun_rx_batched.isra.55+0x494/0x8c0 [ 288.309292] tun_rx_batched.isra.55+0x4ba/0x8c0 [ 288.309309] ? lockdep_hardirqs_on+0x421/0x5c0 [ 288.309330] ? tun_sock_write_space+0x3a0/0x3a0 [ 288.309351] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 288.309371] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 288.309393] ? check_preemption_disabled+0x48/0x200 [ 288.349080] binder: 13947:13975 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 288.350804] ? tun_get_user+0x3020/0x42a0 [ 288.350824] ? tun_get_user+0x3020/0x42a0 [ 288.350852] tun_get_user+0x2b13/0x42a0 [ 288.350876] ? check_preemption_disabled+0x48/0x200 [ 288.350915] ? tun_build_skb.isra.54+0x2230/0x2230 [ 288.367767] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 288.367788] ? rcu_bh_qs+0xc0/0xc0 [ 288.367824] ? aa_file_perm+0x490/0x1060 [ 288.367859] ? tun_get+0x206/0x370 [ 288.375971] ? lock_downgrade+0x900/0x900 [ 288.375987] ? check_preemption_disabled+0x48/0x200 [ 288.376010] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 288.376029] ? kasan_check_read+0x11/0x20 [ 288.376050] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 288.391055] binder: undelivered TRANSACTION_ERROR: 29201 [ 288.391251] ? rcu_bh_qs+0xc0/0xc0 [ 288.395128] binder: send failed reply for transaction 622, target dead [ 288.398843] ? tun_get+0x22d/0x370 [ 288.398861] ? tun_chr_close+0x180/0x180 [ 288.398879] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 288.398898] ? common_file_perm+0x236/0x7f0 [ 288.398924] tun_chr_write_iter+0xb9/0x154 [ 288.463483] do_iter_readv_writev+0x8b0/0xa80 [ 288.467990] ? vfs_dedupe_file_range+0x670/0x670 [ 288.472751] ? apparmor_file_permission+0x24/0x30 [ 288.477604] ? rw_verify_area+0x118/0x360 [ 288.481794] do_iter_write+0x185/0x5f0 [ 288.485691] ? iov_iter_get_pages+0x1210/0x1210 [ 288.490364] ? proc_cwd_link+0x1d0/0x1d0 [ 288.494438] ? graph_lock+0x170/0x170 [ 288.498253] compat_writev+0x233/0x410 [ 288.502145] ? do_pwritev+0x280/0x280 [ 288.505958] ? fget_raw+0x20/0x20 [ 288.509430] ? wait_for_completion+0x8a0/0x8a0 [ 288.514021] ? __lock_is_held+0xb5/0x140 [ 288.518097] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 288.523634] ? __fdget_pos+0xde/0x200 [ 288.527443] ? __fdget_raw+0x20/0x20 [ 288.531160] ? __sb_end_write+0xd9/0x110 [ 288.535239] do_compat_writev+0x119/0x250 [ 288.539394] ? compat_writev+0x410/0x410 [ 288.543473] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 288.548932] ? mm_fault_error+0x380/0x380 [ 288.553092] __ia32_compat_sys_writev+0x74/0xb0 [ 288.557769] do_fast_syscall_32+0x34d/0xfb2 [ 288.562100] ? do_int80_syscall_32+0x890/0x890 [ 288.566693] ? entry_SYSENTER_compat+0x68/0x7f [ 288.571280] ? trace_hardirqs_off_caller+0xbb/0x310 [ 288.576303] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 288.581149] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 288.585999] ? trace_hardirqs_on_caller+0x310/0x310 [ 288.591018] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 288.596041] ? prepare_exit_to_usermode+0x291/0x3b0 [ 288.601069] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 288.605925] entry_SYSENTER_compat+0x70/0x7f [ 288.610334] RIP: 0023:0xf7ffcca9 [ 288.613705] Code: 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 0c 24 c3 8b 1c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 288.632623] RSP: 002b:00000000f5ff8054 EFLAGS: 00000292 ORIG_RAX: 0000000000000092 [ 288.640333] RAX: ffffffffffffffda RBX: 00000000000000f0 RCX: 00000000f5ff80a4 [ 288.647602] RDX: 0000000000000001 RSI: 0000000020000040 RDI: 0000000000000003 [ 288.654871] RBP: 00000000f5ff8168 R08: 0000000000000000 R09: 0000000000000000 15:56:45 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x19, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) 15:56:45 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000), 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:56:45 executing program 0: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:46 executing program 0: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:46 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x23, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) 15:56:46 executing program 0: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 288.662143] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 288.669418] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 288.684348] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:56:46 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000080)='notify_on_release\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(r0, &(0x7f00000003c0)='cpuset.memory_pressure\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f0000000140), 0x1) getresuid(&(0x7f0000000000)=0x0, &(0x7f0000000040), &(0x7f00000000c0)) stat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$P9_RGETATTR(r2, &(0x7f00000002c0)={0xa0, 0x19, 0x1, {0x1400, {0xa2, 0x2, 0x6}, 0x4, r3, r4, 0x100000000, 0x3f, 0x1, 0x80, 0x8, 0x5, 0x3f, 0xfff, 0x4, 0xfffffffffffffc01, 0xfffffffffffffffc, 0xff3, 0x100000001, 0x100, 0xffff}}, 0xa0) 15:56:46 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:46 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x5, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) 15:56:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR64=&(0x7f0000000040)=ANY=[@ANYBLOB="0004000093210000143d14b72c01"]], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:56:46 executing program 0: syz_emit_ethernet(0x66, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x28, 0x0, 0x0, 0x0, [{}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:46 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x7}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:56:46 executing program 3: syz_emit_ethernet(0x7ffff000, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:46 executing program 5: r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1}, 0xb) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendto$inet(r0, &(0x7f0000000300)="f2", 0x1, 0x0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r2 = dup3(r1, r1, 0x80000) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r2, 0x84, 0x6e, &(0x7f0000000000)=[@in={0x2, 0x4e22, @rand_addr=0x8}, @in={0x2, 0x4e21, @multicast2}, @in={0x2, 0x4e21, @remote}], 0x30) recvmmsg(r0, &(0x7f0000000300), 0x393d110483faa83, 0x0, 0x0) 15:56:46 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x14, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) 15:56:46 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x5f}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:56:46 executing program 0: syz_emit_ethernet(0x66, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x28, 0x0, 0x0, 0x0, [{}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 288.960563] binder: 13995:14005 got transaction with invalid offset (36915243910144, min 0 max 24) or object. 15:56:46 executing program 3: syz_emit_ethernet(0xfffffffffffffdef, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 289.066993] binder: 13995:14005 transaction failed 29201/-22, size 24-8 line 3033 [ 289.096380] binder: 13995:14015 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 289.105367] binder: undelivered TRANSACTION_ERROR: 29201 15:56:47 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x2f}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:56:47 executing program 0: syz_emit_ethernet(0x66, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x28, 0x0, 0x0, 0x0, [{}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:47 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x2f, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) [ 289.118498] binder_alloc: binder_alloc_mmap_handler: 13995 20001000-20004000 already mapped failed -16 [ 289.128818] binder: BINDER_SET_CONTEXT_MGR already set [ 289.134978] binder: 13995:14005 ioctl 40046207 0 returned -16 [ 289.141000] binder_alloc: 13995: binder_alloc_buf, no vma [ 289.147385] binder: 13995:14010 transaction failed 29189/-3, size 24-8 line 2970 [ 289.155787] binder: undelivered TRANSACTION_ERROR: 29189 15:56:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup2(0xffffffffffffffff, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:56:47 executing program 5: r0 = memfd_create(&(0x7f00005c5ff3)='/dev/net/tun\x00', 0x0) r1 = dup2(r0, r0) fcntl$F_SET_FILE_RW_HINT(r1, 0x40e, &(0x7f0000000100)=0x5) read(r0, &(0x7f0000000300)=""/187, 0xbb) 15:56:47 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x4000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:56:47 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0xb, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) [ 289.308374] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 289.323999] binder: 14047:14048 transaction failed 29189/-22, size 24-8 line 2855 15:56:47 executing program 5: geteuid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000500)=0x0) ptrace$poke(0x5, r0, &(0x7f0000000540), 0x0) mount$fuseblk(&(0x7f0000000400)='/dev/loop0\x00', &(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='fuseblk\x00', 0x0, &(0x7f0000000300)=ANY=[]) userfaultfd(0x80800) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r1, 0x800442d2, &(0x7f0000000140)={0x2, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, @broadcast}, {0x0, 0x0, 0x0, @link_local}]}) execveat(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', &(0x7f0000000340)=[&(0x7f00000001c0)='*ppp0securitysecurity#\x00', &(0x7f0000000200)='cpuset\x00', &(0x7f0000000240)='&\x00', &(0x7f00000002c0)="785f61636c3d6163636500100000000000"], &(0x7f00000003c0)=[&(0x7f0000000380)='.\x00'], 0x1800) sync() ioperm(0x7, 0x10001, 0x7) 15:56:47 executing program 3: syz_emit_ethernet(0xfffffdef, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:47 executing program 0 (fault-call:0 fault-nth:0): syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 289.350796] binder: 14047:14048 transaction failed 29189/-22, size 24-8 line 2855 15:56:47 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0xf00}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 289.430360] FAULT_INJECTION: forcing a failure. [ 289.430360] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 289.441393] binder: undelivered TRANSACTION_ERROR: 29189 [ 289.453273] binder: undelivered TRANSACTION_ERROR: 29189 [ 289.474814] CPU: 0 PID: 14058 Comm: syz-executor0 Not tainted 4.19.0-rc3+ #142 [ 289.482208] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 289.491573] Call Trace: [ 289.494180] dump_stack+0x1c4/0x2b4 [ 289.497830] ? dump_stack_print_info.cold.2+0x52/0x52 [ 289.503050] should_fail.cold.4+0xa/0x17 [ 289.507124] ? get_page_from_freelist+0x29a4/0x5340 [ 289.512157] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 289.517274] ? print_usage_bug+0xc0/0xc0 [ 289.521351] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 15:56:47 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x32, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) 15:56:47 executing program 3: syz_emit_ethernet(0xfdef, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 289.526897] ? __alloc_pages_nodemask+0x638/0xde0 [ 289.526920] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 289.537232] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 289.537250] ? kasan_unpoison_shadow+0x35/0x50 [ 289.537269] ? preempt_count_add+0x7d/0x160 [ 289.537287] ? get_page_from_freelist+0x17ae/0x5340 [ 289.537312] ? __lock_acquire+0x7ec/0x4ec0 [ 289.537329] ? __lock_acquire+0x7ec/0x4ec0 [ 289.537360] ? mark_held_locks+0x130/0x130 [ 289.537386] ? __isolate_free_page+0x610/0x610 [ 289.574063] ? debug_smp_processor_id+0x1c/0x20 [ 289.578753] ? perf_trace_lock_acquire+0x15b/0x800 [ 289.583722] __alloc_pages_nodemask+0x34b/0xde0 [ 289.588418] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 289.593974] ? check_preemption_disabled+0x48/0x200 [ 289.599011] ? __alloc_pages_slowpath+0x2d80/0x2d80 [ 289.604036] ? debug_smp_processor_id+0x1c/0x20 [ 289.604056] ? perf_trace_lock_acquire+0x15b/0x800 [ 289.604072] ? debug_smp_processor_id+0x1c/0x20 [ 289.604089] ? perf_trace_lock_acquire+0x15b/0x800 [ 289.604112] ? perf_trace_lock+0x7a0/0x7a0 15:56:47 executing program 3: syz_emit_ethernet(0xd, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 289.604136] ? graph_lock+0x170/0x170 [ 289.604153] ? graph_lock+0x170/0x170 [ 289.604168] ? print_usage_bug+0xc0/0xc0 [ 289.604198] ? print_usage_bug+0xc0/0xc0 [ 289.618728] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 289.618753] alloc_pages_current+0x10c/0x210 [ 289.618782] skb_page_frag_refill+0x45f/0x6a0 [ 289.618809] ? sock_kfree_s+0x60/0x60 [ 289.658049] ? check_preemption_disabled+0x48/0x200 [ 289.658075] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 289.666869] ? kasan_check_read+0x11/0x20 15:56:47 executing program 3: syz_emit_ethernet(0xa2, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 289.666889] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 289.666908] ? rcu_bh_qs+0xc0/0xc0 [ 289.666940] tun_build_skb.isra.54+0x358/0x2230 [ 289.666970] ? tun_device_event+0x1070/0x1070 [ 289.694861] ? __lock_acquire+0x7ec/0x4ec0 [ 289.699117] ? __lock_acquire+0x7ec/0x4ec0 [ 289.703377] ? __lock_acquire+0x7ec/0x4ec0 [ 289.707631] ? mark_held_locks+0x130/0x130 [ 289.712071] ? mark_held_locks+0x130/0x130 [ 289.716319] ? print_usage_bug+0xc0/0xc0 [ 289.720394] ? debug_smp_processor_id+0x1c/0x20 [ 289.725093] ? print_usage_bug+0xc0/0xc0 [ 289.729162] ? check_preemption_disabled+0x48/0x200 [ 289.729183] ? print_usage_bug+0xc0/0xc0 [ 289.729204] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 289.729220] ? check_preemption_disabled+0x48/0x200 [ 289.729268] ? print_usage_bug+0xc0/0xc0 [ 289.752922] ? __lock_acquire+0x7ec/0x4ec0 [ 289.757177] ? perf_trace_lock+0x7a0/0x7a0 [ 289.761446] ? mark_held_locks+0x130/0x130 [ 289.765719] tun_get_user+0xc5c/0x42a0 [ 289.765750] ? check_preemption_disabled+0x48/0x200 [ 289.774666] ? tun_build_skb.isra.54+0x2230/0x2230 [ 289.779621] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 289.784916] ? rcu_bh_qs+0xc0/0xc0 [ 289.788490] ? aa_file_perm+0x490/0x1060 [ 289.792570] ? find_held_lock+0x36/0x1c0 [ 289.796652] ? tun_get+0x206/0x370 [ 289.800214] ? lock_downgrade+0x900/0x900 [ 289.804376] ? check_preemption_disabled+0x48/0x200 [ 289.809439] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 289.815251] ? kasan_check_read+0x11/0x20 [ 289.819427] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 289.824723] ? rcu_bh_qs+0xc0/0xc0 [ 289.828288] ? tun_get+0x22d/0x370 [ 289.831837] ? tun_chr_close+0x180/0x180 [ 289.835914] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 289.840857] ? common_file_perm+0x236/0x7f0 [ 289.845204] tun_chr_write_iter+0xb9/0x154 [ 289.849465] do_iter_readv_writev+0x8b0/0xa80 [ 289.853987] ? vfs_dedupe_file_range+0x670/0x670 [ 289.858752] ? apparmor_file_permission+0x24/0x30 [ 289.863619] ? rw_verify_area+0x118/0x360 [ 289.867797] do_iter_write+0x185/0x5f0 [ 289.871710] ? iov_iter_get_pages+0x1210/0x1210 [ 289.876390] ? proc_cwd_link+0x1d0/0x1d0 [ 289.880478] ? graph_lock+0x170/0x170 [ 289.884309] compat_writev+0x233/0x410 [ 289.888218] ? do_pwritev+0x280/0x280 [ 289.892043] ? fget_raw+0x20/0x20 [ 289.895507] ? wait_for_completion+0x8a0/0x8a0 [ 289.900112] ? __lock_is_held+0xb5/0x140 [ 289.904205] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 289.909763] ? __fdget_pos+0xde/0x200 [ 289.913587] ? __fdget_raw+0x20/0x20 [ 289.917315] ? __sb_end_write+0xd9/0x110 [ 289.921421] do_compat_writev+0x119/0x250 [ 289.925590] ? compat_writev+0x410/0x410 [ 289.929672] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 289.935149] ? mm_fault_error+0x380/0x380 [ 289.939298] __ia32_compat_sys_writev+0x74/0xb0 [ 289.943964] do_fast_syscall_32+0x34d/0xfb2 [ 289.948280] ? do_int80_syscall_32+0x890/0x890 [ 289.952885] ? entry_SYSENTER_compat+0x68/0x7f [ 289.957499] ? trace_hardirqs_off_caller+0xbb/0x310 [ 289.962506] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 289.967341] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 289.972173] ? trace_hardirqs_on_caller+0x310/0x310 [ 289.977182] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 289.982193] ? prepare_exit_to_usermode+0x291/0x3b0 [ 289.987216] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 289.992071] entry_SYSENTER_compat+0x70/0x7f [ 289.996466] RIP: 0023:0xf7f02ca9 [ 289.999823] Code: 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 0c 24 c3 8b 1c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 290.018735] RSP: 002b:00000000f5efe054 EFLAGS: 00000292 ORIG_RAX: 0000000000000092 15:56:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="1ef50040f4ff0000"], 0x0, 0x0, &(0x7f0000000500)}) ioctl$FS_IOC_GETFSMAP(r1, 0xc0c0583b, &(0x7f0000000480)={0x0, 0x0, 0x6, 0x0, [], [{0x101, 0xfa45, 0x2, 0x0, 0x6}, {0xffffffffffffff0b, 0xfffffffffffffff9, 0x3, 0x181d, 0xfb8, 0x8}], [[], [], [], [], [], []]}) 15:56:47 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0xf000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:56:47 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x2d, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) 15:56:47 executing program 3: syz_emit_ethernet(0x200000a2, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 290.026444] RAX: ffffffffffffffda RBX: 00000000000000f0 RCX: 00000000f5efe0a4 [ 290.033717] RDX: 0000000000000001 RSI: 0000000020000040 RDI: 0000000000000003 [ 290.041010] RBP: 00000000f5efe168 R08: 0000000000000000 R09: 0000000000000000 [ 290.048271] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 290.055546] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 290.119675] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 290.136335] binder: release 14091:14093 transaction 632 out, still active [ 290.144472] binder: unexpected work type, 4, not freed [ 290.150457] binder: 14091:14093 unknown command 1073804574 [ 290.180427] binder: 14091:14093 ioctl c0306201 20000080 returned -22 [ 290.187932] binder: undelivered TRANSACTION_COMPLETE [ 290.208486] binder: 14091:14099 ioctl c0c0583b 20000480 returned -22 15:56:48 executing program 0 (fault-call:0 fault-nth:1): syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:48 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x8847, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:48 executing program 5: r0 = add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f00000000c0), 0x0, 0x0, 0xfffffffffffffffc) socketpair(0xa, 0x80002, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$RTC_WKALM_SET(r2, 0x4028700f, &(0x7f0000000200)={0x0, 0x0, {0xd, 0x23, 0x13, 0x1c, 0x2, 0xc4de, 0x3, 0x104, 0xffffffffffffffff}}) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r1, 0x29, 0x41, &(0x7f0000000240)=ANY=[@ANYBLOB="7365637572697479000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000f2ffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x68) getsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000080)=0x74c18e7d, &(0x7f0000000100)=0x4) openat$ppp(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ppp\x00', 0x105000, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000300), 0xffffffffffffffff) keyctl$unlink(0x9, 0x0, r0) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000040)) keyctl$link(0x25, 0x0, 0x0) prlimit64(r3, 0x40000000000000d, &(0x7f00000001c0)={0xfffffffffffffff7, 0x13f}, 0x0) 15:56:48 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0xfffff000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 290.225098] binder_alloc: binder_alloc_mmap_handler: 14091 20001000-20004000 already mapped failed -16 [ 290.238828] binder: BINDER_SET_CONTEXT_MGR already set [ 290.248636] binder: 14091:14093 ioctl 40046207 0 returned -16 [ 290.255272] binder_alloc: 14091: binder_alloc_buf, no vma [ 290.261084] binder: 14091:14099 transaction failed 29189/-3, size 24-8 line 2970 [ 290.269952] binder: undelivered TRANSACTION_ERROR: 29189 15:56:48 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x10, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) [ 290.283245] binder: 14091:14099 unknown command 1073804574 [ 290.311694] binder: 14091:14100 ioctl c0c0583b 20000480 returned -22 [ 290.313730] binder: 14091:14099 ioctl c0306201 20000080 returned -22 [ 290.327752] binder: send failed reply for transaction 632, target dead [ 290.337632] FAULT_INJECTION: forcing a failure. [ 290.337632] name failslab, interval 1, probability 0, space 0, times 0 [ 290.348934] CPU: 1 PID: 14103 Comm: syz-executor0 Not tainted 4.19.0-rc3+ #142 [ 290.356309] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 290.365667] Call Trace: [ 290.368273] dump_stack+0x1c4/0x2b4 [ 290.371919] ? dump_stack_print_info.cold.2+0x52/0x52 [ 290.377139] should_fail.cold.4+0xa/0x17 [ 290.381223] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 290.386341] ? __lock_acquire+0x7ec/0x4ec0 [ 290.390594] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 290.396142] ? check_preemption_disabled+0x48/0x200 [ 290.401176] ? check_preemption_disabled+0x48/0x200 [ 290.406223] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 290.411784] ? mark_held_locks+0x130/0x130 [ 290.416030] ? perf_trace_lock_acquire+0x15b/0x800 [ 290.420975] ? rcu_pm_notify+0xc0/0xc0 [ 290.424892] ? rcu_read_lock_sched_held+0x108/0x120 [ 290.429921] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 290.435468] ? check_preemption_disabled+0x48/0x200 [ 290.440495] ? graph_lock+0x170/0x170 [ 290.444316] ? debug_smp_processor_id+0x1c/0x20 [ 290.448999] ? perf_trace_lock_acquire+0x15b/0x800 [ 290.453941] ? debug_smp_processor_id+0x1c/0x20 [ 290.458635] ? perf_trace_lock+0x7a0/0x7a0 [ 290.462900] __should_failslab+0x124/0x180 [ 290.467158] should_failslab+0x9/0x14 [ 290.470981] kmem_cache_alloc+0x47/0x730 [ 290.475064] ? ___might_sleep+0x1ed/0x300 [ 290.479227] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 290.484784] __build_skb+0xab/0x430 [ 290.488435] ? skb_try_coalesce+0x1b70/0x1b70 [ 290.492946] ? graph_lock+0x170/0x170 [ 290.496763] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 290.502319] ? check_preemption_disabled+0x48/0x200 [ 290.507350] ? check_preemption_disabled+0x48/0x200 [ 290.512396] build_skb+0x77/0x270 [ 290.515878] ? __build_skb+0x430/0x430 [ 290.519801] tun_build_skb.isra.54+0x8a8/0x2230 [ 290.522695] binder: 14110:14113 got transaction to context manager from process owning it [ 290.524494] ? tun_device_event+0x1070/0x1070 [ 290.524518] ? __lock_acquire+0x7ec/0x4ec0 [ 290.524544] ? __lock_acquire+0x7ec/0x4ec0 [ 290.524567] ? __lock_acquire+0x7ec/0x4ec0 [ 290.550048] ? mark_held_locks+0x130/0x130 [ 290.554314] ? mark_held_locks+0x130/0x130 [ 290.558556] ? print_usage_bug+0xc0/0xc0 [ 290.560272] binder: 14110:14113 transaction failed 29201/-22, size 24-8 line 2846 [ 290.562629] ? debug_smp_processor_id+0x1c/0x20 [ 290.562649] ? print_usage_bug+0xc0/0xc0 [ 290.562664] ? check_preemption_disabled+0x48/0x200 [ 290.562681] ? print_usage_bug+0xc0/0xc0 [ 290.562701] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 290.562717] ? check_preemption_disabled+0x48/0x200 [ 290.562731] ? print_usage_bug+0xc0/0xc0 [ 290.562754] ? __lock_acquire+0x7ec/0x4ec0 [ 290.594842] binder: 14110:14117 ioctl 4040ae79 200000c0 returned -22 [ 290.598687] ? perf_trace_lock+0x7a0/0x7a0 [ 290.598717] ? mark_held_locks+0x130/0x130 [ 290.598750] tun_get_user+0xc5c/0x42a0 [ 290.598773] ? check_preemption_disabled+0x48/0x200 [ 290.618673] binder: undelivered TRANSACTION_ERROR: 29201 [ 290.622009] ? tun_build_skb.isra.54+0x2230/0x2230 [ 290.622033] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 290.622057] ? rcu_bh_qs+0xc0/0xc0 [ 290.640192] binder: 14110:14113 IncRefs 0 refcount change on invalid ref 15531777 ret -22 [ 290.641342] ? aa_file_perm+0x490/0x1060 [ 290.641369] ? find_held_lock+0x36/0x1c0 [ 290.641395] ? tun_get+0x206/0x370 [ 290.666892] binder_alloc: binder_alloc_mmap_handler: 14110 20001000-20004000 already mapped failed -16 [ 290.670149] ? lock_downgrade+0x900/0x900 [ 290.670167] ? check_preemption_disabled+0x48/0x200 [ 290.670201] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 290.670226] ? kasan_check_read+0x11/0x20 [ 290.698749] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 290.704043] ? rcu_bh_qs+0xc0/0xc0 [ 290.707625] ? tun_get+0x22d/0x370 [ 290.709565] binder: 14110:14117 got transaction to context manager from process owning it [ 290.711172] ? tun_chr_close+0x180/0x180 [ 290.711199] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 290.711218] ? common_file_perm+0x236/0x7f0 [ 290.711243] tun_chr_write_iter+0xb9/0x154 [ 290.737072] do_iter_readv_writev+0x8b0/0xa80 [ 290.742045] ? vfs_dedupe_file_range+0x670/0x670 [ 290.744031] binder: 14110:14117 transaction failed 29201/-22, size 24-8 line 2846 [ 290.746811] ? apparmor_file_permission+0x24/0x30 [ 290.746839] ? rw_verify_area+0x118/0x360 [ 290.746862] do_iter_write+0x185/0x5f0 [ 290.746886] ? iov_iter_get_pages+0x1210/0x1210 [ 290.772024] ? proc_cwd_link+0x1d0/0x1d0 [ 290.773329] binder: 14110:14128 ioctl 4040ae79 200000c0 returned -22 [ 290.776096] ? graph_lock+0x170/0x170 [ 290.776126] compat_writev+0x233/0x410 [ 290.776149] ? do_pwritev+0x280/0x280 [ 290.776165] ? fget_raw+0x20/0x20 [ 290.776199] ? wait_for_completion+0x8a0/0x8a0 [ 290.791493] binder: 14110:14117 IncRefs 0 refcount change on invalid ref 15531777 ret -22 [ 290.794146] ? __lock_is_held+0xb5/0x140 [ 290.794187] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 290.794205] ? __fdget_pos+0xde/0x200 [ 290.794222] ? __fdget_raw+0x20/0x20 [ 290.794238] ? __sb_end_write+0xd9/0x110 [ 290.794267] do_compat_writev+0x119/0x250 [ 290.798207] binder: undelivered TRANSACTION_ERROR: 29201 [ 290.802296] ? compat_writev+0x410/0x410 [ 290.802320] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 290.802342] ? mm_fault_error+0x380/0x380 [ 290.802366] __ia32_compat_sys_writev+0x74/0xb0 [ 290.802389] do_fast_syscall_32+0x34d/0xfb2 [ 290.864019] ? do_int80_syscall_32+0x890/0x890 [ 290.868622] ? entry_SYSENTER_compat+0x68/0x7f [ 290.873229] ? trace_hardirqs_off_caller+0xbb/0x310 [ 290.878265] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 290.883121] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 290.887979] ? trace_hardirqs_on_caller+0x310/0x310 [ 290.893016] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 290.898047] ? prepare_exit_to_usermode+0x291/0x3b0 [ 290.903083] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 290.907953] entry_SYSENTER_compat+0x70/0x7f [ 290.909819] binder: release 14136:14137 transaction 641 out, still active [ 290.912366] RIP: 0023:0xf7f02ca9 [ 290.912385] Code: 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 0c 24 c3 8b 1c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 290.912395] RSP: 002b:00000000f5efe054 EFLAGS: 00000292 ORIG_RAX: 0000000000000092 [ 290.912428] RAX: ffffffffffffffda RBX: 00000000000000f0 RCX: 00000000f5efe0a4 [ 290.924887] binder: unexpected work type, 4, not freed [ 290.941617] RDX: 0000000000000001 RSI: 0000000020000040 RDI: 0000000000000003 [ 290.941628] RBP: 00000000f5efe168 R08: 0000000000000000 R09: 0000000000000000 [ 290.941636] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 15:56:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = dup2(r1, r0) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f00000000c0)={0x2000, &(0x7f0000000040), 0x8, r2, 0x2}) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="0463044001ffec0066688db1243debb5958ab210e99cfa96b9d1f238e02f847b8266fb70ab9fcbd8ec1c30164629f719b6e267885c625bf40efe29caca7ac4175a9ca7a5a6937da0a6bb027029c88ffc2ceefa2899cd1e7bf07fe760b618dc8dd1763040173dafe6cb17620452a47b6c48b2928c8cb7779e5fbe726c4f6f85b57638f4963a9248e669c76a01370cb0957d53974948d8a021533f8bd5f57410a476444e5ae3bb72c6179742f8ac72da858d6d46a4be96ef2d0126b943e748a8b3e3cd22e624a7710a66ed9407004dc5f75bc4451aa1294443dab48d6b99e50f"], 0x0, 0x0, &(0x7f0000000500)}) 15:56:48 executing program 5: mkdir(&(0x7f0000000680)='./control\x00', 0x0) r0 = open(&(0x7f0000000600)='./control\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000000000)='./control\x00', 0x103c, 0x0) faccessat(r0, &(0x7f000003fff6)='./control\x00', 0x7, 0x0) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f00000000c0)={@nfc={0x27, 0x0, 0x1, 0x7}, {&(0x7f0000000040)=""/35, 0x23}, &(0x7f0000000080), 0xe}, 0x9c) 15:56:48 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x18, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) 15:56:48 executing program 5: r0 = socket$packet(0x11, 0x800000003, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000), 0x4) ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000040)={0x0, 0x1, 0x1, 0x100000001}) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f00000000c0), 0x4) 15:56:48 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x2, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) 15:56:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = dup2(r1, r0) fcntl$setflags(r0, 0x2, 0x1) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000480)={{{@in6=@loopback, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in6=@remote}}, &(0x7f00000000c0)=0xe8) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0, 0x0}, &(0x7f0000000180)=0xc) fsetxattr$system_posix_acl(r0, &(0x7f0000000040)="73df4b74656d2e706f7369785b61636c16bdedc908bc9c3200", &(0x7f0000000380)={{}, {0x1, 0x1}, [{0x2, 0x4, r3}], {}, [{0x8, 0x6, r4}], {0x10, 0x5}, {0x20, 0x2}}, 0x74, 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x1f2, 0x0, &(0x7f0000000500)}) getsockopt$inet6_buf(r2, 0x29, 0x3e, &(0x7f0000000280)=""/38, &(0x7f00000002c0)=0x26) 15:56:48 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x17, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) [ 290.941644] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 15:56:48 executing program 0 (fault-call:0 fault-nth:2): syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:48 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x300, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:48 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1=0xe0000300, @local, 0x0, 0x6}, 0x10) [ 291.024499] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:56:49 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x500}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:56:49 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x8100, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:49 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x0, 0x0) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000000)=0x0) ptrace(0x11, r3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto(r2, &(0x7f0000000200), 0x20020, 0x0, &(0x7f00000002c0)=@ethernet={0x0, @remote}, 0x80) 15:56:49 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x6, 0x6}, 0x10) [ 291.184655] binder: undelivered TRANSACTION_COMPLETE 15:56:49 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:49 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x700, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:49 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x100000000000000, 0x6}, 0x10) [ 291.320832] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 291.702863] binder_alloc: binder_alloc_mmap_handler: 14136 20003000-20007000 already mapped failed -16 [ 291.712485] binder: BINDER_SET_CONTEXT_MGR already set [ 291.717896] binder: 14136:14143 ioctl 40046207 0 returned -16 [ 291.718038] binder_alloc: 14136: binder_alloc_buf, no vma [ 291.730042] binder: 14136:14191 transaction failed 29189/-3, size 24-8 line 2970 [ 291.738093] binder: undelivered TRANSACTION_ERROR: 29189 [ 291.744036] binder: 14136:14143 IncRefs 0 refcount change on invalid ref 1 ret -22 15:56:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="04630440010000"], 0x0, 0x0, &(0x7f0000000500)}) 15:56:49 executing program 0: syz_emit_ethernet(0x200000aa, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:49 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x854, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:49 executing program 5: r0 = accept4(0xffffffffffffffff, 0x0, &(0x7f0000000200), 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000880)={{{@in=@broadcast, @in=@dev}}, {{@in=@broadcast}, 0x0, @in6=@loopback}}, &(0x7f0000000980)=0xe8) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r1 = syz_open_dev$usbmon(&(0x7f0000000180)='/dev/usbmon#\x00', 0x6, 0x80000) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/sequencer2\x00', 0x80000, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9f76, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) readv(r3, &(0x7f0000000180), 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0xe, &(0x7f0000001000)=ANY=[@ANYBLOB="b70428df80a089da5000000062ed0000bfa30000000000000703000028feffff7a0af0fff8ffffff71a4f0ff00000000b706000001ed00001d040000000000006f460000000000006b0a00fe000000008500000007000000b7000000000000070000000000000000"], &(0x7f0000000100)='EPL\x00'}, 0x48) get_thread_area(&(0x7f0000000140)={0xaa, 0x20000000, 0x4000, 0x0, 0x0, 0x6, 0x0, 0x0, 0x1, 0x23}) 15:56:49 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x600}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:56:49 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x200000000000000, 0x6}, 0x10) 15:56:49 executing program 0: syz_emit_ethernet(0x7ffff000, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 291.752422] binder: send failed reply for transaction 641, target dead [ 291.791338] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:56:49 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x807, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:49 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0xffffff7f00000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:56:49 executing program 5: socketpair(0x2000000024, 0xfffffffffffffffe, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0, 0x2}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000080)={r1, 0x6e6}, 0x8) 15:56:49 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x1000000, 0x6}, 0x10) [ 291.898215] binder: release 14210:14211 transaction 646 out, still active [ 291.906663] binder_alloc: binder_alloc_mmap_handler: 14210 20001000-20004000 already mapped failed -16 [ 291.931962] binder: unexpected work type, 4, not freed [ 291.955154] binder: undelivered TRANSACTION_COMPLETE [ 291.955192] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 291.974007] binder: BINDER_SET_CONTEXT_MGR already set [ 291.987336] binder: 14210:14211 ioctl 40046207 0 returned -16 15:56:49 executing program 0: syz_emit_ethernet(0xfffffffffffffdef, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 292.006599] binder_alloc: 14210: binder_alloc_buf, no vma [ 292.043265] binder: 14210:14224 transaction failed 29189/-3, size 24-8 line 2970 15:56:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhci\x00', 0x40, 0x0) ioctl$KVM_SET_SIGNAL_MASK(r2, 0x4004ae8b, &(0x7f0000000140)={0x54, "86c5fa67aa4f7e9ca38d8f05314e300340a4724f564b0e02a1e20db3754c8c9efab65d2e3c50fa38804fde935b14b70d3a55ff440f82b266541d4e8c804a99e1189711f99a983f9711ccacb3ef0f72a71e6b7663"}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB], 0x0, 0x0, &(0x7f0000000500)}) 15:56:50 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x500, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:50 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x2000000, 0x6}, 0x10) 15:56:50 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x20000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:56:50 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000800)=ANY=[@ANYRESOCT], &(0x7f00000002c0)=0x1) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000380)={{{@in6=@remote, @in=@multicast1}}, {{@in6=@local}, 0x0, @in6=@mcast2}}, &(0x7f0000000200)=0xe8) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/ppp\x00', 0xc0000, 0x0) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000000480)=@assoc_value={0x0, 0xffffffff}, &(0x7f0000000600)=0x8) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000640)={r2, 0x1}, 0x8) pipe(&(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000500)={r3, 0x240, &(0x7f0000000540)}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f00000006c0)={0x0, 0x18, 0xfa00, {0x1f, &(0x7f0000000680)={0xffffffffffffffff}, 0x2, 0x1000}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r4, &(0x7f0000000700)={0x13, 0x10, 0xfa00, {&(0x7f0000000840), r5, 0x1}}, 0x18) r6 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer2\x00', 0x800, 0x0) getsockopt$IP_VS_SO_GET_VERSION(r6, 0x0, 0x480, &(0x7f0000000300), &(0x7f0000000340)=0x40) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(&(0x7f0000000240)=ANY=[], &(0x7f0000000180)='./file0\x00', &(0x7f0000000100)='nfs\x00', 0x0, &(0x7f0000000000)) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getpid() sched_setscheduler(0x0, 0x0, &(0x7f0000000040)) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$IP_VS_SO_GET_VERSION(r7, 0x0, 0x480, &(0x7f0000000140), &(0x7f0000000240)=0x40) rt_sigreturn() 15:56:50 executing program 0: syz_emit_ethernet(0xfffffdef, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 292.080358] binder: 14210:14211 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 292.104496] binder: send failed reply for transaction 646, target dead [ 292.117088] binder: undelivered TRANSACTION_ERROR: 29189 15:56:50 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x8848, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 292.171909] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 292.244245] binder: release 14247:14249 transaction 651 out, still active [ 292.251693] binder: 14247:14249 unknown command 0 [ 292.259270] binder: unexpected work type, 4, not freed [ 292.270717] binder: undelivered TRANSACTION_COMPLETE [ 292.278548] binder: 14247:14249 ioctl c0306201 20000080 returned -22 15:56:50 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x40000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:56:50 executing program 0: syz_emit_ethernet(0xfdef, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 292.307289] binder_alloc: binder_alloc_mmap_handler: 14247 20001000-20004000 already mapped failed -16 [ 292.329069] binder: BINDER_SET_CONTEXT_MGR already set [ 292.344213] binder: 14247:14249 ioctl 40046207 0 returned -16 15:56:50 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x600, 0x6}, 0x10) [ 292.357342] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 292.368728] binder_alloc: 14247: binder_alloc_buf, no vma [ 292.382427] binder: 14247:14255 transaction failed 29189/-3, size 24-8 line 2970 15:56:50 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x802, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 292.441078] binder: send failed reply for transaction 651, target dead [ 292.458734] binder: undelivered TRANSACTION_ERROR: 29189 15:56:50 executing program 0: syz_emit_ethernet(0xd, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x20000000000802) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="85719686c80000000af36a13af18e4fefe9e904935d2743c9f793d1baba69364ccb9a491695d4ce3f5b171d56c95fcdaf0af7d467c8c72db6df2e42503adfc7aea16396297a5c2a0953050bf04d6ab08180f4a952ea1dc9c085a67f02ec97399c7a906db4563c73fe6297b390b0b2194cdf6874901cc49e572fbed174cd5d7b855a65f79fce1767345e1e1ff06e21f1e1c1fa5f6509ec1", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) r2 = dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, &(0x7f00000000c0)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:56:50 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x6000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:56:50 executing program 5: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bond0\x00'}) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) getpgid(0xffffffffffffffff) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f00000002c0)) r1 = getpgrp(0xffffffffffffffff) getpgid(r1) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_user\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000600)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(0xffffffffffffffff, 0x84, 0x12, &(0x7f0000000300), 0x4) setsockopt$IP_VS_SO_SET_STOPDAEMON(r3, 0x0, 0x48c, &(0x7f0000000080)={0x0, 'veth1_to_bond\x00'}, 0x18) ioctl(r3, 0x800000000008982, &(0x7f0000000080)) openat$ppp(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ppp\x00', 0x0, 0x0) write$FUSE_NOTIFY_DELETE(r2, &(0x7f0000000440)=ANY=[@ANYBLOB="290000000600000000000000000000000400000000000000030000000000000000000000000000000069127fbcdab56d0f1f4cb25800000000000021b0c9e06ea850325f77726e71bff4c99eef500ade32c424020f322903f5bad93af656f3ab1b21b71d36b21f90cc33f448b7074cc657ba4e66617aba4647b3fc7813"], 0x5c) mount(&(0x7f0000000380)=ANY=[@ANYBLOB="cb2b9b525517282cc75d43a54cb3b440fe96132329bdfbaa11c5521288697c83a9f28c7ee9d8df70f2c6849d443d5bc274f1576385a885b764dc4babfdf01646fa6000"], &(0x7f0000000800)='./file0//ile0\x00', &(0x7f0000000200)='cgrQup2\x00', 0x2, 0x0) ioctl$TIOCNXCL(r2, 0x540d) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x82) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000005c0)=ANY=[], &(0x7f0000000100)) ioctl$SG_GET_PACK_ID(r2, 0x227c, &(0x7f0000000400)) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r2, 0x84, 0x79, &(0x7f00000005c0), 0x8) ioctl$PERF_EVENT_IOC_RESET(r4, 0x2403, 0x2) memfd_create(&(0x7f0000000140)="6367726f7570320075b536e08f97e10c4289e296462f3c8fc6a418228027bf4d75931e238b41cf55afcf7dd2284567ed5a738f3382aae6349e10336adf686499eb1d9379eb28", 0x0) syz_open_dev$usbmon(&(0x7f0000000840)='/dev/usbmon#\x00', 0x0, 0x400880) socket$inet_tcp(0x2, 0x1, 0x0) 15:56:50 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x2, 0x6}, 0x10) 15:56:50 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x80b, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:50 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x600000000000000, 0x6}, 0x10) 15:56:50 executing program 0: syz_emit_ethernet(0xaa, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:50 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x4305, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 292.653281] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 292.680117] binder: 14288:14289 got transaction to context manager from process owning it [ 292.761579] binder: 14288:14289 ioctl 541b 200000c0 returned -22 [ 292.786762] binder: 14288:14289 IncRefs 0 refcount change on invalid ref 1 ret -22 15:56:50 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x8100}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 292.805927] binder_alloc: binder_alloc_mmap_handler: 14288 20001000-20004000 already mapped failed -16 [ 292.822734] binder: 14288:14295 got transaction to context manager from process owning it [ 292.832374] binder: 14288:14295 ioctl 541b 200000c0 returned -22 [ 292.843056] binder: 14288:14289 IncRefs 0 refcount change on invalid ref 1 ret -22 15:56:50 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x806, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:50 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000240)='/dev/uinput\x00', 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, 0x0}, &(0x7f00000000c0)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000140)={'team0\x00', r1}) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000000)) ioctl$UI_END_FF_ERASE(r0, 0x406855c9, &(0x7f0000000040)) 15:56:50 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local={[0xc0]}, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 292.916721] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:56:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, &(0x7f0000000140)) getsockopt$IP_VS_SO_GET_TIMEOUT(r2, 0x0, 0x486, &(0x7f0000000040), &(0x7f00000000c0)=0xc) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r2, 0x84, 0x65, &(0x7f0000000000)=[@in={0x2, 0x4e20, @multicast1}, @in6={0xa, 0x4e24, 0x800, @loopback, 0x9}], 0x2c) 15:56:50 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x6000000, 0x6}, 0x10) 15:56:50 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x300}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:56:50 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x3ffffffb}, 0x10) 15:56:51 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x2c00, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 293.071051] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 293.071095] binder: release 14319:14322 transaction 660 out, still active [ 293.086956] binder: 14319:14322 ioctl 541b 20000140 returned -22 15:56:51 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local={[0x6a]}, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 293.116256] binder_alloc: binder_alloc_mmap_handler: 14319 20001000-20004000 already mapped failed -16 [ 293.126352] binder: unexpected work type, 4, not freed [ 293.151556] binder: undelivered TRANSACTION_COMPLETE 15:56:51 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x3f00}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:56:51 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x8864, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 293.187772] binder: BINDER_SET_CONTEXT_MGR already set 15:56:51 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$inet_dccp(0x2, 0x6, 0x0) setsockopt$inet_MCAST_LEAVE_GROUP(r1, 0x0, 0x2d, &(0x7f0000000180)={0x81, {{0x2, 0x8, @loopback}}}, 0x84) r2 = syz_open_dev$amidi(&(0x7f00000000c0)='/dev/amidi#\x00', 0x9, 0x20800) ioctl$EXT4_IOC_MIGRATE(r2, 0x6609) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000001780)={r2, &(0x7f0000001600)="9e928d881c4970ff58340a010000006c9aea0db5ca18ada497cc76439f6f6d2a98065f7ae705bc5b16b411fe9278f26689098317eff3e1be0b3c18156c8d40cb1ef333619894d1058fd6534475fe486dcb7865886f9680a8aca0cff849b44d4879a78ab26a3ced7156ea1b7c9b37286ae6e31eb9857f98c27c9a2dd1ec61d2773bc1618013036d5d72ea1560f0656c1eeb38f3db8b9c4c9c063ca32f7801370b35dbc1d00104ef09fe0d4a9f921ea361f96bf6d0239e2cf16f3ce487dbbf06f36c6ece8c32f1c445582ff07dadd8df739b1d0ae2a93602000000298c0cbd203735b858512c6ca057fdb2d9898b5212a619d5e0a839342eb501f80cd41e08446553f3d4a106e53b2a4e22807c3b1999a884da21b674aeec0cbb5a44cd645ce246f5c6ca07b9a99af87171076928f9933fc6a4c361f663edb171131fe2eb0c243b290f68c5dac886cb168bfd184dd7e67290e97d59f49ac664f7c5d8854a0cea4020ca510ec0e9ff66038307"}, 0x10) r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/fib_trie\x00') fgetxattr(r2, &(0x7f0000000100)=@random={'trusted.', 'self}ppp1\x00'}, &(0x7f0000000400)=""/4096, 0x1000) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha384-generic\x00'}, 0x58) readlinkat(r3, &(0x7f0000001400)='./file0\x00', &(0x7f0000001440)=""/109, 0x6d) r4 = accept4$alg(r0, 0x0, 0x0, 0x0) bind(r3, &(0x7f0000000380)=@pppol2tpv3={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @multicast2}, 0x2, 0x3, 0x1}}, 0x80) sendfile64(r4, r3, &(0x7f0000000080), 0x10001) recvmmsg(r4, &(0x7f0000007f00)=[{{0x0, 0x0, &(0x7f0000007e80), 0x0, &(0x7f0000007ec0)}}], 0x1, 0x0, &(0x7f0000007fc0)) 15:56:51 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0xa}, 0x10) 15:56:51 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local={[0xaa, 0xc0]}, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 293.226814] binder: 14319:14322 ioctl 40046207 0 returned -16 [ 293.245211] binder_alloc: 14319: binder_alloc_buf, no vma [ 293.264854] binder: 14319:14330 ioctl 541b 20000140 returned -22 [ 293.307069] binder: 14319:14330 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 293.346370] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:56:51 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0xd}, 0x10) [ 293.383271] binder: send failed reply for transaction 660, target dead 15:56:51 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x1, 0x20000) ioctl$EVIOCSABS2F(r0, 0x401845ef, &(0x7f00000000c0)={0x6, 0x6, 0x2, 0xffffffffffffffa1}) r1 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x1) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000140)='syzkaller\x00', &(0x7f0000000180)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00000001c0)='/dev/vcs#\x00', 0xfffffffffffffff9) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x50, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="0103000000000000"], @ANYRESDEC=r1], 0x46, 0x0, &(0x7f0000000380)="39e5796ed2bcf72dd0c187b3ec4d484ece4e47048ea7efff693703f8773b34f9ce4a69b1b9171ad32f8fd2f39a05a38cf4e937a97018faa3b983646fcc90fad5c32ef0c4d737"}) dup2(r2, r1) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:56:51 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x808, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:51 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local={[0xaa, 0x6a]}, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:51 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0xffffff9e}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:56:51 executing program 5: r0 = memfd_create(&(0x7f0000000380)='/dev/dsp\x00', 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = dup(r1) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) ioctl$DRM_IOCTL_ADD_CTX(r0, 0xc0086420, &(0x7f0000000100)={0x0}) ioctl$DRM_IOCTL_UNLOCK(r0, 0x4008642b, &(0x7f0000000240)={r3, 0x20}) sendto$inet6(r1, &(0x7f0000000180)="9a626b1bdada879b60a3f381c4cabcf2332fe8889b86af1b46717f6a5621bc3bf2f59be40fae61b160af1c576f31d83122dfe8a2d4971db0da9af0729e07d281fbde1d158e05e5ce653c935031fa71c0", 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback, 0x1}, 0x1f7) socket$packet(0x11, 0x4, 0x300) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000280)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0x18}}, {0xa, 0x0, 0x2, @loopback, 0x7}}}, 0x48) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f0000000040)={0x0, 0x1, 0xffffffffffffff27, @broadcast}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000280)='illinois\x00', 0x9) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000200), &(0x7f0000000300)=0x4) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000080)=0x0) ioctl$NBD_SET_FLAGS(r2, 0xab0a, 0x7fffffff) truncate(&(0x7f0000000000)='./file0\x00', 0x9) r5 = gettid() kcmp$KCMP_EPOLL_TFD(r4, r5, 0x7, r0, &(0x7f0000000140)={r0, r2, 0x8}) r6 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x800) sendfile(r2, r6, &(0x7f0000d83ff8), 0x8000fffffffe) 15:56:51 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x804, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:51 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local={[0xaa, 0xaa, 0x6a]}, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 293.543336] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 293.569801] binder: 14377:14378 got transaction with invalid offsets ptr 15:56:51 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x600, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:51 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x20000090) 15:56:51 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0xf000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 293.614184] binder: 14377:14378 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 293.653439] binder: BINDER_SET_CONTEXT_MGR already set 15:56:51 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000008000/0x18000)=nil, &(0x7f0000000880)=[@textreal={0x8, &(0x7f0000000000)="2e0f20160f060fbaad0058a00f07df170f01cf0f215b660f00558566b9800000c00f326635000800000f30660f017400", 0x30}], 0x1, 0x0, &(0x7f0000000100), 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x1f000}) r3 = dup3(r1, r2, 0x0) ioctl$KVM_GET_NR_MMU_PAGES(r3, 0xae45, 0xfff) ioctl$KVM_RUN(r2, 0xae80, 0x0) 15:56:51 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x5000) [ 293.694650] binder_alloc: 14377: binder_alloc_buf, no vma [ 293.718661] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 293.757974] binder: 14377:14388 ioctl 40046207 0 returned -16 15:56:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000240)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000040)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x40, 0x0, &(0x7f0000000140)=[@dead_binder_done={0x40086310, 0x1}, @increfs={0x40046304, 0x1}, @increfs={0x40046304, 0x2}, @acquire_done={0x40106309, r2, 0x4}, @request_death={0x400c630e, 0x2, 0x2}], 0x0, 0x0, &(0x7f00000003c0)}) r3 = dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) ioctl$sock_bt_hidp_HIDPCONNDEL(r3, 0x400448c9, &(0x7f00000000c0)={{0x4, 0x10001, 0x4, 0x1ff, 0x0, 0x5}, 0x5}) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f0000000180)={0x0, 0x80000000}, &(0x7f00000001c0)=0x8) setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f0000000200)={r4, 0x300000000000}, 0x8) 15:56:51 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x8906, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:51 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local={[0xaa, 0xaa, 0xc0]}, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:51 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x7}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:56:51 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0xf) 15:56:51 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x8035, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 293.903655] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 293.916069] binder: 14416:14417 BC_DEAD_BINDER_DONE 0000000000000001 not found 15:56:51 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local={[0xaa, 0xaa, 0xaa, 0xc0]}, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 293.986028] binder: 14416:14417 IncRefs 0 refcount change on invalid ref 1 ret -22 15:56:51 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x803, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:51 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x28) 15:56:52 executing program 5: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000016c0)='/dev/sequencer2\x00', 0x40042, 0x0) setsockopt$sock_int(r0, 0x1, 0x2c, &(0x7f0000000140)=0x1f, 0x4) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000180)={@dev={0xac, 0x14, 0x14, 0x10}, @loopback, 0x1, 0x2, [@multicast2, @empty]}, 0x18) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x80002, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x25d1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$GIO_SCRNMAP(r1, 0x4b40, &(0x7f0000000280)=""/216) r2 = dup2(r0, r1) fcntl$F_SET_FILE_RW_HINT(r2, 0x40e, &(0x7f0000000100)=0x7) syz_open_dev$amidi(&(0x7f0000000240)='/dev/amidi#\x00', 0x7, 0x2000000000) [ 294.037867] binder: 14416:14435 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 294.043094] binder: 14416:14417 IncRefs 0 refcount change on invalid ref 2 ret -22 15:56:52 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x5}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:56:52 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local={[0xaa, 0xaa, 0xaa, 0x6a]}, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 294.102101] binder: 14416:14431 ioctl 400448c9 200000c0 returned -22 [ 294.137521] binder: 14416:14417 BC_ACQUIRE_DONE u0000000000000000 no match [ 294.180113] binder: 14416:14417 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2 [ 294.200845] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 294.236117] binder_alloc: binder_alloc_mmap_handler: 14416 20001000-20004000 already mapped failed -16 [ 294.267882] binder: BINDER_SET_CONTEXT_MGR already set [ 294.268861] binder: 14416:14456 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 294.284468] binder: 14416:14431 BC_DEAD_BINDER_DONE 0000000000000001 not found [ 294.314214] binder: 14416:14417 ioctl 40046207 0 returned -16 [ 294.322716] binder: 14416:14435 ioctl 400448c9 200000c0 returned -22 15:56:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x20110, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0xb4, 0x0, &(0x7f0000000480)=[@clear_death={0x400c630f, 0x1, 0x2}, @acquire_done={0x40106309, r2, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000140)=[@fda={0x66646185, 0x4, 0x0, 0x18}, @ptr={0x70742a85, 0x1, &(0x7f0000000040), 0x1, 0x2, 0x28}], &(0x7f00000000c0)=[0x30, 0x0, 0x18]}}, @transaction_sg={0x40486311, {{0x4, 0x0, 0x3, 0x0, 0x11, 0x0, 0x0, 0x68, 0x28, &(0x7f0000000380)=[@ptr={0x70742a85, 0x4, &(0x7f00000001c0), 0x1, 0x3, 0x25}, @fd={0x66642a85, 0x0, r0, 0x0, 0x1}, @ptr={0x70742a85, 0x0, &(0x7f0000000280), 0x1, 0x4, 0x25}], &(0x7f00000002c0)=[0x20, 0x40, 0x38, 0x58, 0x38]}}}], 0x50, 0x0, &(0x7f0000000540)="275bf291ee24bd3d6d312b7d0135741e4b26c38fd32f4bffd9916234399619f0023247afc4a14107ee0b02d195b6354d9dca8976a24948e30e795d96ae8d1f9773fa1da139c715d86546edac629a456f"}) dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:56:52 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0xb, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:52 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000040)={@multicast1, @multicast1}, 0x10) 15:56:52 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pkey_mprotect(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1000001, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000100)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x400}]}, 0x8) setsockopt$inet6_tcp_int(r0, 0x6, 0x2, &(0x7f0000000340)=0x800000001ff, 0x10000038f) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1f, &(0x7f0000000180)=""/108, &(0x7f00000000c0)=0x6c) r2 = syz_open_dev$sndpcmc(&(0x7f0000000200)='/dev/snd/pcmC#D#c\x00', 0x3, 0x80) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000280)='nbd\x00') r4 = openat$full(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/full\x00', 0x50000, 0x0) r5 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000300)='cpuacct.usage_all\x00', 0x0, 0x0) pipe2(&(0x7f0000000380)={0xffffffffffffffff}, 0x4000) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f00000004c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000480)={&(0x7f00000003c0)=ANY=[@ANYBLOB="8c19336c", @ANYRES16=r3, @ANYBLOB="00042cbd7000fedbdf25010000000c000500010000000000000008000100000000000c000800ffffff7f000000000c00050002000000000000000c00050002000000000000000c00050001000000000000001c00070008000100", @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32=r5, @ANYBLOB="08000100", @ANYRES32=r1, @ANYBLOB="0c00070008000100", @ANYRES32=r6, @ANYBLOB="0c0002000500000000000000"], 0x8c}, 0x1, 0x0, 0x0, 0x800}, 0x4000000) sendto$inet6(r1, &(0x7f0000000040), 0xfe30, 0x20000006, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty={[0xe00000000000000, 0xfe80000000000000, 0x8000000, 0xe603000000000000]}}, 0x1c) syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x0, 0x0) 15:56:52 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xc0]}, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:52 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x508}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 294.333197] binder: 14416:14431 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 294.352366] binder: 14416:14431 IncRefs 0 refcount change on invalid ref 2 ret -22 [ 294.360844] binder: 14416:14431 BC_ACQUIRE_DONE u0000000000000000 no match [ 294.368018] binder: 14416:14431 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2 15:56:52 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) r2 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x7f, 0x109180) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000140)={{{@in=@multicast2, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@remote}}, &(0x7f00000000c0)=0xe8) sendmsg$can_bcm(r2, &(0x7f0000000300)={&(0x7f0000000240)={0x1d, r3}, 0x10, &(0x7f00000002c0)={&(0x7f0000000280)={0x5, 0x81, 0x10000, {0x0, 0x7530}, {}, {0x4, 0x3ff, 0x8, 0x844}, 0x1, @can={{0x2, 0x8, 0x9e39f8c, 0x1}, 0x3, 0x3, 0x0, 0x0, "9913c7290e6c2db5"}}, 0x34}, 0x1, 0x0, 0x0, 0x4040801}, 0x4000000) [ 294.427686] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:56:52 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0x6a]}, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:52 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x12, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 294.494902] binder: 14471:14473 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 294.516575] binder: 14471:14473 BC_ACQUIRE_DONE u0000000000000000 node 670 cookie mismatch 0000000000000002 != 0000000000000000 15:56:52 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 294.563387] binder: 14471:14473 got new transaction with bad transaction stack, transaction 669 has target 14471:0 15:56:52 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x6, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:52 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local={[], 0xc0}, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 294.640841] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 294.645029] binder_transaction: 5 callbacks suppressed [ 294.645049] binder: 14471:14473 transaction failed 29201/-71, size 72-24 line 2882 [ 294.732984] binder: release 14471:14473 transaction 669 out, still active [ 294.743907] binder_alloc: binder_alloc_mmap_handler: 14471 20001000-20004000 already mapped failed -16 [ 294.753720] binder: undelivered TRANSACTION_COMPLETE [ 294.758844] binder_release_work: 5 callbacks suppressed [ 294.758851] binder: undelivered TRANSACTION_ERROR: 29201 [ 294.813987] binder: BINDER_SET_CONTEXT_MGR already set [ 294.841068] binder: 14471:14473 ioctl 40046207 0 returned -16 [ 294.867707] binder_alloc: 14471: binder_alloc_buf, no vma [ 294.883043] binder: 14471:14503 transaction failed 29189/-3, size 24-8 line 2970 [ 294.905676] binder: 14471:14488 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 294.929289] binder: 14471:14488 BC_ACQUIRE_DONE u0000000000000000 no match [ 294.949073] binder_alloc: 14471: binder_alloc_buf, no vma 15:56:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x2) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x80002, 0x0) ioctl$VT_SETMODE(r2, 0x5602, &(0x7f00000000c0)={0x400000000000101, 0x100, 0x3, 0x81, 0x53d}) dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:56:52 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000140)=ANY=[@ANYBLOB="e0002001ac1414aa00ff000006000000ee823f32962232f0143191cdd62e8c1245cea22950a9e6f80f640385a3a3de0d6cedfeaad9a779210b7a38e1ebb394bcf395990e954a89606d62248193904f8d34c859c630767f7267f0a94cad547285dc96a8852c6f1040428811"], 0x10) 15:56:52 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x5000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 294.955716] binder: send failed reply for transaction 669, target dead [ 294.963832] binder: 14471:14488 transaction failed 29189/-3, size 72-24 line 2970 [ 294.971733] binder: undelivered TRANSACTION_ERROR: 29189 [ 295.024611] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 295.040730] binder: 14506:14511 transaction failed 29189/-22, size 24-8 line 2855 [ 295.061592] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 15:56:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x20110, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0xb4, 0x0, &(0x7f0000000480)=[@clear_death={0x400c630f, 0x1, 0x2}, @acquire_done={0x40106309, r2, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000140)=[@fda={0x66646185, 0x4, 0x0, 0x18}, @ptr={0x70742a85, 0x1, &(0x7f0000000040), 0x1, 0x2, 0x28}], &(0x7f00000000c0)=[0x30, 0x0, 0x18]}}, @transaction_sg={0x40486311, {{0x4, 0x0, 0x3, 0x0, 0x11, 0x0, 0x0, 0x68, 0x28, &(0x7f0000000380)=[@ptr={0x70742a85, 0x4, &(0x7f00000001c0), 0x1, 0x3, 0x25}, @fd={0x66642a85, 0x0, r0, 0x0, 0x1}, @ptr={0x70742a85, 0x0, &(0x7f0000000280), 0x1, 0x4, 0x25}], &(0x7f00000002c0)=[0x20, 0x40, 0x38, 0x58, 0x38]}}}], 0x50, 0x0, &(0x7f0000000540)="275bf291ee24bd3d6d312b7d0135741e4b26c38fd32f4bffd9916234399619f0023247afc4a14107ee0b02d195b6354d9dca8976a24948e30e795d96ae8d1f9773fa1da139c715d86546edac629a456f"}) dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:56:53 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x8, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:53 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local={[], 0x6a}, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:53 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x100000, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000180)=ANY=[@ANYBLOB="e0000001ac1414aa0008000000000000d4ee20b8e39849d6005f69178d37e017bf87bf2074b8e1ccb8c969747e60ea7c54e42b3fd32019c536f020c7e59b4658e18510a1372244225e15c708000000cf76681c1ae905948dc5bfee6666e8af80beef5667d6e7e87cba6efb7dea4f903aac4e9a758597c8d4677caaca46dc5ca836e8f761535694591aaf84ca79ead8d7a1a58df20be09862e268c9f11953a4de74f0cdcd007cb45e33150adfcf3a6136cd67b639a041fdef17fcd40000000000000000"], 0x10) socketpair$inet_smc(0x2b, 0x1, 0x0, &(0x7f0000000040)) [ 295.082929] binder: undelivered TRANSACTION_ERROR: 29189 [ 295.090712] binder_alloc: binder_alloc_mmap_handler: 14506 20001000-20004000 already mapped failed -16 [ 295.142897] binder: BINDER_SET_CONTEXT_MGR already set [ 295.148216] binder: 14506:14511 ioctl 40046207 0 returned -16 [ 295.169323] binder: BINDER_SET_CONTEXT_MGR already set [ 295.171856] binder: 14506:14526 transaction failed 29189/-22, size 24-8 line 2855 [ 295.187841] binder: undelivered TRANSACTION_ERROR: 29189 15:56:53 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x2000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:56:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000040)) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:56:53 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x4, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:53 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x802, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 295.220640] binder: 14522:14523 ioctl 40046207 0 returned -16 [ 295.228887] binder: 14522:14527 transaction failed 29189/-22, size 24-8 line 2855 [ 295.260097] binder: 14530:14531 ioctl 2282 20000040 returned -22 15:56:53 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000040)={@multicast1, @empty, 0x1, 0x2c9}, 0xfffffffffffffd5b) [ 295.290353] binder: 14522:14523 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 295.298507] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 295.317448] binder: release 14530:14531 transaction 680 out, still active [ 295.324525] binder: 14530:14531 ioctl 2282 20000040 returned -22 15:56:53 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x6, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 295.342780] binder: unexpected work type, 4, not freed [ 295.357936] binder: BINDER_SET_CONTEXT_MGR already set [ 295.366452] binder: undelivered TRANSACTION_COMPLETE [ 295.383075] binder: 14522:14523 BC_ACQUIRE_DONE u0000000000000000 no match 15:56:53 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x80b, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 295.385227] binder: 14530:14540 ioctl 40046207 0 returned -16 [ 295.396491] binder_alloc: 14530: binder_alloc_buf, no vma [ 295.413694] binder: send failed reply for transaction 680, target dead [ 295.419040] binder: 14522:14523 transaction failed 29189/-3, size 72-24 line 2970 [ 295.428260] binder_alloc: 14530: binder_alloc_buf, no vma 15:56:53 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x2}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 295.438558] binder: 14530:14531 transaction failed 29189/-3, size 24-8 line 2970 [ 295.451513] binder: undelivered TRANSACTION_ERROR: 29189 [ 295.472668] binder: undelivered TRANSACTION_ERROR: 29189 [ 295.515934] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:56:53 executing program 5: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x508}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:56:53 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x8, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:53 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x10) 15:56:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x800000000000800) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = dup2(r1, r0) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x2, 0x400) ioctl$LOOP_CLR_FD(r2, 0x4c01) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r2, 0x84, 0x21, &(0x7f00000000c0), 0x4) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:56:53 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x8100, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:53 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0xffffff7f}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 295.626667] binder: 14563:14566 transaction failed 29189/-22, size 24-8 line 2855 [ 295.650917] device bridge_slave_0 left promiscuous mode 15:56:53 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x2, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 295.675969] binder: undelivered TRANSACTION_ERROR: 29189 [ 295.677206] bridge0: port 1(bridge_slave_0) entered disabled state [ 295.683239] binder: 14563:14566 ioctl 4c01 0 returned -22 15:56:53 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x806, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 295.720108] binder: BINDER_SET_CONTEXT_MGR already set 15:56:53 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x500, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:53 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x3, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 295.745850] binder: 14563:14566 ioctl 40046207 0 returned -16 [ 295.774331] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 295.783365] binder_alloc: binder_alloc_mmap_handler: 14563 20001000-20004000 already mapped failed -16 15:56:53 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f00000001c0)=ANY=[@ANYBLOB="04000013a5367f451414aa000400ecff1ca2053bc302982f092d13fe9f00b011ba053872ee9fe1a63e638374baef8395c8ed45864cc14863563818aac44995d50389ead093cbb5fe793e33dd4e8f97c3b7c4b31bdf000000003b2e21ace76b2a1b2687f8000000004656236cb56af29348ab3f5437442b84b2c1d34cd473244be1b9ebce15079e35807a8a49b4534e57f5d7471f7fccc3b0e1a51c47a3f3712b6a768160f1585893f8662b62fbf65900080000000000007228a6f3e4dd0e80fdcb58cfb00f79db51a90919a1c3955c101a32aca7813993c6307933c6dcc4e82de2a5cb77e27a300ec7355f71bbb6ef50d75ebaa1cddeabcb0c5537ac8104ca4fc60838313881e544ab7b32fb3f20bfa06722dc1f5a6b594fa1bc4ed2e5c75c4925694e7ba8124c6763e3c8535712e40a5b9a52be1bc8886482e3bb6c077bc21652d0d28cf7fe14623ca19c8bbc84737a39c1d858ecead965a9fe45642f"], 0x10) [ 295.797028] binder: 14563:14580 transaction failed 29189/-22, size 24-8 line 2855 [ 295.804946] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 295.828013] binder: BINDER_SET_CONTEXT_MGR already set [ 295.842817] binder: 14563:14566 ioctl 40046207 0 returned -16 15:56:53 executing program 5: recvfrom$inet6(0xffffffffffffffff, &(0x7f0000ffbf47)=""/185, 0xfffffffffffffeba, 0x0, 0x0, 0xfffffffffffffde6) munmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000) setxattr$trusted_overlay_redirect(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='trusted.overlay.redirect\x00', &(0x7f0000000100)='./file0\x00', 0x8, 0x3) r0 = getpgid(0xffffffffffffffff) sched_setattr(r0, &(0x7f0000000000)={0x30, 0x6, 0x1, 0x1, 0x7fffffff, 0x7fff, 0x200, 0x4}, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f00008a8000)={0xa, 0x10000000004e20}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f0000000000), 0xe5, 0x0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @ipv4}, 0x1c) 15:56:53 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x500000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 295.874916] binder: 14563:14585 ioctl 4c01 0 returned -22 [ 295.875818] binder: BINDER_SET_CONTEXT_MGR already set [ 295.906429] binder: undelivered TRANSACTION_ERROR: 29189 15:56:53 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x6, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:53 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x600, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 295.972717] binder: 14563:14588 ioctl 40046207 0 returned -16 [ 295.983658] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:56:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR64=&(0x7f0000000040)=ANY=[@ANYBLOB="071000000000d06f81033665b200", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r1, r0) fremovexattr(r0, &(0x7f00000000c0)=@random={'btrfs.', 'system\x00'}) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:56:54 executing program 5: r0 = open(&(0x7f0000000240)='./file0\x00', 0x181000, 0x8) accept4$packet(0xffffffffffffff9c, &(0x7f0000000500)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000540)=0x14, 0x80800) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000580)={@mcast2, 0x50, r1}) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$rds(0x15, 0x5, 0x0) r2 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x8003, 0x0) ioctl$SCSI_IOCTL_STOP_UNIT(r2, 0x6) epoll_pwait(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x0, &(0x7f00000000c0), 0x8) r3 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x0, 0x3ef, 0x0, 0x3f00000000000000, 0x0, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}}) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}}}, 0x26) ioctl$sock_inet6_SIOCADDRT(r3, 0x89a0, &(0x7f0000000100)={@local, @empty, @loopback, 0x3}) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000740)=ANY=[@ANYBLOB="c67bf167e58ab9f156330b0fe4cb40973091db8817ede93f126297d0c290a3628d0d9064978b206a9f8531318427d3a51f000000c24d1e4401cf0ae6e99a3493ea9c3cf0d0636acfc2910500002212342c0d3bd9cce10e4ac8e589e514b8ade04569645e6cb4f6cca285aa626461e639b9f80e00005e43cfefc80aa3fc9551440a0274edafebca67d76106143ba8999717373dcb9f0d2734c2e2f6a04ab29334f905c846f3e63600b522b9a5eff32970382b2e403cf4efb27b15bee2e5b411e789d11460"], &(0x7f00000002c0)=0x1) socket$vsock_stream(0x28, 0x1, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev}, 0x1c) ioctl$EXT4_IOC_ALLOC_DA_BLKS(0xffffffffffffffff, 0x660c) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x8916, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x0, 0x3ef]}, 0x3}) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r2, 0x84, 0xf, &(0x7f0000000300)={0x0, @in={{0x2, 0x0, @rand_addr}}, 0x459, 0x10001, 0x3ffffffffffff, 0x81, 0x3}, &(0x7f0000000080)=0x98) r4 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000280)=[{0x3, 0x76d}, {0x7, 0x2}, {0x0, 0x401}], 0x3) ioctl$KDGKBMODE(r4, 0x4b44, &(0x7f0000000200)) 15:56:54 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) syz_open_dev$ndb(&(0x7f0000000ac0)='/dev/nbd#\x00', 0x0, 0x8002) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x2000, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000980)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x13, &(0x7f0000000940)='vboxnet1[keyring,/\x00'}, 0x30) r3 = getuid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000009c0)={0x0, 0x0, 0x0}, &(0x7f0000000a00)=0xc) sendmsg$unix(r1, &(0x7f0000000a80)={&(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f00000008c0)=[{&(0x7f00000001c0)="3238cfc09d0d2d8f54a6086514c0237089ffad92c50d02bfb401e4b45e471d5147966b4cea9ad3342c6b67ea9ef7b971d3faaeb5b94fe64f90309c2fd40e8abdbb7c9cc663bdd72eca188a459cb0355b78b37daa696e32d2e4ff20ffa58dea6e63190da54bab4e4dce160a7fabb2503ee541d433112aef7fb2b9f68522321a07064b746397b7f83d54a85f3695e3ca49f765be9d68e364429207d69d9267d12d1ecc52208f8ca9928972", 0xaa}, {&(0x7f0000000280)="0e9105593e1acb5ce04d4664524719db40fe584ea601dfb9570c968f902d1d90509f3b8b6d952e807133c6f8cd9018c92c72ff54b34f8775c83d30402860cc42030cac783b150049da92e17a90ee2fb695b58da6a5219198cb753519b61b8962420287915c9fb1009317ae9fc936b3069a7bed614382e8c0e6b9ea2adf1c0b3b5736f697cee508e5977a8a89bd9cae41c1636edcc58df660f8a41e94bbb54ff0a85a5e31e0c87e804f8bec36684d0abf", 0xb0}, {&(0x7f0000000340)="afc60b7282b08eb19ea8b002a5c1d48e62d545781bcc0b3fa627a902e6d7144b353f4804aa7656cbdf9f2c1e2b1616f81586493fbc666707b730f90940af858ede5376d9cf158ae67c26ce0716c52eadf206f935c65a038b0db9807e59107f4cbc498ef12a16821b250f1d546e12ec7f5d19f6c7e8f188441874d5d999c24bdf5c4a0dfd505c908e31511c31d417ff58c7b0fc74f1c344e6428d8fc4b00a5763bf5c46719a9b99adaa02f470137202bc0969bc73626b586d332e18582afecebf0c04d7d872d8eb0398792edfb24bffaba720cb05a0a46699e7a0e9076d2486dd36938ed6e57a34713c", 0xe9}, {&(0x7f0000000440)="933b9c5390f320268f4782c276665a443698538c9601a0658baddee0933fce61cbe29782e85c58d07f847043b3835c0e49c2131c24cd223013ef0138ab0d1247fa9f48e846e4f4025390c6e6fc7bce012db5d4d175b14dadfc9395321f417595b9750bfd415bfedf4701e86fe69d", 0x6e}, {&(0x7f00000004c0)="013392c700ac44e014a7d1a217392c30a94f658e907c9f1c199635d41b9440868919f2cbd17d8e7fe02fdded78ab6abc640b42441ae776e0b59f229608efae99a5451e2419d18b009a55cd59f9b140d24110b1a1d928a251e8e2fd00f21bcfb111cb51630b4975cb6e02e7fd614ba8a8ca3a592da133584aa69fe3d12891f80c254b535ef7a840ceddd4a7c1486d2b0b79d1fe19", 0x94}, {&(0x7f0000000580)="b1775cae022be2cc0448c943f9b185b9f1057d9b7892efbd873920e4e936b2a1f8a25c7ea9c9f3d5fc47d0f9c66a4519b7386e9b22cf8e986680b8abeb0ad507c78d798af548bc54095d0d25aed4da54faf8ae5aa2b2cbbfa9871405b13d2fcdfc8880cc9a6d4b34bcb25fbac44ccd8090d6b38617969fcb35689095680d78c811ec544df94c191f0345f484a4d794271672e575d4013ac0579c822f78141139f5e7e7e60de781ec1941f2e995bbf4b78c6a9b1c49640f0573c75338251d4f97e604266387d9780a50528eccfa2fcb52b9d303070c1d468a", 0xd8}, {&(0x7f0000000680)="286a5ad3316754b31b5cd23ae56bf3a996a43b9f83b5da34d135ee5a650f0b7d12035b6c990412c41634500c1d3662dc905a5fbc2e744a2507b1f69cf53e0704d2adb625e7254a72b1c991ea1abb56f92ce9c10f257ae4a6f5f7d8a9a521fbf277199270e5bd1ed1563c0cd6fbbcec5eee3f7ae0bb82fbfeb53c0bb74f8fa5b19e18cefa699c7cba25c0fcf70258fd14", 0x90}, {&(0x7f0000000740)="a2bb7adb68130b69cf1717543548161c1d4d040119660974a5e98d4885b4638a3d8bb71224005b0b9314be4c2d3a6899d9e8b8dc59e1f1a30267762b6ef7e0c5c20ecd8a190727827d3a62243f3445939a3c", 0x52}, {&(0x7f00000007c0)="82b96fd7a307a75a1a38d1622fac8ed5c97ac006a9b39fb71d5c77cfe76c4f08d822a15ecd14fb8f5bfae8e852129631a093083df7497636eeb18cb27f3954fdcad9249cf30b552aa12cd4e76c345ae01d0fe590df5f46137e6a82020e17564725f9cdc64d07095868ddf62bf15527327013153a93e5f6af26ce1c1959cb19c8771e88d0b5ca6c4f506ec2d33ec291c5939ea938e1748eea773ad3529133dfaa00e11ed8bc9759e8ab509e88ec6e1a1833b8b0b97e3b79e1fde1b9f39b5ed75912dcfe3ecb5ee74dfbb25b36d586739c3c36980c0b6946f470bf", 0xda}, {&(0x7f00000000c0)="19309c1a48", 0x5}], 0xa, &(0x7f0000000a40)=[@rights={0x10, 0x1, 0x1, [r0]}, @cred={0x18, 0x1, 0x2, r2, r3, r4}], 0x28, 0x814}, 0x4000000) r5 = getpid() sched_setscheduler(r5, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) 15:56:54 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x600000000000000, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:54 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:56:54 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x8864, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 296.161272] binder: 14616:14617 got transaction with invalid offset (0, min 0 max 24) or object. [ 296.211078] binder: undelivered TRANSACTION_ERROR: 29201 [ 296.225926] binder_alloc: binder_alloc_mmap_handler: 14616 20001000-20004000 already mapped failed -16 [ 296.248696] binder: BINDER_SET_CONTEXT_MGR already set [ 296.254611] binder: 14616:14617 ioctl 40046207 0 returned -16 15:56:54 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x85c, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:54 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000040)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) [ 296.261175] binder_alloc: 14616: binder_alloc_buf, no vma [ 296.267335] binder: undelivered TRANSACTION_ERROR: 29189 15:56:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000008000000000000000000", @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) r2 = dup2(r1, r0) fcntl$setflags(r1, 0x2, 0x1) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x25dfdbfe, 0x10}, 0xc) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) r3 = getgid() setfsgid(r3) 15:56:54 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x7000000, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 296.321060] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:56:54 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x807, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:54 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x300000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:56:54 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x3f00, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 296.450226] binder_alloc: 14638: binder_alloc_buf size 2251799813685272 failed, no address space [ 296.478697] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 296.534701] binder_alloc: binder_alloc_mmap_handler: 14638 20001000-20004000 already mapped failed -16 [ 296.573447] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 296.579999] binder: BINDER_SET_CONTEXT_MGR already set [ 296.606775] binder: 14638:14640 ioctl 40046207 0 returned -16 [ 296.617521] binder_alloc: 14638: binder_alloc_buf, no vma 15:56:54 executing program 5: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x80040, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() ptrace$setopts(0xffffffff00004206, r1, 0xfffffffffffffff7, 0x4) waitid(0x0, r1, &(0x7f00000000c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x10, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000300)='rdma.current\x00', 0x0, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000100)={[], 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x1d000}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x4) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) socket(0x40000001b, 0x0, 0x0) r2 = getpid() rt_tgsigqueueinfo(r2, r2, 0x16, &(0x7f0000000100)) ptrace(0x10, r2) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) listen(r3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x8000000004) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000000100)=0x68df, 0x4) writev(r4, &(0x7f0000000380)=[{&(0x7f0000000300)="580000001400add427323b470c458c5602067fffffff81004e22000000050028925aa80000000000000080000efffeffe809000000fff5dd0000001000020000000000000000cfb193e7ee00000000000000000000000000", 0x58}], 0x1) 15:56:54 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x8906, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:54 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000140)=ANY=[@ANYBLOB="40933400eafe6578eee0c1477f53abdb5bd75186a8f9e3abc76e44511e45d7f701c6dc59e65bf77d1417c39c2b96617585ad36e1cbe2c4a2ca75d435a6cbbff1de6d7f05cc51eb85a45fc7515f678e2340f4f358c9d8490c93c9f8c73533eaa0f5130118e6d9260066ef42236a8aab09ad8a509b8cf7f88abfbbaa02353873d7cc0d9aff60621d438bcf8e2209f6209f60192c2bd30566be42c855924ca14c653d5186400137dba8a89e561ce28df5cdd956c2b333"], 0x10) socket$inet_udplite(0x2, 0x2, 0x88) 15:56:54 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x5400000000000000, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:54 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x805000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:56:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/connector\x00') ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, &(0x7f0000000400)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB="f11b00feffffff00"]], 0x0, 0x0, &(0x7f00000003c0)}) r3 = dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) r4 = mmap$binder(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000004, 0x20110, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x0}) ioctl$VHOST_SET_LOG_BASE(r3, 0x4008af04, &(0x7f0000000380)=&(0x7f00000002c0)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x20, 0x0, &(0x7f00000000c0)=[@free_buffer={0x40086303, r4}, @increfs_done={0x40106308, r5, 0x3}], 0x82, 0x0, &(0x7f0000000140)="99064f802d8252e77d844c1a199ce61bee230c5b33b42a93beb9d79d67f917ce7f52554dda73f5b2f9972f2eafc94455aee59c79c008756dde5bed5482c37e0110ff385853262d48ee8f68c3121565e5db07b2200e49d7b989fe653b4e8d9915781ad18dae2e6a40b84482c5874e9b8f2f80fddb3e5124078f564ee8754946767bfc"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:56:54 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x400000000000000, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:54 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x8848, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:54 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x200, 0x0) write$binfmt_elf32(r1, &(0x7f0000000200)={{0x7f, 0x45, 0x4c, 0x46, 0xe1, 0x7, 0x1, 0x8000, 0x5, 0x3, 0x6, 0x400, 0x104, 0x38, 0x21f, 0x7, 0xff, 0x20, 0x2, 0x101, 0xc4, 0x7}, [{0x6, 0x4, 0x3, 0x80000001, 0xffffffff00000000, 0x80000001, 0x9a}], "70063d3228f2ab19c7f8febcfe482bcfba2833f51ca468ce44a7b209fb348c0017f266722ae5f4113d605c0fe9b6dc1ebc525674e78cc868099d72caab0f4a", [[], [], [], []]}, 0x497) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f00000000c0)=@assoc_value, &(0x7f0000000140)=0x8) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$KVM_GET_PIT(r1, 0xc048ae65, &(0x7f0000000180)) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) [ 296.774034] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 296.802767] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:56:54 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000001340)=@broute={'broute\x00', 0x20, 0x3, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200004c0], 0x0, &(0x7f00000003c0), &(0x7f0000000200)=ANY=[@ANYBLOB="000000000000000000000000929a44bd181d00000000000000000000000000000000000000000000000000000000ffffffff010000000000000000000000000069705f76746930000000000000000000627269646765300000000000000000006272696467655f736c6176655f31000074756e6c300000000000000000000000ffffffffffff000000000000aaaaaaaaaabb00000000000000007000000070000000e00000006e666c6f670000000000000000000000000000000000000000000000000000004c0000000000000000000000000000001f046064bb0767a8005c1d5b5b14aa5d040ea366d92341f699858be642a4b84ff185c7d7283e35d325aaa4e49249aa038ddef7118410b8443d1fa71cbb1edc73000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000001200000000000000457a9be22ffbbd6c0f89d97bb234ec6ce6acedd86150be3668e4"]}, 0x1e0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000440)='/dev/autofs\x00', r1}, 0x10) 15:56:54 executing program 4: recvmsg(0xffffffffffffff9c, &(0x7f00000002c0)={&(0x7f0000000140)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80, &(0x7f0000000040)=[{&(0x7f00000001c0)=""/227, 0xe3}], 0x1, &(0x7f00000000c0)=""/18, 0x12, 0x1798}, 0x20) lseek(r0, 0x0, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000300)='/dev/dsp\x00', 0x80001, 0x0) ioctl$DRM_IOCTL_AGP_ENABLE(r2, 0x40046432, &(0x7f0000000340)=0x2) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) [ 296.824262] binder: 14677:14679 got transaction with invalid offset (72057594004380657, min 0 max 24) or object. [ 296.877938] binder: 14677:14679 ioctl 4008af04 20000380 returned -22 15:56:54 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x400300}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:56:54 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x848, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:54 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x8000000, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 296.920318] binder: 14677:14679 BC_FREE_BUFFER u0000000000000000 no match [ 296.945909] binder: 14677:14679 BC_INCREFS_DONE u0000000000000000 node 694 cookie mismatch 0000000000000003 != 0000000000000000 15:56:54 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)=ANY=[@ANYBLOB="e00000c2c4d990cff8ccd9230620bc00"], 0x10) [ 297.025530] kernel msg: ebtables bug: please report to author: Wrong len argument [ 297.033979] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 297.056750] kernel msg: ebtables bug: please report to author: Wrong len argument 15:56:55 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0xb000000, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:55 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x808, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 297.600805] binder_alloc: binder_alloc_mmap_handler: 14677 20001000-20004000 already mapped failed -16 [ 297.610974] binder: BINDER_SET_CONTEXT_MGR already set [ 297.616455] binder: 14677:14707 ioctl 40046207 0 returned -16 [ 297.616645] binder_alloc: 14677: binder_alloc_buf, no vma [ 297.628479] binder: 14677:14707 ioctl 4008af04 20000380 returned -22 [ 297.629778] binder: 14677:14727 BC_FREE_BUFFER u0000000000000000 no match [ 297.642290] binder: 14677:14727 BC_INCREFS_DONE u0000000000000000 no match 15:56:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = gettid() tkill(r1, 0x2) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x20010, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB="0019620000000000"]], 0x0, 0x0, &(0x7f00000003c0)}) r3 = dup2(r0, r2) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0200ff36e3d7a3637d20e928f2826bef98"], 0x0, 0x0, &(0x7f0000000500)}) ioctl$SG_GET_TIMEOUT(r3, 0x2202, 0x0) 15:56:55 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x34000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:56:55 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(r0, &(0x7f0000001380)=[{&(0x7f0000000140)=""/148, 0xfffffffffffffc1e}], 0x0, 0x0) open_by_handle_at(r0, &(0x7f0000000040)={0xf7, 0x0, "bf7be4d7cac79086668f404ea045dd80573db043792bdb6f10f97220cc5c268c5b7787fae5482789d0d7f836f788a0322f365d58d6bb0177cd46afda72a23aae75aa286576da95b954d01877945a7e5963e057f34b4c13ff66b385c9df4415c18c5f5f132a44d06ac2d51a8a9288c05f85ba8954f02188deaffc47f51412eb07e24c53f7a4406854ffc32b112b6f6085a9904ac04db85f1c279c6f7de54b8329efde85487e1c50aa789af1d37b80270d98eb87ae4414630654fcd38ce9b67bcdc4e8cbd6acbc863065b1fbe6a64d6043fdb718707346fec33905a36b66fb7eddb0661741363595ec147127fdb24726"}, 0x0) prctl$setendian(0x14, 0x3) madvise(&(0x7f0000ff2000/0xe000)=nil, 0xe000, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ptype\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x6c00) 15:56:55 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)=ANY=[@ANYBLOB="e0000001ac1414aa0000000006cd0000"], 0x10) ioctl$BLKREPORTZONE(r0, 0xc0101282, &(0x7f00000001c0)={0x6, 0x2, 0x0, [{0x0, 0xfffffffffffffff7, 0xfffffffffffffffe, 0x8, 0x101, 0x53a3, 0x2}, {0x8, 0x7, 0x3f, 0x65d, 0x80, 0xad63, 0x80000000}]}) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cpu.stat\x00', 0x0, 0x0) recvfrom$unix(r2, &(0x7f0000000280)=""/105, 0x69, 0x100, 0x0, 0x0) setsockopt$packet_buf(r2, 0x107, 0x2, &(0x7f0000000140)="c43ba9289460b9ebee989b40cf56bc15c8667dbe9d95e8347b77c3208167b6b353dfc6bab520ace417f8942df3a4bd3ef9d8bde388a77fab7246e262c79cfdb74c694da98638b38a2db2cf134aef33597627166708030e81", 0x58) 15:56:55 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x700, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:55 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x300, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:55 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x4305, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 297.717272] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:56:55 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x81000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:56:55 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x8035, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:55 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x600, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:55 executing program 5: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x80000000200, 0x1) ioctl$KVM_SET_CPUID(r0, 0xc0185500, &(0x7f0000000080)=ANY=[@ANYBLOB="23aaec0564"]) mmap(&(0x7f0000fed000/0x13000)=nil, 0x13000, 0x5, 0x8011, r0, 0x0) connect$unix(r0, &(0x7f00000000c0)=@abs={0x1, 0x0, 0x4e24}, 0x6e) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000000)={0x0, 0x6}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000180)={r1, 0x1, 0x1}, &(0x7f00000001c0)=0x8) 15:56:55 executing program 4: r0 = fcntl$getown(0xffffffffffffffff, 0x9) process_vm_writev(r0, &(0x7f00000001c0)=[{&(0x7f0000000040)=""/59, 0x3b}, {&(0x7f00000000c0)=""/43, 0x2b}, {&(0x7f0000000140)=""/73, 0x49}], 0x3, &(0x7f0000000280)=[{&(0x7f0000000200)=""/79, 0x4f}], 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f00000002c0)=ANY=[@ANYBLOB="e0000001ac1414aa0000000006000000f18f364b77353ae554f8f223e86cc61f059c07be2f01397fcc3cd28a5ccad4adbb001026c1997173d7a62038ebfbdbdea0d327fc6d652ded0b31a7808b71bef04a238ded91157338c17abc37b8d1d062cab1773669e5cec1d2e9a0f891e0f11669e42ee591449f71a58b28ffeff06e21213100b931ce1128369c9f7e4ebd9789b5964f4f43921d2193638c503f98547c5b3aac9c1fb8fe7488eddce46d0d4196d0202bbf2332053993a5b2b48329def8e418872ff57f07b473b30e907bd7f19b125a248f975a5a2ed4bfb6af3dd30c135280c0da8280c88cfea97edfa3f3070119648845518ffa70c9b32d237103720c8d3f6364bd2c28"], 0x10) 15:56:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x12b, 0x0, &(0x7f0000000140), 0x4b, 0x0, &(0x7f0000000280)="376c7f99715892c5a41215ce4f4bafb10ce927bd44e8bdf299befc49079449f7c9067b1b9a59b23f18fe2356d5100f1cab75add37d57e9495084fe2375f3d9d3ec417c0000000000000000"}) r2 = dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$PPPIOCSMRU(r2, 0x40047452, &(0x7f00000000c0)=0x6) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="04630440fc9a0000"], 0x0, 0x0, &(0x7f0000000500)}) lseek(r2, 0x0, 0x7) [ 297.869289] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:56:55 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x3400, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:55 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x54, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:55 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x8847, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 298.000735] vhci_hcd: invalid port number 100 15:56:55 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x60}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:56:55 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000040)=ANY=[@ANYRES16=r1], 0x1) [ 298.021097] vhci_hcd: default hub control req: 23aa v05ec i0064 l0 [ 298.030616] binder: 14761:14769 unknown command 0 [ 298.032075] vhci_hcd: invalid port number 100 [ 298.041216] vhci_hcd: default hub control req: 23aa v05ec i0064 l0 [ 298.044268] binder: 14761:14769 ioctl c0306201 20000040 returned -22 15:56:56 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x300, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:56 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x8, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 298.103375] binder: 14761:14769 ioctl 40047452 200000c0 returned -22 [ 298.116942] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:56:56 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={&(0x7f0000000500), 0xc, &(0x7f0000000540)={&(0x7f0000000000)=ANY=[@ANYBLOB="30000000180031030000000000000000020000000000fe02000000001400090008000000", @ANYRES32=0x0, @ANYBLOB="0800040031abcccfb3f4267aef44f335eb9cb944e16ac1e3dab3704c3640fae502b030b23693ec72aa8f0373f9ab9e834c8c1a63f0ad6e7bf5b3ca6245af60251f33dd90d7b74d48a88d0217c3d9e15db1ea2b1466a30b45924648c3534026162ba8c36e72ccf3c08924a0f73f87479d7a076b52070e0b241ddc89822054f35ad1ac63bb839d947ba7cd3b47850008150d3de1c8528db4251b0edbdb3667ccb6d2b023287cde69fdf2180a7aab8595b72c230a2ec4337a", @ANYRES32=0x0], 0x30}}, 0x0) [ 298.143903] binder_thread_write: 12 callbacks suppressed [ 298.143918] binder: 14761:14769 IncRefs 0 refcount change on invalid ref 39676 ret -22 15:56:56 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0xf0ffffffffffff}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:56:56 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x1000000, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 298.213745] binder_alloc: binder_alloc_mmap_handler: 14761 20001000-20004000 already mapped failed -16 15:56:56 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x1200, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 298.258425] binder: 14761:14769 unknown command 0 [ 298.264920] binder: 14761:14769 ioctl c0306201 20000040 returned -22 [ 298.285078] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 298.292327] binder: BINDER_SET_CONTEXT_MGR already set [ 298.300514] binder: 14761:14796 ioctl 40046207 0 returned -16 [ 298.315705] binder: 14761:14776 IncRefs 0 refcount change on invalid ref 39676 ret -22 15:56:56 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)=ANY=[@ANYBLOB="e0001901ac619a5b866ef2a6bd8c86561414aae40000230006000000"], 0x10) 15:56:56 executing program 1: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vhci\x00', 0x400000, 0x0) ioctl$KVM_TPR_ACCESS_REPORTING(r0, 0xc028ae92, &(0x7f0000000140)={0x9, 0x5}) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000000240)={0xbee}, 0x1) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) prctl$getreaper(0x3f, &(0x7f0000000040)) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR64=&(0x7f0000000180)=ANY=[@ANYBLOB="000000c94000000000488957f5b0f89a464f8f483ddb5c64ae140010be453b55"]], 0x0, 0x0, &(0x7f00000003c0)}) r3 = dup2(r2, r1) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="04630440010000004a453656185e4283"], 0x0, 0x0, &(0x7f0000000500)}) ioctl$SG_SCSI_RESET(r3, 0x2284, 0x0) 15:56:56 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0xfffffffffffffffe, 0x800) r1 = syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00') accept4$packet(0xffffffffffffff9c, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14, 0x80800) recvmsg(0xffffffffffffffff, &(0x7f0000000900)={&(0x7f0000000400)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, 0x80, &(0x7f0000000840)=[{&(0x7f0000000300)=""/24, 0x18}, {&(0x7f0000000480)=""/222, 0xde}, {&(0x7f0000000580)=""/116, 0x74}, {&(0x7f0000000600)=""/139, 0x8b}, {&(0x7f00000006c0)=""/181, 0xb5}, {&(0x7f0000000780)=""/183, 0xb7}], 0x6, &(0x7f0000000880)=""/65, 0x41, 0x6}, 0x21) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000001c80)={{{@in6=@remote, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}}}, &(0x7f0000001d80)=0xe8) recvmmsg(0xffffffffffffffff, &(0x7f0000003900)=[{{&(0x7f0000001e80)=@nfc, 0x80, &(0x7f0000002140)=[{&(0x7f0000001f00)=""/228, 0xe4}, {&(0x7f0000002000)=""/73, 0x49}, {&(0x7f0000002080)=""/41, 0x29}, {&(0x7f00000020c0)=""/104, 0x68}], 0x4, &(0x7f0000002180)=""/143, 0x8f, 0x7}, 0xdf2}, {{0x0, 0x0, &(0x7f0000002280)=[{&(0x7f0000002240)=""/17, 0x11}], 0x1, &(0x7f00000022c0)=""/83, 0x53, 0x7bf}, 0x101}, {{&(0x7f0000002340)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000003800)=[{&(0x7f00000023c0)}, {&(0x7f0000002400)=""/7, 0x7}, {&(0x7f0000002440)=""/120, 0x78}, {&(0x7f00000024c0)=""/219, 0xdb}, {&(0x7f00000025c0)=""/169, 0xa9}, {&(0x7f0000002680)=""/81, 0x51}, {&(0x7f0000002700)=""/4096, 0x1000}, {&(0x7f0000003700)=""/213, 0xd5}], 0x8, &(0x7f0000003840)=""/154, 0x9a, 0x1f}, 0x4}], 0x3, 0x40000100, &(0x7f0000003980)={0x77359400}) getsockname$packet(0xffffffffffffffff, &(0x7f0000004140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004180)=0x14) getpeername$packet(0xffffffffffffff9c, &(0x7f00000041c0)={0x11, 0x0, 0x0}, &(0x7f0000004200)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000004240)={{{@in=@local, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@dev}}, &(0x7f0000004340)=0xe8) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000004380)={{{@in6=@ipv4={[], [], @rand_addr}, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000004480)=0xe8) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000044c0)={'team_slave_1\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000004780)={'vcan0\x00', 0x0}) getpeername$packet(0xffffffffffffffff, &(0x7f00000047c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000004800)=0x14) getpeername$packet(0xffffffffffffffff, &(0x7f0000004840)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000004880)=0x14) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000048c0)={'vcan0\x00', 0x0}) sendmsg$TEAM_CMD_NOOP(r0, &(0x7f0000004e00)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20042000}, 0xc, &(0x7f0000004dc0)={&(0x7f0000004900)={0x4b0, r1, 0x400, 0x70bd29, 0x25dfdbfb, {}, [{{0x8, 0x1, r2}, {0xac, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x2}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0xbe}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r3}}}]}}, {{0x8, 0x1, r4}, {0xf4, 0x2, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r5}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r6}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x1c3f}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r7}}}]}}, {{0x8, 0x1, r8}, {0xf8, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r9}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x3}}, {0x8, 0x6, r10}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x4}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r11}}}]}}, {{0x8, 0x1, r12}, {0x1e4, 0x2, [{0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x6}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x100}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x4}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r13}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r14}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x6}}}]}}]}, 0x4b0}, 0x1, 0x0, 0x0, 0x20000850}, 0x4000) r15 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r15, &(0x7f00000003c0)="ca", 0x1, 0x0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [0xffffff8d]}, 0x1}, 0x1c) listen(r15, 0x7fff) accept4(r15, &(0x7f0000000340)=@alg, &(0x7f0000000040)=0x80, 0x0) 15:56:56 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0xfffffffe, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:56 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0xf00000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:56:56 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x803, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:56 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0xfeffffff00000000, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:56 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)=ANY=[@ANYBLOB="e0000001ac1414ba0000000015000000"], 0x10) [ 298.479661] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 298.519611] binder: 14820:14821 got transaction with invalid offset (278250127360, min 0 max 24) or object. 15:56:56 executing program 5: r0 = socket$inet(0x10, 0x3, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000140), 0x4) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000080)="2f0000001800030007fffd946fa283bc8009000000040005031d8568080003000800000016ccbb24e0710b42fa3ccc", 0x2f}], 0x1}, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x400080, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r1, 0x40405515, &(0x7f0000000100)={0x6, 0x5, 0x401, 0x8, '\x00', 0x2}) mq_timedsend(r1, &(0x7f0000000180)="0f427a2803a009d81d91e45ac6853a6258e07bb8bc4f0c6fd74576cf7618f262990b50589ae16ad78cd3192a2e2d711eaa1ba6765f78a6fe95922681b6192dc95e215cf4a7402fad2f21e95375614a1fcc2dc0038272c92f38ccb7d215e5e7425d023ddc6366825e4ed735aa7646a623e3", 0x71, 0x72, &(0x7f0000000200)) 15:56:56 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x4, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 298.566359] binder: 14820:14821 IncRefs 0 refcount change on invalid ref 1 ret -22 15:56:56 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x4000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:56:56 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x800) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0)='nbd\x00') sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xc20802}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x38, r2, 0x20, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x120}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xffffffff}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000040)=0x2) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000140)=ANY=[@ANYBLOB="80000000000000100000e40d311acf41f5de7bf43ce5ae7357b0cfe879da1a828d5e4a820f83de2dcc660a2996b5eee11d14b197d2ba65063841d721011179f7e978dac46771a706da7ffd60583a7bb8237da4e16107"], 0x10) setsockopt$inet_sctp_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000000280)={0x6, 0x6f14, 0x3, 0xc5}, 0x8) [ 298.629706] binder: 14820:14834 ioctl 2284 0 returned -22 15:56:56 executing program 5: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x16803, 0x0) sendmmsg$alg(r0, &(0x7f0000004f00)=[{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000040)="ba7c9a25298185e0dc7900217614fcd80532aa59179e44753cd38ac01b060fa52e1d438c06be3bfb3457f2f76e1d451d7bf88f425cbd86b959275b8976c9bdccb8849e35737908a674ff270b57f77df85bfbef09867d9e423d5ffeb6994df62193493a8031316f", 0x67}, {&(0x7f00000000c0)="411a59dccd512463e267b6f5b890c87d975191f274f8de7fe050c4f9476d9b5757c86fe473fc62979bc79e2b968d468628a729a0566d9a031086706043ff232b7353e2e3a0c895c66c66447f524f97c1154f357902eb0110ebb12cbbf2f0ac1914b521e9", 0x64}, {&(0x7f0000000280)="cd1274991b204cd8c9552ff723b11e246a04726d8904ca1314b3d7de2207e31f276a777287536fb44283c259f653565f58aa1f2ea52cdb4b04d95070de9a075413ccc048ea365896fee22355324f4f260a16ab5463366109203d7b4806e54e19a1be671b95554f5feb44cbbb1d5d5efc6d0961422e46e24d8fd635a543f36a83465f9fa35440010197856bca84dab1b532a2ade26dd5f9a5a483aaeb94411cf0aa3409b23ba32f0ab0177df206db758a419fe6630ebd529c894068721e4287748a1af97ef19d3ba62f158bda7fbb546a5fa6ad712981", 0xd6}], 0x3, &(0x7f0000000180)=[@assoc={0x10, 0x117, 0x4, 0x3}], 0x10, 0x14}, {0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000380)="e039722d73a3b57807d5afe06d82f25970dfa734904088266469cb2ce57741fc1bf1592bf05fb05839671ec5f1b502b6b05629492252df9043142018e3e87d7011a946fe60d82011e8868bd4672e949f6172a5acac6bb4a07f24d7e031289fa47b3da50842f380ee9770cefd244d9ddbf54db95900a995f649ee8ae4db7cfbc328a06a3ab47875a1371ebd4fde82ea6bbd0daa9f2ca6c469846f4984be07a87e129a44c414abaee61d6b892128351c7a01b9fb80c75ce0e45f8cb94c27e212cc30659fb0fa3a6f3a33373ac8ee37d786fda7869a3724566e", 0xd8}, {&(0x7f0000000480)="a3e9c81779f813b6322feafa0c13c08d728697123bcd3b6d825777175059682c2b0f6cbe2d5b380626b92838b885d73b5393d778e219fb934efac5c8185a6e8ca498fe4a70f0c17099a9881e0706b52dc47352129854e4603e9fedc147f30105495b7ffc88df5780c9a08fece2a0c984815ce30ba8e4658b299e286ee67d4fca0a26b6c656b5b1a71eaf986cc58c305192d221d5b8b8305e8ea0a8ca4d010c0ae91e712667312445dd0a1ecdfffabc5b13e9a5900f76ff7e8c4198979d0bae9144a24e362cef8066a0f282061c14a49defb09953ac57630b225f1bffc1b2deb3735881cb1a5c250e2dd01682eafa0be01c8288ec320aabada6964953", 0xfc}, {&(0x7f0000000580)="52cf1d3d96c3cbc863a3f89620c4787bc72beacb15a6502db8fa269a6d416bb363e2b28899aac03906f15c092d4af2074b9a01091262b105239b67d618e3ed8f8977f6c2e228fa96ed9a29704f0ab841d19b62ea9ad3b058338edb30fda822ff331e62aff942aedfbfdffaf45720eea1722fcb29db7df5b81a876e0fdb43edc2ec2d3cdabbece25693ffcd53a075bc2d2f388d190f36355ce6385f", 0x9b}, {&(0x7f0000000640)="2e575d360a131ef0a9125c4fed510004b51fd1fc9f2027d6bd5a6e672fe9ae10141bd53ffb6616a2b9bcfddf6561a980239783f87337ed989e942c130ba6238641eb85cf184f3ecee9fc6b4d16df0a973281dbd8c0f55dc068167f0fd6660cccd985efbb997e4b14d275e6611e0bea8a2fb6ea315208a953d07568904abc00a533c1ff8532924a284094f2cca5d4818badf5d48c17cf029b63bbbacd4d3ced8dd6ab53727d13d542c850b51ed5d7104c1a275777aece49e0d0803125be80df698eb4e4bb63796493e7668b6279d63d10", 0xd0}, {&(0x7f0000000740)="bab675eac77d1b6117571144b1891bcc819c8a5637b6fcded3afa7c8601b28157f05b5bdd5e775a48ec4966cfbe448d1c837d78900f7a6f58fc07d3fc4855b1cd1891cac72d50951fb3caf98f405bb692c7b9ca8072d3d240ff71ccc4eda999c3122070efa0844e69b08d34827cfeea1aaaf", 0x72}], 0x5, &(0x7f0000000800)=[@iv={0xc4, 0x117, 0x2, 0xb3, "dcab776bb0b7927e57f1ed08f7fe488a0cf6e12d0ba33c6bfa49e65c8ee5adf3892da46607883499d8612a8ec213510127f9b6a8f639c0fb8d80883599d336155a1251d9144ad1b1b01f853fa18b4bb751e7a596336961682d0de3e95fc172e98be4d027e898b7c8d6fb6946e0ee75f64c6729e809e86df775b5459114a9332429bbdf4557e455e0cf877820b5c09f61b1fce618a8c3cc922542501faa00830cbe20845c36b9d4b5cd8aaeec073cd99745a9c8"}, @iv={0x100, 0x117, 0x2, 0xf0, "a49f0c42e8ddb76cd410ceff14a0243cb6e334b3d1ab39592b34d1c0be2662c4b87a7f81825f5a5194e94bef94d0879578ea3555561a9ebf47c4931ed260ba11c7c7d90cdef4f0509b44b4efa8480554ff262ec3bf6fc3ff307e12146a489a0814c9886b0fdeb1095a97785df6e5e22b74380a1a71bc1ae954152373dcb57b235e73953e77cc477e10316789a336cb8dbcb96ec46e20d42d004a210136d71b00cfa0c9005d54289df699ce30f13cc8b4453929226ba352754081c0f1f19c006d88736155477e1955d4d6145752b318c0d29f4a7e5f98618a11c36ee6bc847918e4db1261d1a0614ab26c06857e72c59d"}], 0x1c4, 0x200048c4}, {0x0, 0x0, &(0x7f0000000ec0)=[{&(0x7f0000000a00)="60f0b558f2f76d1dba15a5dd481c4eda8bc8ae389ef9ce4fde7d2fd9217146ae186492a0e48dada8fdce8f12377231f46c49dc75b3ab405d344659a262fa86bfac8ed09a9d1b743be7337be22747cc8ecab4db66f52a094a5ca42d4d26c75d064cbf676af4c03f8f542ecdf525e652a51882b3ba5a55d428f6ebeb9e95a1b3a7c378ea580d630c3f402b8f14bf90969c4d72d48c64ac393ad2ca05b92e6669a753116a1be1ddf5986de78ead7e2791b708545270280390af5efde0051f3f830f7ff9890069caae6457f925350661d48be309916a57fbd0cbff48edd9bb601fd2b3", 0xe1}, {&(0x7f0000000b00)="9f6cd6bfc0d1ce4aca94fa98a0722cad010453ab1cb1db2606c4668ddea4acf54f46352a21f5aaeaaae3429d2741df2a4e3e5f9605c4fd12d5bed2936ca071e25cc7b5ae94356284b9f1f8bfcecd253201958a94c0a6915ba55cb58114164a608171ccc5b96aff2e58308534abb4caa932e2c53dc59d2320823389b56c8220b076c4291deb81e1e3305a7b2fb28618929ec681feb6b6f386", 0x98}, {&(0x7f0000000bc0)="d40472d448a4a64568f87d806488caf70ac16137321da182df9ffa3c56db989d75903ec270d0189ce183d71e04e05d2a281716109b99f4f160e107efa3760692a195b95eac08a16086954129553e2a59f5cc99e2de158c3e8b1ad31c83a99ba04c582a87a29cbf85", 0x68}, {&(0x7f0000000c40)="d5aa932a258ef387266de2c06e0d97dbd29eeb949557ecc9102246cf3545e8e56621602fe7d131311aec77103826c72263335d0b38891b4097b3016395b1491e84d0b21f3c312cce2a82a6cbae72320e4e465fcc52ca602f17d89e081b0806854429b34f51fa6c987d05b1db6cdad7eb4c0c758b11e525600cbda19f007f536b7b6b3dd10e147d1abbbeaa4513079a1a5b0254770893944527fd204c6e7fcc45c92af9a199d41ee0e887f4e50379ae521fe35e0f89a49891fcd54d92dc6a121bdd639ea82767296ca5b89a", 0xcb}, {&(0x7f0000000d40)="86b02444cc3e6477e87f81055bd984468eaffd148ac8abab234874b902dcc9567181dfbef6f1d21d6eb7f1f04122cc7eb6a9e7dc143f38edbe2db7ec4fd5fa573d07840411fcd1789f5da2074ad859dcf4258850c57c4b9dac3f3a3926d77f9343c8ea8660e33f66caba3183b62675901fec576a9432971c92acabefafd12e95f937f74031d1f2ef2a9966c9ef7c8b6e44015918db5a65f33d8cdc19dcf2b437bae2ac4aee19dc309f188ecc4ce6068dcf82d5f7f0b7283827048b5bfb01350543517e51290f657bb5effc188660f3a83dfd9f15f34d36d760ba772992abe12f255da06f87ae22aeea68416af9c0aabce4ae807813e34435", 0xf8}, {&(0x7f0000000e40)}, {&(0x7f0000000e80)="cfa208363b6097275e93ea4a1c1c7cc4f64e7a", 0x13}], 0x7, 0x0, 0x0, 0x20044000}, {0x0, 0x0, &(0x7f0000001040)=[{&(0x7f0000000f00)="fc82356eb8f29db01ef790185f4844c2d4f2e56888edfc937fa6e90e91c4026b79f200c375b1b5c92c819d8704ebb77e2e5c0c65613b24e98fb0", 0x3a}, {&(0x7f0000000f40)="3c383ae3e4c9ff57581de0570aec42da865d14d46c1d28b1bad90c00ad98470ff4b18f633b700006347eef471a4f47ae34453060cfe18b6a565fe5775007498a5d8a2349169f44ad70b252bd4daf23e812379c1d21030c7ad5ea0d61b90505dd840dcdb033b5330229404378bfb88cbf91b27f24c821307166419149df72a2e434d226b78b43fee14618960678921531aeb4e8b46a8654bed9a98f46676ef346659a82a831baf50324c96a966520ddcdb893230d83a17831a63cdcada509c76290cc9168d56ae8cca8db025b25fd336c3b5ba47fc6ad2f0f52c6bc91067f85fd62c2f314f4d64477119195247b7b37a06d2f148756569e6c9c19de", 0xfb}], 0x2, &(0x7f0000001080)=[@op={0x10}, @assoc={0x10, 0x117, 0x4, 0x7}, @op={0x10, 0x117, 0x3, 0x1}, @op={0x10, 0x117, 0x3, 0x1}, @assoc={0x10, 0x117, 0x4, 0x5}, @assoc={0x10, 0x117, 0x4, 0x1ff}, @assoc={0x10, 0x117, 0x4, 0x8}], 0x70, 0xc0}, {0x0, 0x0, &(0x7f00000024c0)=[{&(0x7f0000001100)="3d1dfe069e1ca88b8337e5d3f2873cceff431a575222e4397f49d26764c1f80d5e91", 0x22}, {&(0x7f0000001140)="fa68a57b6507a864f0b93cb5c8933cbc2b52142cba079d49659a45d3f023ae675eed27acb61b08520263556b2bafa9611f6fa2172810a41f59473a5523e3916f08e5e56fca61b4756d9b0948a8d434bada4cf26a047e28aaad2c5df16e21c01cde03bdd7748cd5cb889621f1cbaabd90275539098f07ea5e36037f3cbcd24e90df4d6a8101203534dd3200b124d2717845a81fa6a1946ce928bb46eaf860aa334a7010374ac2b7edc6ca2f032952eeb6fc57b65ea4c3a83f2011dcb00e7b308230eeb97f4a1f4fb14566b32138bae422376365b2c2", 0xd5}, {&(0x7f0000001240)="02161756edac012e9f6c47ec5a3a0e8d36f5084fbfba860b89d326badf434a352dac255db03b57538e5a1f1d6312d1bebcded965687d3a615c587d7ae783305a1ec9c63d6261da4cb0dce178682b08a37ee48a8ded406a5d9ba31e877c97a672a96149cdbb32f933bfaa93ec2dc754518f0b99f8a2d2077a8140820291ce6d2f4b58a86a02add9123fe71aa39dbab12bd3ee6fd5b026ad7fad9182e29f95bc4631c9286ad13e4ca1c4fa7cf095d206cca44e", 0xb2}, {&(0x7f0000001300)="4ee8803e94361feb8874f40d87c1461993c5b8dde02bc7d75c8a6f0ef125dc4f183d78ebdd931dbbec3be89402a7dda833195047c9e91e340fac74e7fb1337d50baf9cbd8c923946f74e5f030c224428b73fe285f9567aa698c093c493ab3bd268e4a19cce81ce43b0d97b294fd43e20f9f3e7736e11550d7f1ceefbe0b98f6d668f6dd3112209ff5b659ac2c02003302c6c58053928132f12974bdef611892f003c452824441ac380b048e2a022a78bf3de87062727556d4f8a2eae77618ce713841b18f929dcbe942c154a9d692bef29a701e227bbe70a3a335ee9870e71fd3e6905645414d4aa3a0417c519c160f95f8e0c6dd43e39fda8e8beaa8734531a7aa06c116711a40039f25f13dfa3bd6a45bef06624040180a0fde28f17d0691a4e4e9f04d04a2f45ff06379b6be394fd10341b7ba9b407a990b8c37fb5f4738766c341a680d278261f6de2776737d00a249c8eea280d94597b2b2c9103bd47179a30858aa49ff80f1281e84f0a7ea49b7c9c2e12ac06cc91fb9e9f465952fe900fb0f03f29ccb619b6bf3cffd790c70a9ee9c05c8d906c294f0dab0076e159bd154fa3bb6aecea8f4bc49961f54dfe36302edbb170119e54d10de63deaefe16211fe685a2ce10699b885b7dad4d511c73e66137637168dee9053e9f42402d2a92a8a035a5fa2a26a3b945227afc570d2d88b1ae246cc7c00b2de82fb50a6afa064bc29b08b5cbad1a41a9120f354f08614ae5f16a4543f6c548b816badd7468f71bf3f31e82795cfedcf483a3881d217f4608e871f73e8eaf62ada260b4193bbab90e2adfe8b549d66d7ea8ca820c5b1d408883b2270674b2deb123111edec1ff3a4db232047f91dcd7039b4534ad7dadd520d65b56b7654998290d975e6cdbcd8f4870ca5cac1b8cce432a2ed36fb31aa5ff7b9284801c5c52aa738130e65d3ba3aa74cefc6d66477ae10b822bb0a11fcf7d59c12e592824fdf882d0d311f671ad2cbaa323f554e2d4c3635122810db55f871d66b82ef86b5a680979463437857ac3924994016e9542a15aa142733ff16828f3d8272d1b5028673483838f4700e1db33e26608ffdb0fac0231ef832a37febc251d7e1ca0a5bd3c90982803c030a30c6583f8112d49969d61ed4d9c76f3673a266ecd031d0034cb8d048a97f1080f9c4e29bf41e23ee0ef0f4e76c3bf249b7feb6eb3789fc86248271c1fc3b4051401af04dc670a13d8cfff1d4ce5831dde40aff2721c7991baf005084bc6525287d57ddb0e5b1765ad11efcbd0ae4def1f47031c1ad7452718f63e89760be62f4eb05788ba16f2032a7a20f70e3198a6f4925cf5a8420528fa43f137669d2a4418282793c0af4a504372f93abb1cc9c0349e478b0fed050edcd92908710b91f8c45379ba3229ca546f2a657285b6ee1611809c6b4066a65f6002b8c8b6de5484eba3efa296c011c7a9be86895376e249feacf244fc4b5610a9638aa12005a44a2e746ef32dd7a828f13ad9ede93487b6a1da6fd6fcd6fa327825efb21a783f1fa3acd01098f3a6d6555736895b97b589c9adc0aaf17f4d001700a419b970da0af73678913a5082e17174576c6b1824feeb156bf448c33c52dbff7adc91b5ec9f11d15f326bcf1b56964ea38d256d35985b604765198cfa8a135f82a3e50c6906ed3a16ebd154bda2a5b1c0c085c11936a7d2728e8f3ed9c0b44d9b4fc5c020c2e4b6c461653a1eec3c958935e4d44aff64ee738e5b35e8e279411a57a796ea5918b558a4271b79d341f7080c68341637f83ff60e3a4e761d0ed2bba668e2f281c0865f88d8b6ae11306b84d47967ee140245651dfbbef51fc03c9f699b59e89f76b940163a413e3ad41cb4ad223dbb03d14beb272226330290fab4201220c9f27a442403e85b6c4ce3d2d722254a799748a785073da443df3d89eaca18a2a8a7650d9026b3e14a4cbc1932839cd3a8c8b71c43e6bddaf6301e121c7f602b58d7fb40996405760cc2e04decc86908b953c938301c3588cf501223433e1526754534a999f6a6fbbbdb69229e09779430f476c8a8ca54612d1ffaccdde08449d63d4846d74ee59952b280b36ae83558ee0f0394a9368deedbc9ec31add4fc3736d2c4d2c971d9629b9604691ceaf5e57609a01bc1738b7c4282d980707e085e5364f85fb8a0253c4190973fc9b9d7f189f7141d8bf7cadddfa86531a2eb7193ac064c29d935bd461f3882b9674a86651a2d2dbe3440033f500b140d1535b8b4367f574af61d40ec7a923cf67d39e70036db8316bf646a8eaacc4f9c9b8e0079df553b384a1bc75f7bed8db4133e30fafca74457429c7219f1f3a046ba6289311dc74d260f71ce65f3e77af7f005b3e7d20ab26b27964b0fa884f8dffff740a8285cf0a958d90fdc5f24a758acaed5daa03ef2f5548b75e40bc2ec0d3c477a419f283aff69d32ae7429e9442393908b938b142b43b101221ec2ea20b8ffc9e11e80fd052c71505994562188fbec33231cf92431c47e30ed3fcbee5870cf1f75eec6333c70792d8391ee8449a41064f2194fb376ade47ef0efd05ee227f9f8a08c47eadd88ee131e9ba0c3dfe6787cfbc9310e4bfa8346ba62888799d010ee160ce22d276626b6b8d1292021c098d79cefc2ebf5d59305bb6f98974e89ce61cd9920761d29f881b08afeb37d47114f5fe9dd19aa04645dacc6f3c1a1d1dae98299a6350947d7cddb054d60064f3ec904434ef13284d3198016894e22f1812267dea5c4ed66f1ff1a74c9c67cff21531ba3f60f475a0867d53bb9cae8222b5418e82053c832c187cc030b7dc1e80c92b231a56448ee627be112760b0a0c1a96461813401ec2840862ee4dc6c8ed3f8f54765b138106efc9dc4e957855bcdd3e9b787044bdd02eedecabf55d1838074962853633bdc915c03f54909b5128ac540155edd421eb9c3d141b18db9490aa4e86807c803471f0cd00db3964ddbd363bef69f67f3be3181a6f73c2ce1968806f4676a6e4ea3f9fdd7ae1fec12828a11dbcd33e48e780d8e6cad5780b94ea274e7a6c0a614edca6a65fab1151cdabff2a8a1f4d9fb73d6039be9f4f1e581679413a246b82194e470bc3dcb68e315aaaca0c6c39c3a09358e1e12a3a59b5f58ff126d596d630e4ad9ae9c738c29035e029f111f7aa94e9177e5e9413950b1c063b03e25c66c8f1fae327eb3e10e96711a0a38fa577c53f0b48da2089258a0a68581466c43af298263403eb3edac5c8624912da4666a80e97ed8fcf990b0220aa3be99e67a09906888d2da8d9b530ddafab635509e62a5bfbc435693ed5bee5b837e88c6a1818d2edbe5bd606389493598c6d067d81aca5c14a6156fcc25fcaf05958e88d2743b91405593b621a3fe887f65d0caae254646c226f69654865388c93370c86b5f5cbfec8d59b345a328ee2c8dac157e8ea3df0c441006ff1374628fbf4bb2e999a3b831a9b4727e9ef6904904d1d5293e94004ffdcecfcd74fca3247b9cf582e993499145079c188e283575d8a464cb40028665e25e87ab50aa1843f13ce2ba2aef947c4455156b566e60588d4aa1865ada0bfd5e8744c445f273116e4f280d7fc98598b5f636eab170b2dcf37ba2bb2a1e49740a8ccb1badae71c7ded09e98dc1b1756d284899822d2e75c2230af230d25b8d549039269b9e3d6f61dd09b951d58cd6ddd6ab7448e2d87bfe50fccc89da9cdb4fada89dcf26d423ae02c81afe889c6f9e99f7ce527f3d098cd2c92c4bf872a700b14e987b524632e97b943f68ac6a24ab770004b770128d8de924e1a7a0910912e4ed77c8ebdddc694856418b5ada0af0a07b644dae6e821864eb3b6a7db255f38e5e1540516fd84a07f4013cd2881e7fe1dbae2400f0e7ee1af7183faf711a64eac98456730ad1d1ca95a89b90a7cec5093639486109cb0f5f616ee3df0f3205639470aecce02840ad3f2c32b4f4ab82b19f037e9f0af23e821eb6216b54793bb599bd24a1a7fd53a5ce915b964e7e8107e08f41f0ba110d8fe5b37e77d930d3013cdda59f336979a58070bb21cd3eb440ce491003b0dd13f182807e90e0d4b1fd60d1ff534a318f641436bf2100d0df3beb836398891d3588482fc30d208afe6d3202d1722978f32b3969c6518100d4a98a04c95802f2953e847a69c3a72f5915b5d6c29c2849751a543cf97a8e5064e9eb260b5c45694a70c6d8ee311b246c469c3ec4179fc7da01f1137f2391b7ae2ef1785529d8663657b1d756a03eaa8de84623135d8d841efba0ad0d0bad3af0ff1e24b7e456d2ac92217e92d8816c10c67827718e8905c0ca8dfb081e632ace4d8a7e5f17d171765d00d31573b9f4886fae765348d151ab0eda4d4f550469cab57722a0a8f8048899f2829184fcaca369819699e275fa25dbba876278be9d752557f2448ca5bc3d23bee61d5be1a226298d13a93834c6c106715a7c16ea6b34156c0be90b801a694a90c7d7a4b84179abeca65d4bb4060b3e72d6f074828eb34706b530ffe7ec9cfd1e693c21ded6910ecf25a306c864cf9ef8d64ff69a84050589feb89b18269a72e7dd179656defd0d87ba4ddf7ff36c138bc5618ba1b9bd6315eebe01212b9aa42d3c0bf2cb9268fdc76ccb9b5bc2e1ca971983c1c5ea228eecfd9326ea1a6e43dd484d9f14c01ede76e70f94c1c01b02d4acd86ce3710c8c2ac5d6df10a269ab06f778ba7357b82c63cbcfcff01c786a5f3ca59e9138d5631dd3774330c06ba3261afcc17068549339cd96aa79cacf1d418d133952c2b5daa3c9f8a3ae845986499d6771abc4000a9506bf25b4e56a7d50f09a12076454c52c0cb3b32a7249dfbc92c5d1902521cdd290ad9008d3bf37dbeb5d252339485a3a2e97185cc196f0f1f14dc9a5568fef25ac54636861911c6dd98b096092176058e02853e3dc55521f76662fca4b8266d7885102cca88baea8a7fe17673519e991ea52d6fdb47cb4424ed28215a026f065e660e8791456d30ef48e8cf2a03bf30290c5cd8ef001664501dd2bf01effd764af9abb6f6035c27fd6c3dcef79aa0905824354fe0b30e1dbc2def3914fb8a8cbeedd75a7eba35bbe851b0a722286a9a5b8f4a83526732a42b6dde4481f211c86313004c84fbc0c503325a9fb606872b7f1b2ec7d255cf09cd36694a563882e02155882a86f4fe68151bcca9b79118b88f51e90962a436a51666353078fd3033c7f548405d580232c0be7ca3b5ada98f07238a695906db2ba6c6f5ad2c6a3caf0d4110c12819d507854690c661a7be7e26938fa20a6844f028b346cac86bba47301185d19a5e2c6ac9c8d519bfe60ee71c093d21c35f21b75804bb658e0e0058fee3507dd08f3ef8b32c35510c8e72da696e648d41511743d4a166c6283ae0b19a5968e315e8ff93d95f777aff52489d61c4ab2e209d31c9f976d19baec8631c45262c3486a1ebba73d4d7fad4fb2cd9689f0fea0418fd198ca77e69cdb204d1570544f6b17f00b43c577a2ce6aad0e191a571b1f369299559ed33a6a193fdf5ac78673ac9828309d74404905b2efb3f4d8f56824121a55def90c302254a6745658c50eac0f95a3a6f704f58cddf3f1d6b4c385457078a63e28cc58338fee1466861db27064aeae3fcda6c21c88a14694e878bf906c08e6eedfc514d0672511eea18fece08a24d5409d9d3cd1014ce8b027b543cf62849f59726e1d77bdcc337f1f519ca6dc6dcd07d3a66ef0a13a1b34260692c873f9e5e0d8fb68aba0b80dd9fbf94fa966327f4dc85476ff79e406eb42f87a6a87b0ae70a4", 0x1000}, {&(0x7f0000002300)="325bfb11281e175a6db87bc39daed44ed3d6171b17296078c51f610979bf621fd33f18b4f7716a12f6159dc526576a86d7ce22dddb3ee2406c7e360c20f067c0ce4212beb4d6c77c54f81270187ac2b3142344619d1c847edc7a04f37b68d299bd5abaa2d14d9d54c76ed9dbf9047e52a8fd4b2c4b00fa342039d75983db4d14aef9792307b88cd4017dc9da64d2c8b99b02a50618729ad8cd554a82a6614b25a5b6a35bec6a212edf538938aaaa618ee1f2ad060c32261723f4753ba4f0a5cba40489", 0xc3}, {&(0x7f0000002400)="ba185086b1ab413ca9785256bca5b8c5e72d138e273a762d7835936c2af04533191465c471394ae5628327889b7711f51af52eb5340b823501fdbb1e5808049f111f4d4d5d4afef560c12421cdbba5fa3b4c4c892efc0f5407b42fd96506511e06696bb4aa93cdcfd02b0701e5ae9a3f457f246a52e8dc92baee35e2e8c773697040cf66bbcb0398a05de557182e0866b8d14f7198a9dd3234af3a45e797c46065ef9d98214140fb15214c8b", 0xac}], 0x6, &(0x7f0000002500)=[@op={0x10, 0x117, 0x3, 0x1}, @op={0x10}, @iv={0x108, 0x117, 0x2, 0xf5, "13bc809a6b12252b7d9cd025aab8c2bd13947a23d8c3669bd267ad9e3de1f87a5c6d8c8c1f3201fef2bfc3ef67fe1559aa7b51558e334935318345dbccb534554905cb1bdf35acc69a6c3f997d82bf96db3d2c8af12b91f6c4da77996f396666bc43c26b354cdbc2cef4e0394a01d6da00136905c3851d4cb251fe5fb5c9a839773c06fed5a41a03f6d1a9be060249a3cf7fbd476f74a4eca7cfb91b6c1d8d57a0ed0d42a117ba199001a27e45a9ee4b0d8c0de4e77a625095838f357a71e314dae0a8e9e9acb1a4b81b3d529233d23bce2bbfeed3f7f17dd75f90c55bd3b8e069404d1fc02689cb353558b28108855261ffc124d9"}, @assoc={0x10, 0x117, 0x4, 0xffffffffffffff95}, @iv={0x74, 0x117, 0x2, 0x64, "40e8b5fce2e4f4815e2dfbbd67782895d2eefa63dbd8905b379d8d37e678fad47bc76a42a02cbb790bebe1705252043ddcf989110bfcac05f16e2795882558d0fb7cc9eea956a223102b88c32d74b37f819506c650ff6e831f1e488cae2b7b39b9e3f5b8"}, @iv={0xb8, 0x117, 0x2, 0xa8, "5bd129ad40520b3b0c6dd5b65d4302a1254574562c5eefb87a36ed7e8a33a3d8a7855dfb60ed96bc563f836f2c15f9988f3f9ac24e8aab06d30cd42b7860bffa5597e80c6394be734afd59b2f46fb5a5e153072f1bb3d916193c53bf27f94c3ed489df68f2b9a2f97f8cecd6c2df1861e6b03b513e504d522a43d2cad10d21454fc8d554f1867ff4869c0e3b886c0dafb8c7448a6066b1e1eb58b31dc88d44dfb9926f6ad1cf23ea"}, @iv={0x1010, 0x117, 0x2, 0x1000, "28fb7c074f47693ac0b5ab9c5a115c46586aa4aa3f4c273b362e94ccd01303832d2313ef9e5322e91e16208c97ecd5a05aee00a894ce4732693db6d4b149148e4cb7cd8deea8c7630b281da069c63c022f72d9752beb20ef44f24471e88ecd3406cd7bc58e7bc27fc7ea214a859879f962d58f450093e50863be2a744863f687430dbe7dd90a2aca38c81522ec065c0b9f4e62c2bf33fc7e333fd04941e110385e1ca3f1b6bf300f817c9cfa25308ec0c4e7404a7873d63440791d8ab4172ca55883ac1699f126883e1dbb62db70bc92ebab67f91b57b859f958409af121a901193a46b10dec1f82f1c10e14d79573aa51dc9f262640ba6ac3d00a55fdef7766970542f095743d21a5e543b338c528bcc411a72eac0763a68c52e97ed8283c1c342c62952817acb70192014dac395451a3ee499dbad3897b9b9f1ea5def9eb96c534190fa7376948d685261739f132ca8b2e9bc20f4cd5c22173a046353cb536650b4a6ad16389ae272b6b3f4663563776a6fa373e9a67a4ef193c26886292020a6dd23c4bf2020c9dece4834444dfbf76ed6360a0e935b28e663cc9a26e9b63d2ef4ed145df52450be16b4b82fbc406f1bd104c4d87e9dd4fd387d8069206441d08eae270bde72d609f69d505ea04ab308c2685bd1e4f21e82bb478b81bf42bbf01a5ff895bf17aa78404466dfdf6d47979f94107a5d42be58580825fd4ee269ec09145087a47e98676a9206f3942378d915181c51e53a6135e883c32c4b1fe7fa42909155c42b4e5dd9f3ba81bfa07ed424da7e5f1ec01a88811f6d4494890d910fbf956821814db0250ff9137ac095e5378f8c939a6d41aa5a8115f4dcc5ac60836eb0a79879577cc0ffb5892830da109b58ab6f99ec0dcbbf73b5349e7835a8a96988b618385ba0fa6d4135d03edf00b16670a92246b4a54c195cd58d22b77447b5209684d41dbab07a68fde70cbd5ab6579bd66cf9638505253da502fcbd46c839fc80f06b0c8711e0d717f8c681aac4deb7655c64bec8b13b238fb7248b8ef09ff8fe8e887eafe4da07e1527937921c3653386da25ba77ce46287d3655f11d6bb00138b555a88280a6b3ed94b30edf0a0ab8dfae8863a4015d379cdf9aba3aa7eb72eba791c4cfc063adee569caae69d4561ceb53c0c2577915d521c144133f35b930473dec2b79ce98c48f3996d7937223a10eddbe4e5574def099e440ea1440d6c065b4bb95d58e0d6870a906c6e36e2f36d2013e8604ae72394aeb839039fdda162b0a052de09a474a89b8b72a428516c14dc1f24d9b585cefef4c921091bbd9e74dafbf1716cfb86ff225e5a12068a9edf2a6fb47cf23de34514d5d6201537dd4614f7c2a39098b73087a671cea4c1392fb4f6ca0597a770038197d6ece998de78626338d00e57f618bbe9351b4faae9c59b77ee26c7ef0e1a78f983c8f2094485cbe50725c35041ec8427120269b838ea160429305b8639ba31b2bbf9c17bc7a00c0f27cd7907483c470f26e0c06509c10d90bd7848797fa219169d4fe627a053485dc1106be48e5326958d3b75fb0167305864433afbbd7a6e9259ffbe3f9c81fa74528d06c68731402bd56022092cc0ac6ea9419a8aa48886893496774c3f362205f0879cf3031e9c9bfa87ab84ce8e63592864d5ddedbd38749b6d9e7ed38428b82175d947bd7b08531c9902e4f74548f5a09982cb48525ae86691fe10032575a23bc4774bcf6653b6df8baacc307c07f1b2b9dfe3e29fb4e23008672f23bdb56e0671daab0473f072a2ec54f42b03e4acb8f965dbafc943322db06d591237067623f5cd57ce7fe54da5e842af6f141c03365a799da071b7589495a132c83f9bde76483dcc05c5224c5e09e438d18decf89a3a7fb202ba84ffff30e0504ef249f78e0b19c68ea636933761b419ad7a7803d48f569361c4a818b3f9eb7633b6bdd8dae4e9eee9522e7c716409771f4b095e1854eb3d6267cbfa667d4c95f5d452703e6aa54879fb243070d2dbd91af4722e2a6819f9451f33decfeee23e88426d2611c54d6125e156a5eed28fd88ec15f0d9e79c3c8505bbf17f461a76eeb52900152f87a595252e3c6579d74f17e23395d0286ac9be07d1f8cba7e694c2fe11c59d0bc5e548b7d2a26875959d343ffdcda48bcf6a9aaf93c117cbdaaf26805fed51e24f5ecdbd2279e45343b0c383da6bbf21532b19ce255bb6dbb201ff6840bdea7c6f330ce281729273857da627c3566e40eefaecf875cf83948a2c2b033f124c9a99275cabea3ba1b4edaca15e969371e56fb27e106a0b95b2a6af99f79607f2998df9880e5ecba1a1cb2246049bbe708366a22a81a05e97533e0d0182b5b312b915b3379aa77f2db26e3555703640fe986e324ea9211c28057fa7c2c6352333f964ca74c6cb5c11a44e9e3a6b99ad1694cc10bdc9473afa4ac122c598936b29aa4404bf990879578176ad42e98c13a43ed831ee1d8dc185ccee9b327a0282ae59e7aafba7c191914650338da923a45bda6994b11c4f2c69325d72d586cb8fd4f2103b424b24c59ab7ea2a137b1fb9e6ea0ef3d3e35bb8e2f43453e32addfe27f69600118ef9934471888509bfd76be9886aad5cf820b48328f677a9717eb3cd7bfb9f421bff9ffe58d3ccdc594e0a91e2e84423f0df0d16b89a8ed021c5f8c2decadc9a6c65446a29ed9da0ebc7c96daa2368009383e8050bb4f7a63fb28312f460270e8cb6763f35a6bb15e0424f66caa445eeefea97622bc763148a0fbf31b024d71ca202648233571a8f6a56627c29629ae6cf48568ba06bb1d9a649175b5533aaa5e0a10e514ad24317863e74e0686e1a2b2c58bed13c4ad60a88009ffa4e835fc1a06094dea38a704a89acf5392fe98bfcfed5be907f6a48b7a48b84c0a0a07bf2d6769e09923fd66eeb879567613e9530fe4ca41ba52ed8df3c8b24e97e8f9429022fb122ba334c3626c0ae2692b05407f377c53b3b164b731b857477af6db3553faa992a18b63ab7a73f133f8ce6863ed5ed176bd8f80a5d3c46afecd131a5f1466ac3605a696e02aa8d752a25f9d4aacfc82c201c2bdd05e199a245dcdd204a9206265b8a896b1f698610d3f1ef4d1f745c4a0ac951d1ce54f28ed9ffe200e1c92b9c5c5fd878c1ab2d81949162a2e786bda82738e2e1021572590bfa22faa9458af9f856c2a1b66554b9aab2075e2c463f48618f47e3c5dd49512e061b95b4d29b86713f71a04630d90f286870d208f2bc989a4e5b4d467face0fe9dfa5e42c85ae752ef1da4a4515192298cb16e453a0170e8dac5057ef246a14fab65ee3e4967a425825271b25b503f63b1b07db1a6d3a58e115575c638a97f081e3dabfbd985090b8b6e93f496cfd14ed1342ecf945c03cb879b8bb1833714154fb828c1639b77cf45f30b856ce62d89fbd515995d0f5db794ae5c98e0a8b56bc0361b53a4530cadb891358cdd5d733aa07a2a287b56994f41f222dc8e1d439ccf9121691f145a92de862e3b1c5f9461c23405f1c0d63254e6deb89a87a3f0506f7e0d1f5cdb17d204c683ccc9eedff32f52338e2d2d8005bd4e68d168f877ae1ad905ead2cc7e7e184a5dc4082ca01bd24bfa85af79fda238a2862a45f00abf5d3f9d841b674ecbe158dab79ce2190a6138d12d9b1ee687be90e74afd78acf75d27574ee64852cbbb2ddc9bbd773709adc5911a870848d060585d09c2eb5a7df711821e124ba25908919fff633dd2aee19a3aaac188158875c42648702b8071ff4d36f5463265a60b5dfa6739289e7543d4f9170e07a72cee1ec2480091cfac199ffe27b90e3207fae0d473598ecf581c144e0edb798e37b40404411251c522a853df69c30480a1f57ca9da1ba14cd07345c007462680238ae8e35a71bc4c65a368355c6c84369cbe54d16327fcce265a3418ccd7790b340dd1dc75667c24bcc05facd59453891a8f186dd26789cc699d67f88a471cc737dfea08a2b697069ffdd32dc3a14bc64d8ab1643157c7849c21f0172431c38e77bed25ae029e5ee133d5bd216b885173d5a50474cafa7136efebb53ad7e3ea9e2039ee3b9d50ea53d15438a63a60d79885200ae9dd2d213b2fec91a84daaad5f0a455d80fac442c70994fdd02f5a8daf4962a78779a12551d335d9260f6b71b406b10dcfcbdda6849eb3203428eb22d397f6fd12da84ff5715c9741a4fb6e9c535d60a71d2cd896dd95c8002783d475199657f8ab10e3909666c72373c5d6d0084d713e2d012fb68c88ac172392cde5c616966e4030af36484ab901825bba3bcb3b1aedb20bdd689e5c6597cd1fd426b3d5336eb9d2e9b6d526fa78182c2d92cb0cb1f4ebefab169c0acec107ae91afa5ce0e1515024b08c8d3f3d4fe99e390bd1c334bfbd55827e40a2f0f63ff4995934e429f24cf09d90d6570ea0f34389ad48bc321b04517553e4804962679fcbcb22c6162fbd6752a77891fc939eda3bfb22ad83ae48ddd8160e29c4d35ec2976c7497f0d64f1b55e8da96a6d6811dc3089957d6575e04709a2449aac78a95972d66e47ac9a73e4d4161f7c4c9a4ad7929d91dc69a418f2bdec92deb553e0adb7a4e4ed501a5b0f877867d062d1afa96cfaedcc9078d6a1659fe39dbc69a62b7cdb6637e86745af950a6181c3252b49ead3e4e8ee7ed2004b5fd848d0ba909dc236bc1f8e4740db2584a2aa746336ae1bdab7e984710b980c5f3906544b2cacdf9847b69c009d3c7b99e1cac6172e2eb53a8ea15896d15eb0ac3109403172c0705f01fd9663f8a37e722822ebd6ecfa8da3651ac805a0f3b6995d12567e52cd4319fcf995894a1170f296309eed4331248cac35142992ed05184ab6d36a75a3e14a639f0992bc1269b36109b07ef96aa12599a46f275adfc89be97b8125fd39199ae9dcca052d03a6086d98482ab7533b867551f171a91921f95999efe2a7c45fe49e307a3c763ca5bcb5ad538ffec69e5bfaccfd0c5e777010b844d3687a8aae031566343a8b2bbea8fd75feb320c16bd7ec3334a641bde9803c74c441d758835a33c61686bec77197e719fddc293ce11f97533cab1fd7a8cb4cb2c20847bbc7b222b08495649c2e63165c7a1a11fcb51d1975e39d2043b90435f8fe58e513f4dbd0fce1993607970b65329babfbbe9bab69ffbfa2315131dae7cfe00bbb03be52d6d3c49aef57c8ed83d53a72abf5985fdbe1e5853460ad7bb167483d7ef2e6f28ac15a26749ba5e91c2fa57d5e06610d7daf9aeeeae40673d2607dafc89f0def6838d92e3123ed3e0cc38ac56e980da55e0b9d1f1c7231fe1cf3ceb217640567f7d84dd7e6c380ab1922c3cd9667768abcd925081a079d9848f2e34fa9759de7daf821eeb1bd05198b25bcf534bb1433808adc147194de033399fe981ca397ca2f98cda89b25d408fc791f1f1969e61536ad7a3f797cb404769c7dde79d0d1c60cf77d87baa750109bbf8471a1b4a6b57ec3296b46ca3c11f0d2c620359ed81b5501ed294cc54e2a95f92e19a2cfe7e9c4bf6bc39971677f4435fd3c39bde547cae836f07d66d5d4856c2316b9c6ee663c6b54d022eba701e3e810572f7b8dd00667f272b1bffa8f46778e666c243d7593e3582b752547d6f25c61183dce5572fb1413838269563e96ce476aaa5632630a203e7a21e7cd3a505341ed82b1a20a9ee394d7209d74d83eabd111f33bf0b1ad0bf1e0b4fbdbdb61fc9d497177a1ea29c66be11a83bb0ea20971dcba4a9b278c3a2f8cbe8a48ee951c4bba2e5e45fe105a8ff92827ad3b9b8bb4a5eb582a0"}, @op={0x10}, @op={0x10, 0x117, 0x3, 0x1}], 0x1294, 0x4010}, {0x0, 0x0, &(0x7f0000003880)=[{&(0x7f00000037c0)="06c2f3969b1ca2c7ca5183ccc82f9f3cbff2ab818656f180efc5fb7bc1bb2fdb486f5632987ef95e6f1a176c44e89a82ee736458aaf5a4af562262a1bbfdb461a8b1b194e89321216691add8caaf79356d82632129747647ac271891116c100b97c514ecd5e6df23253d498a755ea0522b66ac4308834d0637a51000e62857c9e331c30ad198e085cd6c979bf62bab654d4c4344dfe76d9f27e58a90946d", 0x9e}], 0x1, &(0x7f00000038c0)=[@iv={0x68, 0x117, 0x2, 0x55, "11f8ad5edd31b017dec7468d937ce19264f76e95004da2e7b730722667c5ad4f7fb0769eb4fe2852f99b4b556c520f79d6f2fb94a6bb83a0360556850a0abc855b22fd1ba423bf3a409ad69ac7b5a15ba3f6a3dcc1"}], 0x68}, {0x0, 0x0, &(0x7f0000004cc0)=[{&(0x7f0000003940)}, {&(0x7f0000003980)="85066b9f22e59f40b5d7aa8e3e809b7726c9509d5e232f007c4b4e8b5790444433e12644cca10833836e7d77f495508a6b37687a28a897b965d1c324344bb3f4203be79646f584b50b92a0abf974f2f8feb07109be73ae0ea84187f4dfe2846cdc21bc9162f6926f7d4402c4773a8634f90149e37c12befeda9431341f804955a29a65", 0x83}, {&(0x7f0000003a40)="23ac4cdce49160f9a8b74e306ba321abc1134a7a9ab33cbaaa8b9aa119d83c95ccee5749baeedf978fcc9392fe2056960fb17e5eef71", 0x36}, {&(0x7f0000003a80)="d6fadcded4584424fc26edb32a79bc431c7545c2fa7a9a5558033ad3837b02b5f9e5bb68a53909e1b44339edf8a487dd618a8f40d546bf4369297ae848a49e0324466108c21080ab27d2dd74aaded162dca34edb03b79c0441dd1c95bc367a308598bde71b4208d6a8c31f431a73fc1f2e95f89cc929b000e9382c6e0ff96f680a422782c72faa48697b76782f3f063f8d23e7f754cddaddc90f1930a76dec0b8e15a0773c5a4240773e477e47e78b630ac3cea2ab565d72542aad1f4b34ce6c1fb3f35fb8fe947f03e7751720a783d8f34b4749bc0a95d8dfaa003e8d42118e904b6f51d235cf838bc3c4af08359fdcd30010e8c5005426dd5b675451b4f48464b373b5235d9f2185101eb01bd854d62d5947e3167a68440a257eb6965b3cc714b555cb8f6712364b83aea021cfbf4694e0525a8f8bc49a76212febca1751ddee5a38ed1e07f6d7223170077cc58630681cb4f60910b36862574404dc708c20e28c1aed9001dfeffddc2872020e46f3077893518ed7c5a90cae19a44e2430817a50931441ede9eb41840ec735c59bca0b00e50344673cac66c01a058bd4668ac4948e86193a6c1b92a0baa86f2709643157663ed65f8a42bdc38cd3d5d82bcf97ebe9126e4d5f90f6c3a72414e08458d8571b6d8861954de5d5ab994c6c5a78f82e32dd8fb18e4be4714bac3702350a8d41bc781045e4dd2ccc4bb98eeab90bb9f5bca24abc93c4a4215d2bcc8c3b287e66fc5732361c9efb194152d09b22aa79c7bf30174c9e1591e7090f169003f4154421f9ed3a282680c51d62dcdb7a4be136fa2b972457b2f1bfdc1ecb62a71d7181585844b416a7558120e2af10ea5c2a45fa894e4d34b08e4f0a6e7d99b4a995284e14682a5637f238b0aced04c33fd8c2e0398b98b87aed469c1249d602910b0990685a00305214bb6d576bd3c8c0116c08a814c412637e4435c5e35d37432e136f913eb63eaef8af3676dfe9578ffcef3f8280df363306dc07a647d2f75a659088b33c1f4d48c92231b61e83498e9affdae39d33aaffc85b4edad953abe89bdf2687aa6a8e575bfda1f219230dc31f2eb9f8d352865c1b734a93a01a4ec3cf879768f8a82ee7ee5141a95f9af85adb71c6b555c6b62085713062fa537415f6c0107b3aac247dc091259652281f943f8596f32fbcbeb3e9447526977bb84d4bf11fbf2ceb4b350d59142ed2bfe60bd0e4377cb6e3d59bb773323bbb04e617b672281103b7923fd50c06a1caba60c85eebf4de7b7a60a2baa1d8d17cad4a58202b1c70c44f322f9c1d31662a9ab3f1eb44f7ae6f50d7538384c2e91cf10430dcc66311b9c82d75bac34812366f7d1acf4800ff921ea53c8b2121388425dc5f078f41cd59468842e1208156cb775371aaf8a4c9a0260a8fcdd8e9667cb94e558f80031e4adadf11bfe360daaf3fdd707c29663fc1178621f815a6111a23883e1b866c8f585e95431fa746206bcceae6afb99a05b5573924ab96765689e4f3d1b2f7df4e16eb149bf5300b7cce55cc6d44289da02cc9f808ee0b3d5d988733add5fcfea7391499ea8035fe04115187724208946a7cbfafef566b84e1ba0ee86472cd3c6ab3d281d1b4f9c602d7ddaf5fde75a23f5da1cc2326de1c1d32cdae750d7fe4e118a3a1e168d803b5adf6f82c8e1a56b4941b0224ef783bfcc9d1b82572449c3b6386f82cd4a46672fa064e2f75d74fb15fed78bbc5c532c6abea1812421e5c6929e95698743bcd0f3c4865b521e7c8cc6512c075887e32ca2ccd095f7b3b61fecad0791e4a3a2f553a457a5fc2982917e35d3d5e55f5a94337e7820b83ebbba5f6ffc67fd12e8c85fa72b2842d5a08ec6e8e919b1f274e8ef263265076386cd72503a00247dc4d94d9d3728ed08cdb7d82c1eaddf6440be4cf793d674d6bb0480bbb21540690fe5781a64a53db8ef5d1f9bf70b55ecac89e1e5f1557f9d9718c12aba79e419814e47cb369c4d63882913069f20742e55bc0564bf3a520eff1ddec821e8db54c756e465161eefaa473139dd7578b25ddfe9b316543431daeda829fe050107e03a70ebcb0dd880aaac0531f3921b0a006df2177e01d05a29ee85368f12d4dc8cb67fc800bb377fd36fdd8e38a8b11394d0c49bc87a185e13e588d1c98415c93b9e45d65e0bef5a373ead14fa124fca30d244b473e75572525aae2df10d2f8219d07dfb3b401525484eb4dc39c3b51a0f26711abd7d1ba146f286233f7d173bba17d190545d4d1491b020cfd2f936eda3143c94e2829010ed3aa265761d2aac0561ebb24ade9b991b3aa716092dc1a6aaca1187b09e566d9481e4d308f03905ca5eb346b0945c41094df26e44bcf5234b7ee9ec86f851bbcb587997c4504e8384e622a1522b838cebd901da7e58b0c98f3aa0ef679fe36eaf84bac2737c2d7c024e20fecb8d7854cb21856424fd0a77c02e5621da5154f5646147425a10bd6aa6609b6fe2640fc7a44de46f43514532ce5e899c92f80c1f7e218157c846bf4e93d03ba3fb4b32f9f38f2eda81ebd30d5ceb6ae2e1d05313940af4e5747cdf9a109801e51956eeb2e75d709d058cc97bd5463b2c9ccc74471b1ed14361a34b08c6e02a459118df2a2dd3b8e74f36d59f1ee6ba9e70ea5500caa1accdd764edda909867d0ec887eb9a38eb8d8394c0279f699a55a2a7b96da54d59a1712611ad49f6329c8b2d8e13c0e2348ddcc22a23b7ab33de979259bcfd7c6b052a854e172f824cc8723bfd55a79732095a6722fb2c433232a4538a06a37e069cd9c839919c974a2cb441ccdac5dfca456c98ec20a289c2016f010fd15fbd3f2b01eaee114090e761168669eb88d9d744dd18a94ebb05275f02f2cc61eb6c22cac813c2c9a0a1542eeb2b1d7b666af6b5edd30f91d2e8d8342083f8d1de79bb92cdf92f3b347cdd725e0ba60fdbfa93cf8779f86d00802bf7ff6f9a108a17c840fafda595622450e4bd7d44c57a6e89d19fc22b6efe99b7be2cfa966e31fa6a5726b6500013d64bd18aa50348c4f77c696d0173f2ebce55cdbc841fad11441acb9e568ce2c5a6494d0aa3fa0df2909a1d3dad77b2a0b007de745ce7a282e8446884ad35e6c434c538246c63a2d800886934bdf32848724b9af09b3d0c2952be8a6b2c11e3514afe57e08e0d1bba4ef0662eb5e2a33e3eb0c53599a7a622e32dfad56f2849c68ebd2e0ab5c620653fe42376d13d23c92e2fafd19ba126a11072548ae200e19c1e303d81bb2a9a1e7c8ac9b054205bbc4bb04aa7ea620874b2171eedafabd0b5b4f8c4ecf7094483f6d0fde19da0ab3e1adffa17735bfc55ef6eb970924fa2d409372a1e406b1555685dbd750f51d17a4bbd1a133e3e3ba7938406560ab615ac0153f773df2a36a723e71376e4e625cfc9857aee8fd63d897445d4b13bfb14fc6ceca7632a704d23e84deb236aed4a362858131ad1e86cbedfa5d137725d0320a25461ef014f8a7fbd77b85cf20727d430deac47c9bd704df2cc66df839b9d32ceef59627887d74415e0411e2b54b04deba0a1fe99fbb26813ef628c3f632b9971da3bf3c3ac688857710abcff92dff4f96c55c06371c39cd1440fa9c5e86ca515f7a2ebcff149bed41acdbbacdd2c24ce50d4900bc1cd1925186392e9e5bcf20777658c74c427e83ef783b6d9d04e5977b568c5fcc96801c321d1e8d0afe03c257cf580815ee4d52d344bd11ae10ba8fb683a1ceaa15781773326d138d9f273ce79a94531b9a4a69d4871d9669b88fd8435737a6bb108b062b5b40ca6201ba2ac3ce386959fb1371d43cd4daaa9fb952763ec16fe3afa65ec2848e8c9ff506e860d16905e9762db48b0449462e15c9dd761815c86708084ea159e6eacf21afe200168514b128167c95c3a675376876b879cacde8125981c5fe07f98ab0d19579639aa45f9a7ed4303302d0f03f204dca1504e97db662f51ccbff5b8f2e55713ba3291c123054ac3253a79cc9ded31def0afe73d28dc1a9c7c5e85f9cc8f2e77232530629d277b1c098b4619758d24fba3cdacff331ae60b1639ccf2de2296dc17a6c01d8b1d2fa8e5e698a225f3780f6bd54e9022a700f44881be2dd2fb7d29d838e9f54785c0d30b41e37af194963d24182193a83a2d56bdbb35218536503df649226b83b035ff80609752ac515e3581a75456e292f5a1a6d6b4609d4c7d04cd52822d82138f63c3a99e583a9a799b2ca12154cf9a3ef6604e074f4b778d5df1ced56086bc17a46bfd8c8255d2c2e4839bf0f828889bf5ad9e0e76626872f3582effd64ecf4981694a03e985f54442b0a9547c2d6566cde9d568a06c0712a731023f50e765e6ecc8851be8bf1aba87f1667a5a7e94523c908b1afd683a2000ce4a115fc500212f7dbe7db14d7ddd1a18c524ca5e50908f0c6b17867ca12696d5dec070ac9ba23e7c20f6cc85bd178f496c66238f4fba01ecf5905d8b91988d060dc01d816b65d40e153c6b0bff204b7aacc9f5b7159ee5ec6ed4cd60ad879db489a59557cf226c4e40720ff1d390c8f35e0e1f35ecb2f820514867018d8e84b17728d5b5c66722d5f2a8ce41a9f4796d076f6dced9950797e97ad6312c0e4815d5e7530d7440dc3ed2286dead4751193644940128f6c7959200932a271756f2066218597dac0b8397aebb81f5efe9a574445fe11493435a9b232cce9d664ca4fc639b2149040af7e2e6aca81c8a4ea08b25ec5c167e9d00266f4c8dada19da8959b8c56d00fc1c98caf36e73f0a5a79c7a2993855d1c8010fc5628bf67d47354c30a1d724c9394bf397b1b78817dc8e624769cd7dbec6ffd72d8e8b2dcd0d1c2da2e8a29d913df3c66c12d4bbc70893dee4be9fa9c08e232940f09fb39774371ab0f661d3231a8703288495a85a82a6b6188d8af3edb38a51b33503187b0a76eb37c9a3c659498dfb9f46d5b7a9dfa59ff074a7db5bbb0a494207ac9bed2cdb256fdb6f28fada1487b646b6ac769326136688f8d3bcbfd9874f3ada33b116c5ab6d0ccf1488eecdaf172b68401a7f71675bd03188d7b668feddb89049d63cbecd971c711a0acf7de480a6d676372906c701a094c5386a1fd857db5420e2696b9dd13e582d80b55ce8ee8499a9cbf9c757952e04e08f6aabaa74056d7e6e3fdd69c517763cedf86ca13e6dc1e03a9841ca83f3783d8197d6a27dae8228a28afcb25745d01bdc7b4f4195a98036c63c2383c35ad1e7b15a36b57632a676bbc3ed44f4e10ea1bcb85a0af465d86d8548f0896756db7adc13d1388b905eb811b7e082cd23474527c57589be8b80d4917f914d5d70beaf666818d6f167ffff307a4081a1d89b6e289c9c5e1ff2b79e90a4d7a7b4cb5cb9074990f1d48c519f2651ebb06ccc05eafa7193e0a84e581340405ca69d506b8a340af3e225973441285596e3f4a73ca7fb0515837bc1c32f916d0d35b4640a1a7a843e1591f3c9976ab886653c4287d8d2fc57326f36789b720b9fb021e2575ee526575d7c18bbb100ce00397ffeaba0ec12f24a65f60b4d5803b421b9a62c097038839fde0cfb282cef84a565b53c7c48798abd4f25bb1c774316129eb35c5eb8eca1be8e135731c47ec1cf001a2ae1b98ae6e5fc5d71a0d1358b9fde2d46e069cdb81f6d706c45b4ba95212b4e7b94b4281778fa33186694a01a27fc8a90f61c179ca31849a95de1bd9d3425f00e4fdd6a2e74e9d623b707c459353041825bec4bc5ed5eafa65f02d7cf889e269e7fd38e5cc9867a34ac21cd17f44de7cfe3ae84d35715bb66c31db73b84604126b4c3b", 0x1000}, {&(0x7f0000004a80)="90b4eee10cde597689c728853054e679b286da05c7c927d11239cf4e48f1be46c58a0403a80cbecfe25163488ac83966d397", 0x32}, {&(0x7f0000004ac0)="7b70cbce0f6d03db2c57e78e458c62072255c19b17773675501dff2f64fd17a16d14b3", 0x23}, {&(0x7f0000004b00)="6d8fe2", 0x3}, {&(0x7f0000004b40)="483325133b69655fa8a64e65851d288a346ad75e2d0e740f6d0ed0405c5803327cd232b9bc666ed14faba4c55255afb59cbdfe0aeaf50a7445a34d8d67ef67d2f60a6ddf6852924a37c0d3c8aca95177c6bcae18152716dcca67d716b59324ca8806f9a1531509ef7e7cfa", 0x6b}, {&(0x7f0000004bc0)="4b7905cef7ae5094e164ee33f143646ba53271d3b98036126ef69917a93b4c6d859d5225664125fd527853ce7a9241e91e2a69ff842af0489051ee09d1cec8907fb290a8f68614f976ff40aab24ff635e6a42c6fe45341447386ddc943e8580e070bdf7c6a2164138b8f41010b62c9d3be4b55cba7a1eee545d187b2aeb21a4fb05bd25711bb76619f3465972788ce88d91c625d14e775c85bf48453abb0713cf08004bfdead798e2d8ddc35d613d8ab119014ec8b9159302d9a845c6036b5341a8fed8dde12bd5465588c5e6dd4eaf9b50f6a713e394c06906c35dda7d6c665d0378578d9662abeaee612fb486b73809cad288e31e0793f13", 0xf9}], 0x9, 0x0, 0x0, 0x1}, {0x0, 0x0, &(0x7f0000004e80)=[{&(0x7f0000004d40)="3da44de6bd4317ab9d9914a90fa1bf239412e250684e77b6d2f4cfcdc55b43abf7cc1e63d249c656b0e4592bb2db11b723bb6f68e3a4c6fc87b48ff45c736eb8bf481a5dfe32a89036ece074b6172de1ed00243b1968fd8f25fe", 0x5a}, {&(0x7f0000004dc0)="cb20e1091d9d604bca26dc6edb0229b4f075aa55a1983ba1a8f1078d7be958983a2f74b886a71b5a35ea583dd4eece1b4ddf6549b464f014eceb675deac77b6e473a60f66824dd0e46da94c3d29b9c6eb7017b840867eb6c49717ff024c09f4d3f7fa833af10060124fe3d0788388d8d9dc25f1c509401687eef7dd0c2d3bdf2ea29190d8113ac4e00e93c70a26d89a70ad0196aaa8b14cf8f1e568d6061cd899b0ad018ffec5fefed4e815a72f6", 0xae}], 0x2, &(0x7f0000004ec0)=[@op={0x10}], 0x10, 0x20000000}], 0x8, 0x0) write$FUSE_POLL(r0, &(0x7f0000000e40)={0x18, 0x0, 0x1, {0x4}}, 0x18) perf_event_open$cgroup(&(0x7f00000001c0)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_config_ext={0x0, 0x1}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 298.697587] binder: BINDER_SET_CONTEXT_MGR already set [ 298.712019] binder: 14820:14821 ioctl 40046207 0 returned -16 [ 298.731578] binder_alloc: 14820: binder_alloc_buf, no vma 15:56:56 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x3f000000, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 298.739927] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 298.763680] binder: 14820:14848 ioctl 2284 0 returned -22 [ 298.775305] binder: 14820:14821 IncRefs 0 refcount change on invalid ref 1 ret -22 15:56:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x5af, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f0000000380)="341424b8f5cda927b0948a11a8efc8fb9fe607b07517444f32502a2e0b85cb6698140c9dda293d10e42c59078f52d60d9abd1584f17e422954a56dc054c6d4caa7ee30710746c99e1c2ab8e204339ca6eb6642e24e72c806ad08ee2c5936abc8a7aa15398f2f7d26f3f3c55dc5e638bec18ea8"}) dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:56:56 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x12, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:56 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x10400, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000140)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) r3 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x4, 0x400000) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REPLACE(r1, 0xc1105518, &(0x7f00000001c0)={{0x1, 0x7, 0x0, 0x3, 'syz1\x00', 0x3}, 0x4, 0x41b, 0xa14a, r2, 0x1, 0xf7d, 'syz0\x00', &(0x7f0000000180)=['/dev/sequencer2\x00'], 0x10, [], [0x8, 0xfffffffffffffff9, 0x8001, 0x1ff]}) 15:56:56 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x8050000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:56:56 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x5400, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:56 executing program 5: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000acc000)={@multicast2, @multicast1, 0x2}, 0xc) rt_sigreturn() setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000080)={@multicast2, @loopback}, 0xc) setsockopt$inet_mreqsrc(r0, 0x0, 0x24, &(0x7f0000000000)={@multicast2, @multicast1}, 0xc) 15:56:56 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x6, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 298.953292] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 298.988544] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:56:56 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0xb, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:56 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000180)='/dev/vcsa#\x00', 0x4, 0x80000) ioctl$VT_ACTIVATE(r0, 0x5606, 0x4) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000200), 0xffffffffffffffff) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000000)) ioctl$FS_IOC_SETFSLABEL(r1, 0xc008ae09, &(0x7f0000000400)="8bef378d68cb3a95010000000000000041dfb7c86e29018553e89af108314ab51984ca94e40054d0b5386e23817f0600dd3bf4d794d227499a048ea12358f0d812dba5ddee022c830fba9ce2c2af7571e05b6fc8f24e7c8c958151d01e014a4c33e36aaf301b3f70f04326b985d7b91c96cd8fbc46d897ea21609375124c6db8320008883f39148174544e23a26d571e05de7f341a0f97244d3882dfe82e1b8f50bad67a5d717a9fb09f73adf962d578117ffa12242036221df793b9be86b3f0d9118df3b3f9aa10a5e7745bdec73916537040ed34f5dade9ee43c1d113913143440c6a356d1047b4d06e9c970a3c0c000") syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x1400000000, 0x0) eventfd(0x9) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000000c0), &(0x7f0000000100)=0x10) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000140)=ANY=[@ANYRES32=0x0, @ANYBLOB="00be1200"], &(0x7f00000001c0)=0x8) [ 299.001057] binder: 14877:14878 unknown command 0 [ 299.015473] binder: 14877:14878 ioctl c0306201 20000440 returned -22 [ 299.054191] binder: 14877:14878 IncRefs 0 refcount change on invalid ref 1 ret -22 15:56:57 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) sched_setscheduler(0x0, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) 15:56:57 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x8, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:57 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x100000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 299.099484] binder_alloc: binder_alloc_mmap_handler: 14877 20001000-20004000 already mapped failed -16 [ 299.157402] binder: BINDER_SET_CONTEXT_MGR already set [ 299.181575] binder: 14877:14878 ioctl 40046207 0 returned -16 [ 299.195454] binder: 14877:14902 unknown command 0 [ 299.208885] binder: 14877:14902 ioctl c0306201 20000440 returned -22 [ 299.226047] binder: 14877:14890 IncRefs 0 refcount change on invalid ref 1 ret -22 15:56:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x21) ioctl$TIOCCBRK(r1, 0x5428) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = dup2(r0, 0xffffffffffffffff) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$VT_RESIZEX(r2, 0x560a, &(0x7f0000000040)={0x8001, 0x1, 0x8, 0x101, 0x1, 0x10000}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:56:57 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0xffffffff00000000, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:57 executing program 5: r0 = memfd_create(&(0x7f0000000140)="6367726f7570320075b536e08f97e10c4289e296462f3c8fc6a418228027bf4d75931e238b41cf55afcf7dd2284567ed5a738f3382aae6349e10336adf686499eb1d9379eb28", 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) ioctl$EVIOCGLED(r0, 0x80404519, &(0x7f0000000280)=""/211) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000080)=0x1) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xb8d95223) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000000)) 15:56:57 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000002c0)='./cgroup.net/syz0\x00', 0x1ff) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000300)='/dev/snapshot\x00', 0x80000, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f00000008c0)={0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000900)=0x18) sendmsg$inet_sctp(r2, &(0x7f0000000a00)={&(0x7f0000000340)=@in={0x2, 0x4e20, @loopback}, 0x10, &(0x7f0000000880)=[{&(0x7f0000000380)="02d633f5b1df8c2ae3e248d41e88947ea19b4ad00ddd950360b3670a7f86de6656a3df468a60a82d99bb030419f463c83d907ac4a867cc4f384a586651d4a5f46d77f17ef466ccd9055930cd3ff2c7a57576565f0873ea1b68eec1b82d0e69031e60c662651a9d1894cfd7dd9ff447711ddc770ea45194469f6d3333281542a5aad93d5aff", 0x85}, {&(0x7f0000000440)="bfa95280a6a40d07c8f72bc0f473198a00440ec443c92c52aab95668a5e5938f3253737385545cbadd7a805e9d87ab7bbe8540d53119c2179d38b294b62398768c303583d953fc0bdbddf93c1863aac1caa26eaf3ec06ffddbd4fc29fa8b515c11e2372cc2db82bbe0c1511ddce782625bdd88589f7ff4d3162d451c2c68d88c806051438de9e5840ff155ba3d120426a0757b38957afb9c82c92e38bed51f82044b91ffcef1fab84d0134fcf3192409ff8cd51c44d386a3b020ba", 0xbb}, {&(0x7f0000000500)="489c8de688c11563ba4562303baf890b55da252e6639245afc8d7e43dc8c166a3b335b49f1ae806a5e6da06b671d03babb64f230ee11216d4268f28c681ae6d885b394801f03efa7b5106f4301d63dcdcb823bb49860e30da7a495624595ef55515bfd9bf7a6dbde61614ce8300a42c020b0f95c0a95d1abdc0d1b4f34d19bd51a8eabb8beb43261279f8f6b93fe6c37e375ba7d6baa6775ba37d83a3aaaa15eb6b6f597e314a92bb502", 0xaa}, {&(0x7f00000005c0)="68c8d9b1872fcbf87ae19e7fa19a189dfff5cfab13329b9d30c67bee994dc08e690f9e740fbf27d79a8698224bda19dd349ac0efe2e393abf7895e02d71586c0add5d48b36f88bb4a7907800ea8529a046cfa24af481bb0a4b71d6812be6daed904a61fc0b69f4d9df481fe9bd1b9526ec8f153638bc6e0285c1b9d89d28c813e969ab6d9be7c35371345ed1b4107fb2f27eace75520f53508068536", 0x9c}, {&(0x7f0000000680)="511081b227befeece671d8949b228860c1f63d09a7d0db6b82d753aab21c1bebc14e09da70ba49bf5424b444e180c1134b9624dfd8b47fd03aaa8a191df9ea925ed822301bbafbdfebe7ca7506d278ccc593439ff2a21e0dfd114e747c822f04fb2e1ebbe9b7fa045b26ddd57d", 0x6d}, {&(0x7f0000000700)="49414d5b68e4daa33e7ece3e595c1c1a763a87a14b69997271cf4989928bd2ff54448da8140140f4aab1ee82a4fe29d455f5974481ba855142e9b7f85cdeab12b0bb3827309d192fb777821233e1abd7477d2d5204a6d20914aaca65a997582cf71af923ee7d6cbb3767c82ea4f9ae714f63ff943bd6ae38a798ffbd565a675601d2bf882d71e778c322622e171fb6457ba50ba2b5e6e1f51279db8c28e6a0b31e6ebaca4fb5a486aefcd593dafd52c3104b0192e4cdfe42a4a6314f383060f777d7b8440dcc043b6dd48f12b282eb28304f50e044cbe56de15b18cc810f86", 0x23}, {&(0x7f0000000800)="b1a7e4af3a1be3da8e7f8575167aa202600e212d57b66ee01ff51911e4749aeb837016e652f2aa36053f36ca48ece98b026d0c6140e5380f2aab4b74ac50eb120fa22ff7", 0x44}], 0x7, &(0x7f0000000940)=[@sndinfo={0x1c, 0x84, 0x2, {0x8, 0x1, 0x6, 0x10000, r3}}, @authinfo={0x10, 0x84, 0x6, {0x8}}, @prinfo={0x14, 0x84, 0x5, {0x0, 0x100000000}}, @dstaddrv6={0x1c, 0x84, 0x8, @local}, @prinfo={0x14, 0x84, 0x5, {0x20, 0xbda9}}], 0x70, 0x20048844}, 0x11) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) r5 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x3, 0x200000) ioctl$KVM_SET_GSI_ROUTING(r5, 0x4008ae6a, &(0x7f0000000140)={0x7, 0x0, [{0x5, 0x7, 0x0, 0x0, @irqchip={0x2, 0x8}}, {0x1, 0x3, 0x0, 0x0, @adapter={0xffff, 0x4, 0x10000, 0x0, 0x3}}, {0xffff, 0x0, 0x0, 0x0, @adapter={0x2de4, 0x59, 0x1, 0xba, 0x1000}}, {0x770b55df, 0x2, 0x0, 0x0, @irqchip={0x6, 0x8}}, {0x2, 0x4, 0x0, 0x0, @msi={0xfffffffffffffff9, 0x4, 0x6}}, {0x1ff, 0x3, 0x0, 0x0, @adapter={0x400, 0xffffffffffffffe0, 0xfffffffffffffff8, 0x8a, 0x100}}, {0x7, 0x3, 0x0, 0x0, @irqchip={0xed64, 0x1}}]}) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r5, 0x84, 0x77, &(0x7f0000000a40)={r4, 0x7ff, 0x8, [0x8, 0x3ff, 0xfffffffffffffffa, 0x2, 0x0, 0x8, 0x100000000, 0x8]}, &(0x7f0000000a80)=0x18) ioctl$TIOCGLCKTRMIOS(r5, 0x5456, &(0x7f00000000c0)={0x8, 0x81, 0x1, 0x7, 0x2, 0x2082, 0x8, 0x280f, 0x7, 0x1f, 0x7f, 0x10000}) ioctl$EVIOCREVOKE(r5, 0x40044591, &(0x7f00000009c0)=0x5) 15:56:57 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x6, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 299.274359] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:56:57 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x100000000000000, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 299.349802] binder: 14916:14917 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 299.376538] binder: BINDER_SET_CONTEXT_MGR already set 15:56:57 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x300000000000000, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:57 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x8100000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:56:57 executing program 5: io_setup(0x9, &(0x7f0000000000)=0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$inet_mreq(r1, 0x0, 0x24, &(0x7f0000000040)={@rand_addr, @dev}, &(0x7f00000000c0)=0x8) io_getevents(r0, 0xfffffffffffff000, 0x0, &(0x7f0000000040), &(0x7f0000000080)={0x0, 0x989680}) unshare(0x40000000) pselect6(0x40, &(0x7f0000000100)={0x5904, 0x8, 0x3, 0x3, 0xffff, 0x38, 0x2, 0x2}, &(0x7f0000000140)={0x4, 0x4, 0x400, 0x9, 0x7e, 0x7fff, 0x100, 0x1}, &(0x7f0000000180)={0x18c3, 0x9, 0xffffffffffff8000, 0x3, 0xa901, 0xffffffffffff9ba2, 0x8, 0x4}, &(0x7f00000001c0), &(0x7f0000000240)={&(0x7f0000000200)={0x4}, 0x8}) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vcs\x00', 0x1, 0x0) ioctl$BINDER_SET_MAX_THREADS(r2, 0x40046205, 0x3) 15:56:57 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x40000400, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f00000000c0)=ANY=[@ANYBLOB="e0000001ac1414aa0000000006000000d763"], 0x10) [ 299.418172] binder: 14916:14923 ioctl 40046207 0 returned -16 [ 299.428559] binder: 14916:14917 IncRefs 0 refcount change on invalid ref 1 ret -22 15:56:57 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x8, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:57 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0xfeffffff, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x40000000000000) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB="0000001000000000"]], 0x0, 0x0, &(0x7f00000003c0)}) openat$ipvs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/vs/cache_bypass\x00', 0x2, 0x0) r2 = dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000140)}) getsockopt$IP_VS_SO_GET_INFO(r2, 0x0, 0x481, &(0x7f0000000040), &(0x7f0000000140)=0xc) [ 299.523235] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 299.591029] IPVS: ftp: loaded support on port[0] = 21 15:56:57 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x4000000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:56:57 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x2, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:56:57 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x4000000, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 299.621317] binder: 14943:14945 got transaction with invalid offset (268435456, min 0 max 24) or object. [ 299.626543] IPVS: ftp: loaded support on port[0] = 21 [ 299.656989] binder_transaction: 8 callbacks suppressed [ 299.657009] binder: 14943:14945 transaction failed 29201/-22, size 24-8 line 3033 [ 299.682258] binder: 14943:14945 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 299.711606] binder_alloc: binder_alloc_mmap_handler: 14943 20001000-20004000 already mapped failed -16 15:56:57 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x700, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 299.729620] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 299.731323] binder: BINDER_SET_CONTEXT_MGR already set [ 299.744869] binder_alloc: 14943: binder_alloc_buf, no vma [ 299.750998] binder: 14943:14950 transaction failed 29189/-3, size 24-8 line 2970 [ 299.763226] binder: 14943:14945 ioctl 40046207 0 returned -16 15:56:57 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x6000000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:56:57 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x3, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 299.795803] binder_release_work: 7 callbacks suppressed [ 299.795811] binder: undelivered TRANSACTION_ERROR: 29189 [ 299.806832] binder: 14943:14950 IncRefs 0 refcount change on invalid ref 1 ret -22 15:56:57 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0xffffffffffffffff, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 299.909891] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 300.013162] IPVS: ftp: loaded support on port[0] = 21 [ 300.029505] IPVS: ftp: loaded support on port[0] = 21 15:57:01 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000001, 0x0, 0x8, 0x0, 0x0, 0xfffffffffffffffc, 0xffffffffffffffff, 0xfffffffffffffffe, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x1, 0x0, 0x0, 0x10000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sync() 15:57:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) ioctl$KVM_SET_GUEST_DEBUG(r2, 0x4048ae9b, &(0x7f0000000140)={0x40000, 0x0, [0x5, 0xfffffffffffffff9, 0x7, 0x5, 0x80000001, 0x7, 0x9, 0x7fffffff]}) r3 = dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(r3, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:57:01 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x7, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:01 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x4800000000000000, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:01 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0xf0ffffff}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:01 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x80, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @dev={0xfe, 0x80, [], 0xc}, 0x1000}, 0x1c) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) 15:57:01 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x5c00000000000000, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 303.144048] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 303.153188] binder: release 14975:14976 transaction 707 out, still active [ 303.160202] binder: unexpected work type, 4, not freed [ 303.172900] binder: 14975:14976 ioctl 541b 20000000 returned -22 [ 303.187893] binder: undelivered TRANSACTION_COMPLETE 15:57:01 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x3, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:01 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x700}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 303.210382] binder: invalid inc weak node for 708 15:57:01 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000f68000)={@loopback, 0x800, 0x0, 0xff, 0x1}, 0x20) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000000)=@routing, 0x8) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000f68000)={@mcast2, 0x800, 0x0, 0x103, 0x2}, 0x20) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000040)=0x0) ptrace$setregset(0x4205, r1, 0x203, &(0x7f0000000080)={0xfffffffffffffffe}) [ 303.243603] binder: 14975:14976 IncRefs 0 refcount change on invalid ref 1 ret -22 15:57:01 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) mlock2(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1) [ 303.305576] binder_alloc: binder_alloc_mmap_handler: 14975 20001000-20004000 already mapped failed -16 [ 303.309786] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 303.334230] binder: BINDER_SET_CONTEXT_MGR already set 15:57:01 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0xb000000, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:01 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x4, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 303.357325] binder: 14975:14976 ioctl 40046207 0 returned -16 [ 303.357364] binder_alloc: 14975: binder_alloc_buf, no vma [ 303.383009] binder: 14975:15004 transaction failed 29189/-3, size 24-8 line 2970 [ 303.447095] binder: undelivered TRANSACTION_ERROR: 29189 [ 303.456663] binder: 14975:15004 ioctl 541b 20000000 returned -22 [ 303.476745] binder: send failed reply for transaction 707, target dead 15:57:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = memfd_create(&(0x7f0000000140)='/dev/binder#\x00', 0x1) ioctl$RTC_RD_TIME(r2, 0x80247009, &(0x7f0000000180)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYBLOB="85d3c57300008000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) r3 = dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) bpf$OBJ_PIN_PROG(0x6, &(0x7f00000000c0)={&(0x7f0000000040)='./file0\x00', r3}, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x8, 0x0, &(0x7f00000001c0)="7af63a82dd44f764"}) 15:57:01 executing program 5: io_setup(0x0, &(0x7f0000000100)) r0 = socket(0xa, 0x1, 0x0) getsockopt$inet6_int(r0, 0x6, 0x23, &(0x7f0000000100), &(0x7f0000013000)=0x10) 15:57:01 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x40000000, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:01 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) gettid() setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) 15:57:01 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x4000000000000000, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:01 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={&(0x7f0000000200), 0xc, &(0x7f0000000080)={&(0x7f0000000100)=@ipv6_deladdr={0x2c, 0x15, 0x101, 0x0, 0x0, {0xa, 0xf0ffffffffffff}, [@IFA_LOCAL={0x14}]}, 0x2c}}, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x4000, 0x0) write$FUSE_OPEN(r1, &(0x7f0000000040)={0x20, 0x0, 0x6, {0x0, 0x2}}, 0x20) 15:57:01 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x6}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:01 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x300, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 303.671919] binder: 15029:15032 got transaction with invalid offset (0, min 0 max 24) or object. [ 303.700626] binder: 15029:15032 transaction failed 29201/-22, size 24-8 line 3033 15:57:01 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x40000000, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:01 executing program 4: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x2000, 0x0) ioctl$NBD_SET_TIMEOUT(r0, 0xab09, 0x7) r1 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) [ 303.727324] binder: undelivered TRANSACTION_ERROR: 29201 [ 303.742066] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 303.751094] binder: 15029:15032 IncRefs 0 refcount change on invalid ref 1 ret -22 15:57:01 executing program 5: syz_open_dev$evdev(&(0x7f0000000080)='/dev/input/event#\x00', 0x2, 0x28021) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000100), 0x4) ioctl$int_in(r0, 0x5452, &(0x7f0000000380)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f0000000240)=@assoc_value={0x0, 0xff}, &(0x7f0000000280)=0x8) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f00000003c0)={r1, 0xffffffffffff3007}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000200)=[@in6={0xa, 0x4e21, 0x1}, @in={0x2, 0x4e20, @multicast1}], 0x2c) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x0, @local, 0x2000000006}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e1f, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r2, &(0x7f00000002c0), 0x400000000000027, 0x2000000) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) recvmmsg(0xffffffffffffffff, &(0x7f0000001c00)=[{{0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000800)=""/65, 0x41}], 0x1, &(0x7f0000000a00)=""/181, 0xb5}}], 0x1, 0x0, &(0x7f0000000040)) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000ac0)={"55c990aa4964e82a3ec457f4c7d69681319b32c4fe546fdaa52a7f1ee7a27d5f71fb895c4bf21bf0301d2a160f646d230ecc224077896302fd1e64ad393ef24145492c44f164e53100dc89f52d25895dcd4320f649fc784145767a5224088c492511d0a5d7bb0c0176706c238dfeee9caae8811ba9d2ec92a4a340c091647ae36123d290d72c375af37957c01aa945bdb6a7a6870069350c7c2ac6b9c032e80d8150743be19fbaf9447badcc1908d174e06fd466e64e24e3c892ee52a4b31338ad67030baeffa5bfa701c1e7bfbd8fd016d87018d05ab11f9e813877bd9cdf0884cbaabe09190f95550884f8a1e6510f6bbe96f86859597bf89741aea068e55b938ebee9d9bff58478513c4b72edbf79f75431b54743ab05d3980b30b2127cf13bf94beba0828a4bb1848bc1f862fac00698e4bd2f4bde3bb35107056c4147c0ed8d7d588ba03c37b82ea384d1db706a8b46ee351812ad747d1045540a48b542996812548270c5af5d27ff72920bebd8371348c7f55a953e236ac13fe737a81bd9b61e30a5e9c526cf61862f5a0a90963c73febe3b66ab29f17b6da74b7647bcc4e527356d57fa1fe3f3dffab39df7b353eda6b839decb4484939f4fc0c84bda1c964941ccf4db1ca0d2c152fd356ac66441c8b68755d533b416d9f7999678227c7a69db08e997252dd6a38fc458d93fac9f1f14f49b7ca4a0b0c8b538d2f30c34503a0975506ae9004b3e5c3d2469cf4e03d9b79dc1499647b5b680a02bdc56c18782c48120dee663918288f068c49d85355d114cfe0c5d1405cf5e37b181f296fa7dc9af116fbe220121fe139739226eefce468f27f5d21ab51ef0e26134c5341cf13799003ceb38d4050c2ba1c9e6decc2d11a8f14a6adadd45e615106b5dd4c07093ba114ac55b4e80d1a3545ab6e8fbf796b908ecc244340fc06e4d4bd6e069b7f0232198ab067a709bcdd4d41500e5dc7032e5993f965d4603033fe61cc523937d7345df42b4f1b62c4daf64f6c29eb2f214b88680bfe19252b67719ccea37d19fe3bfb0c8ad0bd6f4a1df532ec9220269453df5144ff48f63c2ad655b8f20db01b3af95c11f4e7de2bd0a47d47b08b620589a33327bef9ee310505c1736510e88b74281f098099c753d30fcf32f31a0521e32407d689b093f24d07049682ff4662b5b94616699fd704589c0edb02cf3e622088c685564b0c166f9f3cdb12dd8a70684ac6e24570191dda2db2b1965d2397a45060f834405b81fa79204e029b7cd93333dfbef669f3e480fd071f5b87e9fdf984dfe176353ed12ea15484366548336f540a5f1e8b9e19bdeb8d71dce9ecf03d09515bc4bcf7be382176e7e12395ee0f795f76695d0d90eee181d300deb89d7098403ac76309e63f6ca3eade1ce57dcd9de56e24610ed5c470d5540e9f50d068ee8a1431bb3216ae99b18"}) socket$inet6(0xa, 0x3, 0x1400000000) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@textreal={0x8, &(0x7f0000000100)="66b91000004066b80000000066ba000000000f30baa000eddb8f05000f89ae6a660f3a22efa80f09f00fc709f20f1ab60d0066b93608000066b80000000066ba008000000f3066b9800000c00f326635000800000f30", 0x56}], 0x1, 0x0, &(0x7f00000000c0), 0x0) ioctl$KVM_SET_LAPIC(r4, 0x4400ae8f, &(0x7f00000016c0)={"ce51ded145d0fdec431460de156134cbc1c072a52ffcec572456c3f5a18684752301000000010000005ce4b53a955d8738cf0a3d1a000000000000007f6c83d4b257a2b7261dcdbf961639a5976bf8769bb4451120a1cb6b3511ac5fec3f031b5b52f3f1ecb8c3cafee2159de782753b997144c576689dd822add5da7f65c206de64f60e8aaebf61f1267c977193c96f4ed1c64dda0062e21d2242879ad09896baef52f1610436a19a2001b72b6891ec370b916e3fc2e54ff6a602082b89bdb1cab587a749befab8ea7e16cc906f00ad4feecfb249de45e81059a320afce7f042cb918bd139b78e5cd971081d382b0a91461f71fd925923a3c23bff4335c639c2bedf3e4f03ebcbbfb36086cc86388790522d36364e453c3b80748fc91a4949b0749941ed62d4dd2329e9aefdb3a0fb20eb924227e24524c990965f7c4c900376860a8ba004fc01072e74052d25f319675df5f69bc8db18b6a219458afbd9f0b057ae630f12105c0adb2b97aa1ac8666b93488ffc170f1ff334eaec60ba54d9df2a3bc1fd87783f783bae8f9701d59660984fb8229eb935e174ac97b456938b93a1218d1d1eebe4743ef07900528099c9c612d959b92a9f155e50bf5b05690a648820d8bc1c091f8ad472d5c92dfa998937c760f59aaa70e82361038ddd3e759cc9c50c96ba09344a6b64b29ad361e034726deebf52f401e33528b6df1ef85f83ac71c3b4f9c717103236a409612f244ea495fe97440cda2f97c8a1177e9af0572a960147f7e3a9a7422908672e65272328503504e528b004d1adfca7d814a1c0d18faf4430c61d5b40c32e267c5a994d294910e5fd7f7df8787566ba9a120db61bcae77c145eb1ca45e268f7a9da5cf09a6a76c1ea3165f576b7b2ce7e55670f74e4a8cf9b944d48c0e1b4adf58a440aacadaec980d9a31295253f1e7b80dac1aa49d4e9521a50b773709c161c48bac2cfed0949beda15de0d78a0540c17be0e2d8963374b456c62f6571b7b634f49c560cbc4a23b2b77445b9c026022d7b5fe05777713cc8ca5009d1e0d0738ed6abbefd54000c3a8e9004790a05f56bf42ef4b9b60cf7e6dda8588d8a96ff5f2f47dd89bdc33e57c744a2b4ed1fc83e5cb13fa334dd0041d13ca3a7cb78e02a328e4a5ab9b9b88a2e0819794e4a9e2ff9eeeb18529b61cf250db1f72e41c29c5b70af48551eb33740bd38503720d54b3437508e8fc817cba05a67008c79000005042e257536c0bed690b140666f239974d21cdcf446070d7e506e0a7a34500a647ac343e754f1f07e0dd5c4767bf29459f401bb3d6ecf17b60c26602f325150759b5da60fbee3eed062e2595152a892b6adb1ecab834e158fd343b036378ca67baf69e299062474e7a475f67016055427985976e533ce1b35725d3e29de450200"}) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)) 15:57:01 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0xffffffff00000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 303.915696] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 304.440554] binder_alloc: binder_alloc_mmap_handler: 15029 20001000-20004000 already mapped failed -16 [ 304.457117] binder: BINDER_SET_CONTEXT_MGR already set [ 304.469339] binder: 15029:15040 ioctl 40046207 0 returned -16 [ 304.476249] binder_alloc: 15029: binder_alloc_buf, no vma [ 304.481933] binder: 15029:15074 transaction failed 29189/-3, size 24-8 line 2970 15:57:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) r2 = dup2(r1, r0) ioctl$KVM_CHECK_EXTENSION(r2, 0xae03, 0x0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="0021000020004a15"], 0x0, 0x0, &(0x7f0000000500)}) 15:57:02 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0xfffffffe, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:02 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x2000000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:02 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x4000, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:02 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000140)=ANY=[@ANYBLOB="e0000001ac1414aa0000000006000000d76e5fd0e870835ede9942ffa9b33e8264b844d1f6ab2b22afcc6e73a24ff64440a4eaa35367813d2fa4a9fc70ac42e72952df407e91e23dfed7e8d956b513"], 0x10) r2 = fcntl$dupfd(r0, 0x406, r0) write$cgroup_pid(r2, &(0x7f0000000040)=r1, 0x12) 15:57:02 executing program 5: syz_open_dev$evdev(&(0x7f0000000080)='/dev/input/event#\x00', 0x2, 0x28021) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000100), 0x4) ioctl$int_in(r0, 0x5452, &(0x7f0000000380)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f0000000240)=@assoc_value={0x0, 0xff}, &(0x7f0000000280)=0x8) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f00000003c0)={r1, 0xffffffffffff3007}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000200)=[@in6={0xa, 0x4e21, 0x1}, @in={0x2, 0x4e20, @multicast1}], 0x2c) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x0, @local, 0x2000000006}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e1f, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r2, &(0x7f00000002c0), 0x400000000000027, 0x2000000) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) recvmmsg(0xffffffffffffffff, &(0x7f0000001c00)=[{{0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000800)=""/65, 0x41}], 0x1, &(0x7f0000000a00)=""/181, 0xb5}}], 0x1, 0x0, &(0x7f0000000040)) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000ac0)={"55c990aa4964e82a3ec457f4c7d69681319b32c4fe546fdaa52a7f1ee7a27d5f71fb895c4bf21bf0301d2a160f646d230ecc224077896302fd1e64ad393ef24145492c44f164e53100dc89f52d25895dcd4320f649fc784145767a5224088c492511d0a5d7bb0c0176706c238dfeee9caae8811ba9d2ec92a4a340c091647ae36123d290d72c375af37957c01aa945bdb6a7a6870069350c7c2ac6b9c032e80d8150743be19fbaf9447badcc1908d174e06fd466e64e24e3c892ee52a4b31338ad67030baeffa5bfa701c1e7bfbd8fd016d87018d05ab11f9e813877bd9cdf0884cbaabe09190f95550884f8a1e6510f6bbe96f86859597bf89741aea068e55b938ebee9d9bff58478513c4b72edbf79f75431b54743ab05d3980b30b2127cf13bf94beba0828a4bb1848bc1f862fac00698e4bd2f4bde3bb35107056c4147c0ed8d7d588ba03c37b82ea384d1db706a8b46ee351812ad747d1045540a48b542996812548270c5af5d27ff72920bebd8371348c7f55a953e236ac13fe737a81bd9b61e30a5e9c526cf61862f5a0a90963c73febe3b66ab29f17b6da74b7647bcc4e527356d57fa1fe3f3dffab39df7b353eda6b839decb4484939f4fc0c84bda1c964941ccf4db1ca0d2c152fd356ac66441c8b68755d533b416d9f7999678227c7a69db08e997252dd6a38fc458d93fac9f1f14f49b7ca4a0b0c8b538d2f30c34503a0975506ae9004b3e5c3d2469cf4e03d9b79dc1499647b5b680a02bdc56c18782c48120dee663918288f068c49d85355d114cfe0c5d1405cf5e37b181f296fa7dc9af116fbe220121fe139739226eefce468f27f5d21ab51ef0e26134c5341cf13799003ceb38d4050c2ba1c9e6decc2d11a8f14a6adadd45e615106b5dd4c07093ba114ac55b4e80d1a3545ab6e8fbf796b908ecc244340fc06e4d4bd6e069b7f0232198ab067a709bcdd4d41500e5dc7032e5993f965d4603033fe61cc523937d7345df42b4f1b62c4daf64f6c29eb2f214b88680bfe19252b67719ccea37d19fe3bfb0c8ad0bd6f4a1df532ec9220269453df5144ff48f63c2ad655b8f20db01b3af95c11f4e7de2bd0a47d47b08b620589a33327bef9ee310505c1736510e88b74281f098099c753d30fcf32f31a0521e32407d689b093f24d07049682ff4662b5b94616699fd704589c0edb02cf3e622088c685564b0c166f9f3cdb12dd8a70684ac6e24570191dda2db2b1965d2397a45060f834405b81fa79204e029b7cd93333dfbef669f3e480fd071f5b87e9fdf984dfe176353ed12ea15484366548336f540a5f1e8b9e19bdeb8d71dce9ecf03d09515bc4bcf7be382176e7e12395ee0f795f76695d0d90eee181d300deb89d7098403ac76309e63f6ca3eade1ce57dcd9de56e24610ed5c470d5540e9f50d068ee8a1431bb3216ae99b18"}) socket$inet6(0xa, 0x3, 0x1400000000) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@textreal={0x8, &(0x7f0000000100)="66b91000004066b80000000066ba000000000f30baa000eddb8f05000f89ae6a660f3a22efa80f09f00fc709f20f1ab60d0066b93608000066b80000000066ba008000000f3066b9800000c00f326635000800000f30", 0x56}], 0x1, 0x0, &(0x7f00000000c0), 0x0) ioctl$KVM_SET_LAPIC(r4, 0x4400ae8f, &(0x7f00000016c0)={"ce51ded145d0fdec431460de156134cbc1c072a52ffcec572456c3f5a18684752301000000010000005ce4b53a955d8738cf0a3d1a000000000000007f6c83d4b257a2b7261dcdbf961639a5976bf8769bb4451120a1cb6b3511ac5fec3f031b5b52f3f1ecb8c3cafee2159de782753b997144c576689dd822add5da7f65c206de64f60e8aaebf61f1267c977193c96f4ed1c64dda0062e21d2242879ad09896baef52f1610436a19a2001b72b6891ec370b916e3fc2e54ff6a602082b89bdb1cab587a749befab8ea7e16cc906f00ad4feecfb249de45e81059a320afce7f042cb918bd139b78e5cd971081d382b0a91461f71fd925923a3c23bff4335c639c2bedf3e4f03ebcbbfb36086cc86388790522d36364e453c3b80748fc91a4949b0749941ed62d4dd2329e9aefdb3a0fb20eb924227e24524c990965f7c4c900376860a8ba004fc01072e74052d25f319675df5f69bc8db18b6a219458afbd9f0b057ae630f12105c0adb2b97aa1ac8666b93488ffc170f1ff334eaec60ba54d9df2a3bc1fd87783f783bae8f9701d59660984fb8229eb935e174ac97b456938b93a1218d1d1eebe4743ef07900528099c9c612d959b92a9f155e50bf5b05690a648820d8bc1c091f8ad472d5c92dfa998937c760f59aaa70e82361038ddd3e759cc9c50c96ba09344a6b64b29ad361e034726deebf52f401e33528b6df1ef85f83ac71c3b4f9c717103236a409612f244ea495fe97440cda2f97c8a1177e9af0572a960147f7e3a9a7422908672e65272328503504e528b004d1adfca7d814a1c0d18faf4430c61d5b40c32e267c5a994d294910e5fd7f7df8787566ba9a120db61bcae77c145eb1ca45e268f7a9da5cf09a6a76c1ea3165f576b7b2ce7e55670f74e4a8cf9b944d48c0e1b4adf58a440aacadaec980d9a31295253f1e7b80dac1aa49d4e9521a50b773709c161c48bac2cfed0949beda15de0d78a0540c17be0e2d8963374b456c62f6571b7b634f49c560cbc4a23b2b77445b9c026022d7b5fe05777713cc8ca5009d1e0d0738ed6abbefd54000c3a8e9004790a05f56bf42ef4b9b60cf7e6dda8588d8a96ff5f2f47dd89bdc33e57c744a2b4ed1fc83e5cb13fa334dd0041d13ca3a7cb78e02a328e4a5ab9b9b88a2e0819794e4a9e2ff9eeeb18529b61cf250db1f72e41c29c5b70af48551eb33740bd38503720d54b3437508e8fc817cba05a67008c79000005042e257536c0bed690b140666f239974d21cdcf446070d7e506e0a7a34500a647ac343e754f1f07e0dd5c4767bf29459f401bb3d6ecf17b60c26602f325150759b5da60fbee3eed062e2595152a892b6adb1ecab834e158fd343b036378ca67baf69e299062474e7a475f67016055427985976e533ce1b35725d3e29de450200"}) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)) [ 304.490405] binder: undelivered TRANSACTION_ERROR: 29189 [ 304.496837] binder: 15029:15072 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 304.552093] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:02 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) tgkill(r1, r1, 0x34) 15:57:02 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0xf0}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 304.627942] binder: 15087:15088 got transaction with invalid offset (0, min 0 max 24) or object. 15:57:02 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x700000000000000, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:02 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x300000000000000, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 304.674972] binder: 15087:15088 transaction failed 29201/-22, size 24-8 line 3033 [ 304.731553] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 304.761908] binder: undelivered TRANSACTION_ERROR: 29201 [ 304.762675] binder: 15087:15092 ioctl ae03 0 returned -22 15:57:02 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x10200, 0x0) ioctl$SCSI_IOCTL_SYNC(r2, 0x4) sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000200)=ANY=[@ANYBLOB="7f000001d39e14fc0b0000747d7bff029b137ba704000000200fe3d3efafa606f914d5a88faa572b88b34fdab527da9646b9e8cd719ead5a1c91bf5cdce39fb40f5e1a21150dc82457e825e39383f85d15a3ae928c35e05e0e6e3cb6ba2323e30b21d38392000d906457d0566ff38cda3c38f46ca792cd9bed1e41611cecfb202406d25ed68b2a1bfa65d698575424379e88f80a7727ac3850eb004e29a41a9c3e0d4bcc219104843f009e3fca8a0dcdff9eaabc78d3457b000000000000"], 0x300) [ 304.808501] binder: 15087:15088 unknown command 8448 15:57:02 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x200000000000000, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 304.856546] binder: 15087:15088 ioctl c0306201 20000080 returned -22 [ 304.923216] binder_alloc: binder_alloc_mmap_handler: 15087 20001000-20004000 already mapped failed -16 [ 304.962103] binder: BINDER_SET_CONTEXT_MGR already set [ 304.997861] binder: 15087:15088 ioctl 40046207 0 returned -16 [ 304.997903] binder_alloc: 15087: binder_alloc_buf, no vma [ 305.016670] binder: 15087:15092 transaction failed 29189/-3, size 24-8 line 2970 [ 305.027779] binder: 15087:15092 ioctl ae03 0 returned -22 [ 305.033724] binder: undelivered TRANSACTION_ERROR: 29189 [ 305.039533] binder: 15087:15092 unknown command 8448 [ 305.045181] binder: 15087:15092 ioctl c0306201 20000080 returned -22 15:57:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = dup2(r1, r0) ioctl$KVM_GET_TSC_KHZ(r2, 0xaea3) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:57:03 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0xb00000000000000, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:03 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x600000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:03 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x60002103, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)=ANY=[@ANYBLOB="59eb34bc0400"], 0x10) eventfd2(0x6, 0x800) 15:57:03 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x800000000000000, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 305.139977] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 305.147476] IPVS: ftp: loaded support on port[0] = 21 [ 305.172854] binder: release 15126:15127 transaction 718 out, still active [ 305.180481] binder: 15126:15127 ioctl aea3 0 returned -22 [ 305.190001] binder: unexpected work type, 4, not freed [ 305.205510] binder: invalid inc weak node for 719 [ 305.211672] binder: undelivered TRANSACTION_COMPLETE [ 305.248875] binder: 15126:15127 IncRefs 0 refcount change on invalid ref 1 ret -22 15:57:03 executing program 5: prctl$void(0x7) capset(&(0x7f0000000240)={0x1000000020080522}, &(0x7f0000000080)) mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r0 = inotify_init() inotify_add_watch(r0, &(0x7f00000000c0)='./control\x00', 0x80000000) 15:57:03 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x600, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:03 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0xb00000000000000, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:03 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x700000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 305.293042] binder_alloc: binder_alloc_mmap_handler: 15126 20001000-20004000 already mapped failed -16 [ 305.337984] binder: BINDER_SET_CONTEXT_MGR already set [ 305.371220] binder: 15126:15127 ioctl 40046207 0 returned -16 [ 305.377802] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:03 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x3f00000000000000, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:03 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x4000, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 305.416306] binder: 15126:15146 ioctl aea3 0 returned -22 [ 305.421062] binder_alloc: 15126: binder_alloc_buf, no vma [ 305.432180] binder: 15126:15146 IncRefs 0 refcount change on invalid ref 1 ret -22 15:57:03 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x80000020002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x200, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f00000001c0)={{0x7, 0x2, 0x6, 0x9, '\x00', 0xffffffffffffffff}, 0x4, 0x9, 0xfffffffffffffff9, r1, 0x2, 0x70, 'syz1\x00', &(0x7f0000000180)=['userwlan1md5sumem1em1selinux\x00', 'proc\x00'], 0x22, [], [0xffffffff, 0x7f, 0x6, 0x4]}) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x4400, 0x0) ioctl$TIOCSPGRP(r3, 0x5410, &(0x7f0000000100)=r1) [ 305.514501] binder: send failed reply for transaction 718, target dead [ 305.522138] binder: 15126:15141 transaction failed 29189/-3, size 24-8 line 2970 15:57:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000040)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x4c, 0x0, &(0x7f0000000280)=[@transaction_sg={0x40486311, {{0x1, 0x0, 0x3, 0x0, 0x11, 0x0, 0x0, 0x48, 0x20, &(0x7f0000000140)=[@fd={0x66642a85, 0x0, r2}, @fd={0x66642a85, 0x0, r0, 0x0, 0x3}, @flat={0x776a2a85, 0x0, r3, 0x3}], &(0x7f00000000c0)=[0x18, 0x0, 0x30, 0x40]}, 0x2}}], 0x0, 0x0, &(0x7f0000000500)}) 15:57:03 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x3f00000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:03 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140)='/dev/uinput\x00', 0x0, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x6, 0x8800) ioctl$TIOCGLCKTRMIOS(r1, 0x405c5503, &(0x7f0000000080)={0x0, 0x0, 0x94ac, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) ioctl$UI_DEV_SETUP(r0, 0x5501, &(0x7f0000000300)={{}, 'syz1\x00'}) r2 = syz_open_pts(0xffffffffffffff9c, 0x400000) ioctl$TCGETS(r2, 0x5401, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045566, 0x0) [ 305.555880] binder: undelivered TRANSACTION_ERROR: 29189 15:57:03 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0xb00, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 305.625833] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:03 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0xb00, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB="0000c49303000000"]], 0x0, 0x0, &(0x7f00000003c0)}) r2 = dup3(r1, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="11634840010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f0000000180)=ANY=[], @ANYBLOB]}) [ 305.669841] binder: release 15160:15163 transaction 723 out, still active [ 305.691140] binder_alloc: 15160: binder_alloc_buf, no vma [ 305.697039] binder: unexpected work type, 4, not freed [ 305.712215] binder: 15160:15163 transaction failed 29189/-3, size 72-32 line 2970 [ 305.728804] binder: undelivered TRANSACTION_COMPLETE 15:57:03 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x200000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:03 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x2, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 305.782792] binder_alloc: binder_alloc_mmap_handler: 15160 20001000-20004000 already mapped failed -16 [ 305.821100] binder: BINDER_SET_CONTEXT_MGR already set 15:57:03 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x700, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 305.834382] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 305.851357] binder: 15160:15163 ioctl 40046207 0 returned -16 [ 305.851952] binder: BINDER_SET_CONTEXT_MGR already set 15:57:03 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x2000000, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 305.882866] binder: 15177:15178 ioctl 40046207 0 returned -16 [ 305.891721] binder: 15160:15187 got transaction to invalid handle [ 305.891728] binder_alloc: 15160: binder_alloc_buf, no vma [ 305.891770] binder: 15160:15173 transaction failed 29189/-3, size 24-8 line 2970 [ 305.918470] binder_alloc: 15160: binder_alloc_buf, no vma [ 305.929147] binder: undelivered TRANSACTION_ERROR: 29189 [ 305.939012] binder: undelivered TRANSACTION_ERROR: 29189 [ 305.957920] binder: send failed reply for transaction 723, target dead [ 305.974541] binder: 15177:15178 got transaction to invalid handle [ 305.979110] binder: 15177:15189 transaction failed 29189/-3, size 24-8 line 2970 15:57:03 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x7000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:03 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000040)={0x0, 0x2d, "4a782f0ce4b8ae5c59a94b68d97b5127799aa841dda23d55ae24ae92d20a1173186efe66fad99da79f4931b921"}, &(0x7f00000000c0)=0x35) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={r2, 0xb0, &(0x7f0000000140)=[@in={0x2, 0x4e20, @remote}, @in6={0xa, 0x4e23, 0xfffffffffffffff8, @dev={0xfe, 0x80, [], 0x1c}, 0xfffffffffffffffc}, @in6={0xa, 0x4e24, 0x7, @mcast1, 0xc35}, @in={0x2, 0x4e20, @remote}, @in={0x2, 0x4e24, @broadcast}, @in6={0xa, 0x4e23, 0x3, @ipv4={[], [], @multicast2}, 0x3}, @in={0x2, 0x4e24}, @in6={0xa, 0x4e21, 0x8, @empty, 0x100000000}]}, &(0x7f0000000240)=0xc) sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) [ 305.996717] binder: 15177:15178 transaction failed 29201/-22, size 0-0 line 2855 [ 306.011541] binder: 15160:15187 transaction failed 29201/-22, size 72-32 line 2855 [ 306.046448] binder: undelivered TRANSACTION_ERROR: 29189 [ 306.051975] binder: undelivered TRANSACTION_ERROR: 29201 [ 306.062936] binder_alloc: binder_alloc_mmap_handler: 15177 20001000-20004000 already mapped failed -16 [ 306.073896] binder: BINDER_SET_CONTEXT_MGR already set [ 306.079391] binder_alloc: 15177: binder_alloc_buf, no vma 15:57:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/zero\x00', 0x400, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f0000000140)={0x2, 0x0, [{0xf, 0x20, 0x8, 0x3ff, 0xfff}, {0xc0000006, 0x3, 0x9, 0x10000, 0x5}]}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) openat$vhci(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhci\x00', 0x10000, 0x0) 15:57:04 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x54000000, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:04 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x4000000000000000, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 306.109181] binder: 15177:15178 ioctl 40046207 0 returned -16 [ 306.124952] binder: 15177:15189 transaction failed 29189/-3, size 24-8 line 2970 [ 306.136229] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:04 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)=ANY=[@ANYBLOB="e0000001ac1414aa0100000006000000"], 0x10) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x42000, 0x0) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f00000000c0)={0x0}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp6_SCTP_RTOINFO(r2, 0x84, 0x0, &(0x7f0000000180)={r3, 0x0, 0x80, 0xff}, &(0x7f00000001c0)=0x10) [ 306.155281] binder: BINDER_SET_CONTEXT_MGR already set [ 306.172391] binder: 15177:15205 ioctl 40046207 0 returned -16 [ 306.172402] binder: undelivered TRANSACTION_ERROR: 29189 [ 306.200887] binder: BINDER_SET_CONTEXT_MGR already set 15:57:04 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x700000000000000, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 306.222777] binder: 15207:15209 ioctl 40046207 0 returned -16 [ 306.229578] binder: undelivered TRANSACTION_ERROR: 29201 [ 306.257722] binder: 15207:15209 transaction failed 29189/-22, size 24-8 line 2855 15:57:04 executing program 5: r0 = socket$inet6(0xa, 0x3, 0x4000000ff) setsockopt$inet6_int(r0, 0x29, 0x16, &(0x7f0000fcb000), 0x4) r1 = socket$inet6(0xa, 0x80003, 0xff) setsockopt$inet6_int(r1, 0x29, 0x16, &(0x7f0000fcb000), 0x4) setsockopt$inet6_int(r1, 0x29, 0x16, &(0x7f00000000c0), 0x4) 15:57:04 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x3000000, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:04 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x9effffff}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:04 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x10000002, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x20000, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vcs\x00', 0x383182, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) [ 306.310869] binder: undelivered TRANSACTION_ERROR: 29189 [ 306.319676] binder: 15207:15209 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 306.382449] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:04 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x5c000000, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:04 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x1000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:04 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x6000000, 0x0, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 306.425943] binder_alloc: binder_alloc_mmap_handler: 15207 20001000-20004000 already mapped failed -16 [ 306.471286] binder: undelivered TRANSACTION_ERROR: 29189 [ 306.520587] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="e3e165b190"], 0x0, 0x0, &(0x7f0000000500)}) 15:57:04 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0x80047601, &(0x7f0000000040)) r1 = getpid() r2 = syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x9, 0x0) ioctl$sock_SIOCBRDELBR(r2, 0x89a1, &(0x7f0000000200)='sit0\x00') sched_setscheduler(r1, 0x5, &(0x7f0000000140)) ioctl$LOOP_CHANGE_FD(r0, 0x4c02, 0xffffffffffffffff) memfd_create(&(0x7f00000000c0)='/dev/loop#\x00', 0x0) ioctl$GIO_FONT(0xffffffffffffffff, 0x4b60, &(0x7f0000000180)=""/76) 15:57:04 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x20080, 0x0) ioctl$KDDISABIO(r2, 0x4b37) sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) 15:57:04 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x3, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:04 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x3000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:04 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0xffffffff00000000, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 306.687539] binder: release 15253:15254 transaction 737 out, still active [ 306.695296] binder: 15253:15254 unknown command -1318723101 [ 306.709511] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 306.714568] binder: unexpected work type, 4, not freed 15:57:04 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x48, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 306.764459] binder: 15253:15254 ioctl c0306201 20000080 returned -22 [ 306.776182] binder: undelivered TRANSACTION_COMPLETE 15:57:04 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x28000, 0x0) write$FUSE_POLL(r2, &(0x7f00000001c0)={0x18, 0xffffffffffffffda, 0x7, {0x4}}, 0x18) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x4800, 0x0) r4 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x3, 0x84000) unlink(&(0x7f0000000200)='./file0\x00') r5 = dup2(r0, r0) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000140)={r4, 0xa7, 0x0, r5}) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) 15:57:04 executing program 5: r0 = open(&(0x7f0000000100)='./file0\x00', 0x20e800, 0x81) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000140)={0x1, 0x0, {0x2b, 0x6, 0x3, 0xb, 0x0, 0x62f, 0x0, 0xff, 0xffffffffffffffff}}) ioctl$TUNSETNOCSUM(r0, 0x400454c8, 0x1) syz_emit_ethernet(0x1, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaa80086dd6050a09c00022100fe800000009635d400000000000000000000000000000000aa000000000008907800000000000000"], &(0x7f0000000040)={0x0, 0xfffffffffffffffc}) ioctl$SIOCGIFHWADDR(r0, 0x8927, &(0x7f0000000180)) syz_emit_ethernet(0x52, &(0x7f0000000080)={@remote, @remote, [], {@ipv4={0x800, {{0xf, 0x4, 0xfd9a, 0x5, 0x44, 0x68, 0x0, 0x8000, 0x84, 0x0, @remote, @remote, {[@ssrr={0x89, 0x17, 0x9584, [@multicast2, @multicast1, @remote, @multicast1, @local]}, @timestamp={0x44, 0x8, 0x6, 0x1, 0x3f, [{[], 0xb95}]}, @ra={0x94, 0x6, 0x8}]}}, @icmp=@info_reply={0x10, 0x0, 0x0, 0x2, 0x5}}}}}, 0x0) [ 306.817563] binder_alloc: binder_alloc_mmap_handler: 15253 20001000-20004000 already mapped failed -16 15:57:04 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0xb00000000000000, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:04 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x3f000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 306.908626] binder: BINDER_SET_CONTEXT_MGR already set [ 306.928408] binder: 15253:15254 ioctl 40046207 0 returned -16 [ 306.947448] binder_alloc: 15253: binder_alloc_buf, no vma 15:57:04 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x6, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 306.961630] binder: 15253:15267 unknown command -1318723101 [ 306.989385] binder: send failed reply for transaction 737, target dead [ 306.992818] binder: 15253:15267 ioctl c0306201 20000080 returned -22 [ 307.017006] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) pipe2$9p(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4800) write$P9_RREAD(r2, &(0x7f0000000180)={0x66, 0x75, 0x2, {0x5b, "dc92aae72fc6892e6e3139e8ff43c5efd750bfce80f0b77babc26c89e7e2de6d25039f6bcc1a45ba35ae8463cd4d306ee2d7a090c1973959927e1bca2f1131ef8a217c34c4e89ba939ccb8e2b27f8425cd66476674917cb63158e1"}}, 0x66) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) bpf$OBJ_GET_PROG(0x7, &(0x7f00000000c0)={&(0x7f0000000040)='./file0\x00', 0x0, 0x10}, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:57:05 executing program 5: fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f00000000c0)={0x0, 0x0}) r1 = syz_open_dev$vcsn(&(0x7f0000000100)='/dev/vcs#\x00', 0x4, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x4, 0x2, 0xffffffff, 0x7fff, 0x0, 0x6, 0x6000, 0xe, 0x8, 0x800, 0x80000001, 0x5, 0x94, 0x2, 0x1, 0x8, 0x7, 0x5, 0x200, 0x10001, 0x10000, 0x3, 0x7de5d329, 0x1649, 0xa0, 0x7f0a1a12, 0x9, 0x8001, 0x1, 0x119135f3, 0x3, 0x81, 0xffffffffffffffff, 0x6, 0x3, 0x3f, 0x0, 0xa4ca, 0x4, @perf_bp={&(0x7f0000000000), 0x2}, 0x8008, 0x0, 0x5, 0x3, 0x100000000, 0x20, 0x5}, r0, 0x1, r1, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(0xffffffffffffffff, 0x6611) clone(0x40210007fa, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') sendmsg$IPVS_CMD_SET_CONFIG(r1, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x31a10002}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)=ANY=[@ANYBLOB="98000000", @ANYRES16=r2, @ANYBLOB="00082bbd7000fddbdf250c0000004c000200080007004f0f00000800070004000000080005007871000008000b000a000000080005000000000008000900810000000800050000000000080005000800000008000800070000002400020008000900000000e207000b00020000000800070000000000080007001f0000000800040060720000080005002000000004000100"], 0x98}}, 0x20004800) 15:57:05 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x5400, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:05 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhci\x00', 0x200, 0x0) ioctl$EVIOCGABS20(r2, 0x80184560, &(0x7f0000000140)=""/241) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f00000000c0)=0x0) ptrace$setopts(0x4206, r3, 0x3, 0x1) 15:57:05 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0xfffffff0}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:05 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x200000000000000, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:05 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f000000d000)={0xa, 0x4e20}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0xb}, 0x1c) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000180), 0x4) ftruncate(r0, 0x1) syz_emit_ethernet(0x3e, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa0086dd6050a0bacfd39c00081100fe800000000000000000000020fe8000000000000000000087220000aa00004e200008907800000067f2f7d8256f77132b86db71d9261ae9641e07ae4989254cc7bb8525b099d97741bf99e9425988c968dc2d3fe0136fbfe0f5fdf272338fc19cc321204d32a8aa04805127aeeedee721bddedeb8c39e67246d158f7aaf369fe6d0f50b481c77fced04d1535898dbb46b9818f4f9a68a64c789adfcfd84f612dab54db15d4932bfe1af65fa0d908009efdac567b081dd49bc0a"], &(0x7f0000000040)) [ 307.389565] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 307.390395] binder: release 15297:15298 transaction 742 out, still active [ 307.408087] binder: unexpected work type, 4, not freed [ 307.413614] binder: undelivered TRANSACTION_COMPLETE 15:57:05 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x4000, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 307.432808] binder_alloc: binder_alloc_mmap_handler: 15297 20001000-20004000 already mapped failed -16 [ 307.454138] binder: BINDER_SET_CONTEXT_MGR already set [ 307.471883] binder: 15297:15298 ioctl 40046207 0 returned -16 15:57:05 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0xfeffffff, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:05 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0xf}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:05 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0xb, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 307.523313] binder_alloc: 15297: binder_alloc_buf, no vma [ 307.550590] binder: 15297:15304 IncRefs 0 refcount change on invalid ref 1 ret -22 15:57:05 executing program 5: select(0x40, &(0x7f0000000680), &(0x7f00000007c0), &(0x7f0000000800), &(0x7f0000000040)) init_module(&(0x7f0000000080)='ppp0nodev+\x00', 0xb, &(0x7f00000002c0)='&{,\x00') socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000180)) fdatasync(0xffffffffffffffff) keyctl$set_reqkey_keyring(0x10, 0x0) seccomp(0x0, 0x0, &(0x7f0000000100)) lstat(&(0x7f00000003c0)='./file0\x00', &(0x7f00000004c0)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000006c0)={{{@in6=@loopback, @in=@broadcast}}, {{@in6=@remote}, 0x0, @in=@multicast2}}, &(0x7f0000000400)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000840)={{{@in6=@dev, @in=@loopback}}, {{@in=@multicast1}, 0x0, @in=@remote}}, &(0x7f0000000540)=0xe8) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) getegid() getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000640), &(0x7f0000000940)=0xc) lstat(&(0x7f0000000980)='./file0\x00', &(0x7f00000009c0)) getegid() getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000a40), &(0x7f0000000a80)=0xc) getresgid(&(0x7f0000000ac0), &(0x7f0000000b00), &(0x7f0000000b40)) fstat(0xffffffffffffffff, &(0x7f0000000b80)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000c00), &(0x7f0000000c40)=0xc) fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_default\x00', &(0x7f0000000c80), 0x24, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='trusted.overlay.upper\x00', &(0x7f0000000580)={0x0, 0xfb, 0x15, 0x0, 0x0, "811f54820836ed26b1baa53f56ee07e2"}, 0x15, 0x0) futex(&(0x7f0000000280), 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x1c9c380}, &(0x7f0000000040), 0x0) clock_gettime(0x0, &(0x7f0000000080)) bind$inet6(0xffffffffffffffff, &(0x7f0000d84000), 0x1c) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000380), 0x4) setxattr$trusted_overlay_upper(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='trusted.overlay.upper\x00', &(0x7f00000015c0)={0x0, 0xfb, 0x15, 0x0, 0x0, "714b25b8ca55cbb96b40b04ddc47f682"}, 0x15, 0x0) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpgid(0xffffffffffffffff) syz_execute_func(&(0x7f0000000440)="42805da06d0fef69dc0f01eeaf6c41ff0f66410f3840e934030f38211a67430f4bc5c19086d9f28fc9410feefa6b20784175450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") eventfd2(0x0, 0x0) syz_execute_func(&(0x7f0000000340)="428055a0876969ef69dc00d9ce41ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175450f2e1ac4010d64ac1e5d31a3b706e2989f7f") [ 307.578207] binder: send failed reply for transaction 742, target dead [ 307.634453] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR64=&(0x7f0000000480)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="0000000000d807292fd45075000000372df0b349fb71361dfe22f1436476cb632cfe6aaab97825d4a22002535c853d5f0a8beb3a673803f388a1816630cb5ebfbd81d5576cb840d3601374d9f5029d6f6f4574d5e0cc8de3347c5beaa2b82aa2f976f93e672c38028e59df2a4efffbdd057a58800f5345c73619258a8a0293bc78a33b2adde9e7be196168a13f942795d41b8a4f7479dc9e4df6d8bf4148eb0e09423b89378ff4db3d6f1267d2426f07484a6e196aa2c80d733a6ee1c0e6c5c0e9360098fa45862a45ff3302961528d64831de1bb235931833ee3faae116cc1ec4a47a56819cab9ce5946860d2ea749c2f079ae4ea6e30d8e778331dd8faaf"], @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) r2 = dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) ioctl$sock_SIOCBRDELBR(r2, 0x89a1, &(0x7f0000000040)='erspan0\x00') 15:57:05 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x4000000, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:05 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0xf0ffffff00000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:05 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)=ANY=[@ANYBLOB="e0000001ac1414aa000000000600b500"], 0x10) r2 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x7, 0x402800) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f00000000c0)=0x1) 15:57:05 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x7000000, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 307.777589] binder: release 15333:15334 transaction 747 out, still active [ 307.789786] binder: 15333:15334 ioctl 89a1 20000040 returned -22 [ 307.803788] binder: unexpected work type, 4, not freed [ 307.824591] binder: undelivered TRANSACTION_COMPLETE [ 307.847057] binder_alloc: binder_alloc_mmap_handler: 15333 20001000-20004000 already mapped failed -16 [ 307.861375] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:05 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000040)=0x6) sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) 15:57:05 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x7, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 307.892981] binder: BINDER_SET_CONTEXT_MGR already set 15:57:05 executing program 5: perf_event_open(&(0x7f000001d000)={0x200000002, 0x70, 0x0, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)) open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000280)={{{@in6=@mcast1, @in=@rand_addr}}, {{@in6=@remote}, 0x0, @in6}}, &(0x7f0000000200)=0xe8) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f0000000380)) recvmmsg(0xffffffffffffffff, &(0x7f0000003ec0), 0x0, 0x0, &(0x7f00000040c0)) openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNGETFEATURES(0xffffffffffffffff, 0x800454cf, &(0x7f0000000080)) ioctl$sock_inet6_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000004100)) futex(&(0x7f00000000c0), 0x3, 0x0, &(0x7f0000000140)={0x77359400}, &(0x7f00000001c0), 0x0) ioctl$sock_inet_SIOCGARP(0xffffffffffffffff, 0x8954, &(0x7f0000000580)={{0x2, 0x0, @multicast1}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @dev}, 'nr0\x00'}) getgid() getgroups(0x0, &(0x7f00000003c0)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000480)="428055a03b6969ef69dc00d9fbfb69203737c3397c05bd060f38211a40a564a70f157a9e400f01efe5e5417545c462010d42002e660fe095000000003ef0f6585501ee31a3b786e29885c4227992dd289f9f") setrlimit(0x0, &(0x7f0000000080)) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f00000003c0)={'filter\x00'}, &(0x7f0000000400)=0x24) [ 307.929507] binder: 15333:15334 ioctl 40046207 0 returned -16 [ 307.930277] binder: 15333:15339 IncRefs 0 refcount change on invalid ref 1 ret -22 15:57:05 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x4800, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:05 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0xfffffffffffff000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 308.023559] binder: send failed reply for transaction 747, target dead 15:57:06 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x8, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 308.084484] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:06 executing program 4: r0 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x109400) r1 = openat$cgroup_ro(r0, &(0x7f00000001c0)="63ef5be2b374617400", 0x0, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r2, 0x0, 0x29, &(0x7f0000000380)=ANY=[@ANYBLOB="e0000001ac1414aa00000000b3030000b900911d416b0832018a7cbd32aafb63debb3f6392e03e386aaca27db93ae57700bcbef0671c203ae6783ac6c617fa320f31b2329712d5cc36039e41d7583919da6bd1818a5b547e4d38411ad8b13f27c2885f1bbfe75917725a4a0f00201e821dc6e360b13578e70052cc6fa015e3028a7bd2e778fc71d50556f4c681b9fc71f6b1987c963d440034e68ff9ce3a0308fd8f527b2f4f50137488bc68b5e71e5fd76efe8ad10f1f8af8c88c8619bed98f4923a3197a78d99995b04590316717d68faf5a170d1112afa50485f8f32c00b213db92dae5b310c97b7d7ddbe5d3ff6fdf8f107120cd523d4871597042d60000000000000000000000"], 0x144) ioctl$DRM_IOCTL_MODE_SETCRTC(r1, 0xc06864a2, &(0x7f0000000140)={&(0x7f0000000080)=[0x9, 0x5, 0x8, 0x68, 0x9, 0x4, 0x9], 0x7, 0x8, 0x98c, 0x20, 0x693641e7, 0x8, {0x9, 0x8, 0x6, 0x2, 0xdfc0, 0x4, 0x63, 0x67c, 0x4, 0x7, 0x5, 0x6, 0x20, 0x1bd70e8f, "8b4dec4ac9c514af458b734aa18d84232737a58567f9dcc4b7db77fb9ae5f7e7"}}) 15:57:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000003b0236"], @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) r2 = dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="102304033f0075a171ce4001038800"], 0x0, 0x0, &(0x7f0000000500)}) mq_unlink(&(0x7f00000000c0)='/dev/binder#\x00') clock_adjtime(0x7, &(0x7f0000000140)={0x2, 0xfffffffffffffffc, 0x3, 0x9, 0xffffffffffff84a4, 0x8, 0x7, 0x0, 0x5, 0x1, 0x101, 0x8000, 0x5, 0x9, 0x1, 0x100, 0xd0a0, 0x7, 0x7, 0xffffffff, 0x7ff, 0x1, 0x0, 0x100000000, 0x808000, 0x1}) 15:57:06 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x800000000000000, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:06 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x700000000000000, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:06 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x60000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 308.272159] binder: 15378:15379 ioctl 541b 20000000 returned -22 [ 308.278509] binder: release 15378:15379 transaction 752 out, still active [ 308.290906] binder: unexpected work type, 4, not freed [ 308.301915] binder: 15378:15379 unknown command 50602768 [ 308.314996] binder: undelivered TRANSACTION_COMPLETE 15:57:06 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x1000000, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 308.325935] binder: 15378:15379 ioctl c0306201 20000080 returned -22 [ 308.352861] binder_alloc: binder_alloc_mmap_handler: 15378 20001000-20004000 already mapped failed -16 [ 308.363348] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:06 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0xb000000, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 308.372114] binder: BINDER_SET_CONTEXT_MGR already set [ 308.395375] binder: 15378:15379 ioctl 40046207 0 returned -16 15:57:06 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$md(0xffffffffffffff9c, &(0x7f0000000040)='/dev/md0\x00', 0x0, 0x0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x3e8000000000, 0xdd50, 0x0, 0xf, 0xf, 0x4, "892cf11b401b8cddbeea3e1cd2a0bac523a6ee409816bfc0d87f6adcefe6b54ab111df5701026bd5643f1f0028b690605cfc3b94a89d4b6f72cf4eedd5d9f7d6", "bed7b8a8cc5f952ada706d604a592950c70c3189b89a99aeeeb9c70fd0e1ae83b43b620bae3e2668a37ec9254316970b89d8726efdeef2023f3e49453e8a9547", "042f1d97f16dbac802ed5a9b144078776d35a1f3af39f59b0da5ba1ceea600d8", [0xffffffff80000001, 0x8]}) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) r3 = dup(0xffffffffffffff9c) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffffff, 0xc0086426, &(0x7f0000000240)={0x3, &(0x7f00000000c0)=[{}, {}, {0x0}]}) ioctl$DRM_IOCTL_DMA(r3, 0xc0286429, &(0x7f0000000380)={r4, 0xa, &(0x7f0000000280)=[0x3, 0x9, 0x9, 0x3ff, 0xfffffffffffffffc, 0x533c, 0x2, 0x2e22, 0x8c4, 0x6], &(0x7f00000002c0)=[0x4, 0x100000001, 0x5, 0x2, 0x3, 0x6, 0x0, 0x2], 0x1, 0x6, 0x8000, &(0x7f0000000300)=[0xffffffff, 0x800, 0x2, 0x1, 0x50, 0x0], &(0x7f0000000340)=[0x2, 0x6, 0x8a1, 0x8, 0x9]}) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r3, 0x114, 0xa, &(0x7f00000004c0)={0x2, "8629"}, 0x3) syz_kvm_setup_cpu$x86(r3, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text64={0x40, &(0x7f00000003c0)="f0470fba6880040f09440ffeb434a0d70000c4c33141cac38f4810ec898e0000000066ba4200b00bee66b837008ec841d9e1b9800000c00f3235008000000f3066b80e000f00d8", 0x47}], 0x1, 0x5, &(0x7f0000000480)=[@flags={0x3, 0x2}], 0x1) [ 308.422760] binder_alloc_new_buf_locked: 1 callbacks suppressed [ 308.422769] binder_alloc: 15378: binder_alloc_buf, no vma [ 308.445179] binder: 15378:15393 ioctl 541b 20000000 returned -22 [ 308.482821] binder: 15378:15379 unknown command 50602768 [ 308.498711] binder: send failed reply for transaction 752, target dead [ 308.506240] binder: 15378:15379 ioctl c0306201 20000080 returned -22 15:57:06 executing program 5: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='illinois\x00', 0xd470041877f0fcc9) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20004000, &(0x7f0000e68000)={0x2, 0x0, @local, [0x0, 0x0, 0x1802000000000000]}, 0x10) 15:57:06 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0xf0ffff}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:06 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x6000000, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:06 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x3f000000, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000200000000000000000000000000000000000000000000000090000000000018c75c0a207f00000000000000080000", @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) write$tun(r1, &(0x7f0000000700)={@val={0x0, 0x800}, @void, @eth={@random="cb8b25482f39", @random="7413f7c9d981", [], {@ipx={0x8137, {0xffff, 0x101e, 0x206, 0x14, {@current, @random="513f217d1cfe", 0x6}, {@broadcast, @broadcast, 0x3}, "e9fb859f8d6da475212e93a98620394deb6c7667d1209e566f399d9d005ecc92f9949b5a0a474247cc80de05b72943ca5df8c6dc42db536249f12d27231add73b1a07af68ac57649950c1a58785f68af3544c23271ea884552ba7566da988971f3145be100575beaee9823edd0dca358cc0947d2b9475d66d860e84bbab4fa3774f3e42346accfae254a676ba6386cc5967c2d35fd4864f7f347b4029cd03229154829d15e43a652cdbae2a48a12499cd882812f217c0c9658e30e3fb3970c3660fbe072ccb482c150fb333f69e95190132a9c976c6e7f90dbcb187a20a4729d7b4d116ead411f7a948e704a7f6e832738de6b964bc6e92b59c7db758550dfa643231f3d10b755bca0c5ecb2a7a770bc8c37930970eba152fceb2db88668dae144323902fbf5130d679a5498083c60036e9c9cfab1d4d6c2e2a21600708831325e2c896fca801f35ceffed7a047b119594da61836e007cfb23c66d66efa54781c917d884c73c6e877bb8b6dfabcc0fb8dc83c0e265c64e855c3b0f7ad188c4c228a6aeb2b7d61b79b434f61ef5b00ab00fb25208a018479d62528bc345fc8f873acaf23ab8c8429d5c06dc8555f49fbcfbf4b6c5b4a5f61599d1a4012d8176b0a3161433b86bca1e0a2ac125ecf43340da3b567d39399e43f12dad906ebf6d66ea05b9ddb219f3addb3b9fdb38104bda0766e6952bc90e4162f4923cbe1c13031252d7115ab040b18864e75a4ecc7130a49f23b6fa2d8efa6e4382391fa3523b87392f6559f92b888008dcf943acb0091ab83038e86f080bd6401b8a6760a000fdee084de9cf54ebff5780d451b0aaae4f5c3a3550e5ae166037271fe4dff6fa901a79eef013769d29b76ff38628f332ee3f7fa9a56693dec01956b73d785e094c77decb29a70d1a063b41c7a3155321bbee82f08d0b39656ae15b1938d223bb5089a9dcce1762dca97caa0423aeabc4cbfcfd6425400e9557d16db71ddf6693d156d5b61d1090e4adbcbf75ddd0d943baebe8ce7b15d2a27ff2767bd9e62ba733bf5e9c2909e7c48e599953c9db8503e2173ab6261711e6f4903d3cab6a396123313744d9d21cdbfc45981d4f08b8eb869481f98d6747989497a39bf25a03d12b8512f06a7defdff5a182eb227033656524d09bd4d98906549882fc9db54a2b562c26de7a07ea9d9a468b9bf8ea88d8de69845414d3faaeb3dbcc05243156eed26f994aeda5a14fdb4de9cfc7549c83322324eada92667289576ff65c600a376527427a9eb973fa7814b15ef39e7bcda6e972909f006af0bc1c3bb250d447b14e455e4d71ac400864585c5f954a67b896b20d18dd4b1285a316e39aa96a3074dca381c5a094c88a4d0eb118832d97421691393a7d6b95ec20bd3690fda29301e9689da0a5968f86d776116b2ce4973a5986c7ffb571a64a16191cde505862bfced552f27f69b46eedd11592304b273555d9f6eceacfe7b5ada046c69ec5b95c019bc83a64578651c255bc908f259bdd0d81024c2909c1e10ca232f1ab8fd61e6b1f0183b5c7866442f374bb0ce98f51923cc251a788494d912c834ab70cee9b2bb67adf04548483129b351ad29661fb8ef62594777b9f0f925e8608721a8f23bc62897ee3051be67b6550b2a30c6a24f0965f2aeaa7c4493b949e18bf939e79bcae375c5ff4ec6a483df18c62fa83970d887aae321fc3a13f8c78403f8b45f8d310a1fe2b53e93c3c120a69c39c9c1eb45b4d262b337289a3a3c6ee91e236e4baf55d63e28b859c276285daa550c44ef06c592babdefcfa683290493d4fa0e7c403639616174e50c7c01e408dfb1d2ebccb3977338dff0c3f5b88327197def88c2a9013fc7ab495726c15249777097347ea6a435037fa054338d19677bbcdcf9c6b1e2c5511cd4f3aa5f6fbcd3093b936a5d5289ac6ae7bf47f301f26464ab282c9819b23c4644592294ad25270f8742facaf07464cec181ab6372875d6688c80a1e68f12675b95b11549a879a67ff5478cfe5d576c0c6f7ffe62ee68ed38c0511674da32d4445e90c6309703476c7de240024b2f5aa29f45144316beb9e85506a7d26853d46f9eef295b3f94db0e781bf7fa7b9192c67293ac0966cacdd40246f6d5ece09f2deb9d5502b98d0dafddcd2d85fc634d7c42b96315d5aeed0112934eb9cad8ece66052c4922594a5083699d21b40e1289df167aa5bc7aabd70f9d23d90da0bfc174d1bf1740c5f08d9f58ac5650d7e9267d553a9fd12c62a79f2dce58a0fdae0bdd17b55a3fe7a0ef62756646bd39dfc5be369578446532ff0618f889854924e359c4c0a12606b4d7b9f8c79b56c6b0b7912e5d9f0e8980bcdf910f8e7145fcc9daf6ed647c64d11b3750e82ed1099d3486837e306f53850c5ea14490fb325ddd14e63f3b96ed7f83fcafd13681c627b21d58b1310e7a4f1e297345d2007a0b3ddb53b7b2f15ac1fb4764c2b3c4ae4f3e301fc7532ce5a24ffcbdaa575dd81ac7942d8e45fac7334f2c498a620bf93a4e969803c6ec24c2c866c8b0489e5f04fb7c47faaf077cf32840f9b0efcecea9b8d25edca04d1b1d99ddb463bd04794ca65da0471141e6447db24541f64bc0e7d85bbf1e1e005ee96ec94ebe7294898042e8f37d883a3638b79695f351135edd6da25040c9ee14e1bf5bb2ab9fa81ebec4c23a487971141705eac2cc900cce2915b75f7d53c84f7494507ca1c8cb2e720a0eb7ffafe8760a17e15e47a3b384b59d2e1e7406cbe821be150e02caf42216623820d2edfd425cb0afb90ea71a97ad459c6ce9313dfb521abc1947faf8ce0c7c1b4ffd5e663589c661244e46466548dccf76c72a3a5eb14ac341832bb4eb23f889517461eab75d9194657d803cc4a8d1bf9403bd2c79aabf543db0c805394d803792fb0d47109b9aa69ac8e50b83f93effcd8c2c0ae31b8888bb66e7750c0593a7d4e480a99adc051b9d240b661d95b3df8860ed8deec3949211a290c445b3c692310f39a6d129e73bac270e38d951546e8f24cad3290649e0db71900e922d4372ce99731338756518f8d45fadcaa88deb3cd004f42ceb26a30eabda30bc8f9de76666be29c8cd13fcfcd2f290b444ef5f3947c0dc5b2d9945bfa6f891618082b4e368b3ee7cc794237b44c004d3f7d4a8dda92743303152c9984283e04f8af70a6d0e0f47f2c30c1373a4aeb1a9759d9a68df0be7e6e2695760b2cf9c433f13c3bceb339f1b69f89bab705435422fba7c0791e3b56fc3ac42d90678b29aa1bdc7fedfaa9a9c0d976f3574428e2ceb5ae8f8d40987862ec50dfc7cd96f06c1c482b7708d86dcee52fd4b6f3b95b43a45b36f3801764bdac8b2b5e481e370e539e16dde5bb4b13defee2c73be99fe944a5e95f7fb6e799990affbe4b55d4dd4cd9c692e2c47c641573391cb305eb84b0fa24f7ee69e30c243298cb5d8c8fa70f62e325e11eb489aad6be504e79b1894db4cf584670d13379662ab6f778c20f73dd2dcb181f70502c42f3900ba577edf22e2f5ad56c8c02c2346cf0afcdeb398ca1ef1471a3b6a362c1596284f420955424677b0d64ecc872388b54c7fcd23a384558a18c781e20ed3b7af14764441d05d3247b3b71bc0c98f06ae7664865bb457db5ef58f2612106365517021106fd03e2ab1201d95ecb6b9b0b7206d009aa906aad6573a3f014c9ff95c32c33eb7d3914b49d1aadc4827a1a470672426b9bcc39737d112c8c3ed6f3e304621468c52a4cdf51afad55f70922daee478e7d78edbed49934f0bfa14402b78e0f049567cd49b2885391f534eca12aa89303c645be2d496d028716a35ede05d881bf65ebe408e9f1fdc00aedd3cbf1e85c93d5edf270c5c3f3b3826fa634289b9a840dd7565bd07a784bb0d5ee3af90d91f5c74c241f17c78b08f3e35352c2b1ea8c7874173f6eef64b372680d92ac16068fbd1a74cb8ad35eaaf1bd084105bb7ed24121302bdad5ae512af7b44836e97b5d7c4d49530aafba223e354ecfa4b6e7b387e206d25847638bf6764ea0ba7d56060ab66ea9b38c0780068f8da3d5555e2168638336f89e23f21216aa3f0ac1bcf067dcba74e268d60b64630b35d14c49c66466428db391b86828c70304834a8f8bbe84a2a939d9fb596d2e6efc791e172a5d33267c4b1531ac53acf123ca8425ff71b2b0f8c1ba60c15fdb64c0571e61ef476aa0f520c9856644c32f8a3c4df7b9cdb889fbe5cfac49d3e9ecb5932dd2fc7d1993dbd04479da4d1c7aa6f374f16f625ab11ceeb33ff5b0c6492856ad127c797746491706306f151815eb1d203d7a3387d6fa65500e183d1c3fcce3fa90b8190acf4323d1432fdd6b2433f8fc3340e2b5ff5df7f3f41fa1573aa8d9428ff24a6f7b79aee01c4624016ababf5484d2ed1383f5e7c9eb1a2f5838a7023f72779b5edad625c1f0f34978c718f79c52315ba0a8dbd884164112ff5224315126010e6db0deef1ed99317fc53761c3895ae82aae4f87c0c83198a2efe581b865b9689c1674dbc3ab25a25d9ca796f80ef20d4ed9ed4e2bfb822c01cac87e6f6b8107daac66495dc682543daf5abc7ca60cd8a13a4147231f611a51bb6128e9f615f7ef805684d947c0141dc0bc6a4dbbc50746ad868750435397b911f3235027986d62fa463a44244342a9c6774d1eab1d8c138a48fb7198d461274f61ac49fdfa365188fc0ec6210180611e830b43f8e65a60b7b95071785c69f83a04dce938141183811cfd7703ea5f4909133b56b37563e6f8f93403ae8102978532c6baae0fc460553f2e54b7d5e833debe4bd09cf30910f2a65a9836be2b151bacdd4756f94528bcc83b087d54139c748880eacafa24e57c1ba8da94018c866ccf82d04ec1c91887c3c40df987a90d8ceb9d6728c664cf76b1adac3bab9e9b27c9fcfcda157835824967205b2ca396b5cb648a3e61fed371ea9cc6ce7cc894f0fc6f81190c534cca057a52b9a1ed9a81f3a5d1e2a20e421a13e4148eeea30b0d885e4bb0619839ae7247da7b188e66db5e9b65a01ea388727651d0503a3108e5dbf9233d9f843622dc5593c7fd20a41fe3367bb58ad5cee13758f98ace302f2c67c5e863b0b7f39e74cd981f1d2e2192a93c1bf02e39bc95400831665ee6c3db9e7e1c8e7b1ce85b9a69970a9fe283f64714ca92413841d00b842f364ba7ac209cedf4ec1e83b61534d37ecb3484ed584b2ca07b6514a52e9c376a5a67698737022ca9e9efa12cad06f9aaaf0641933208b4db2d7d930157d64062bfac7d2c97fd1f849e928c427cd90dbcbb60331b1cb733c22fffdf72c33fd1b8847c4ca8b908d086fa4f48d9d150ec7a6ffffc9ddc62cff8dc0127018c51d632945244dd8003bc0b8b4b3e24b6f5d79f4a213c3fb2a4806d3dcda07226fc9e336ca71a492f59bdf6f6b7e94ffecbd41852b467d053a2589f300630ce776a0f74f4e25edc1548dd2c91bd7a5615760090c9aeec00eb96b571ad7af7658a15d500eba6d64014b5f953a46d913402cf942c74b908bd3b18ad193a1a9e9731470bf27b7bc721f5928102c4c892b13deec1b530c6bcb63f3be0e6eb467f3b6f65b65bcb352ccee2353464b48cf895b22c033b44b9a0729a7258d02f5dd69a15e10a983ba1add6d5f8b362dae1ddf830862b083897d05beae3ddac7797b37ef8d761346ad6755ec7e9fe9acb75288c3afe484f0c9808c13149f39b711f34c4e58a3b808bfc86695d5f331eba9529bed5505fdfba3d6fc1c91d6ad4d1f01aa4d65492133ae8cc6409af916a72a60322cb8e1cf950003dd00493e3f"}}}}}, 0x1030) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:57:06 executing program 4: socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000000)=0x5) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x40) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000080)={0x0, 0x8d336ceab35077c1, 0xfa00, {0x200000000000000, &(0x7f00000002c0)={0xffffffffffffffff}, 0x2, 0x2}}, 0x20) getxattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)=@random={'system.', 'vmnet0\x00'}, &(0x7f0000000300)=""/19, 0x13) ioctl$KDSETMODE(r1, 0x4b3a, 0x7fffffff) write$RDMA_USER_CM_CMD_CONNECT(r1, &(0x7f0000000180)={0x6, 0x118, 0xfa00, {{0x8, 0xffffffff, "d2708f4ca505f0cf4d3233bd5dec57c0092dcfe56664506a81c957558374049d6521fb656610d48f088295fb2291e670514a440365ca5baa7d177a91eacefcb0724f203a880c3505925dc482c32d5223c70a393e1d46ebb1a1831eb90fc7a4f46fec480a8fedad783eb255e4aad4038e60f804b26b85b8cd2618960cfe4eeb3c3a9d4a030ad00402a5118645885a8bf6f19df4391b2f0247313c7f5772245c1d4a337c55382c13ec8aad3f99378499f1e8ee896ae7496c609f2df23892bdb01077fcbcb8894bbca0a3c2e0dcc473e904b4991db252f7172f7d1537f52c7d176602c06912eb5a4590e3844d5265830691716d08c0013694b9489c04124fb58e5b", 0xd0, 0x2, 0x3, 0x7, 0x10001, 0x5, 0x100000001}, r2}}, 0x120) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f00000003c0)=ANY=[], 0x0) 15:57:07 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x10000, 0x0) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1}) [ 309.090568] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 309.123903] binder: 15414:15418 got transaction to invalid handle 15:57:07 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x2000000, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 309.153716] binder: 15414:15418 IncRefs 0 refcount change on invalid ref 1 ret -22 15:57:07 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x5c00, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:07 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 309.197109] binder_alloc: binder_alloc_mmap_handler: 15414 20001000-20004000 already mapped failed -16 [ 309.256010] binder: BINDER_SET_CONTEXT_MGR already set [ 309.261353] binder: 15414:15418 ioctl 40046207 0 returned -16 [ 309.293309] binder: 15414:15432 got transaction to invalid handle 15:57:07 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x700, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 309.301089] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 309.323720] binder: 15414:15426 IncRefs 0 refcount change on invalid ref 1 ret -22 15:57:07 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x6000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 309.444942] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:07 executing program 5: keyctl$set_reqkey_keyring(0x7, 0xb) pipe(&(0x7f00000001c0)) ioctl$RTC_VL_READ(0xffffffffffffffff, 0x80047013, &(0x7f0000000200)) clock_getres(0x0, &(0x7f00000000c0)) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) socket$key(0xf, 0x3, 0x2) seccomp(0x1, 0x0, &(0x7f0000000140)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000340)="42805da0690fef69dc0f01eece41ff0f1837370f38211ac4c19086d9f28fc9410feefa6b2179a6e5e54175450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") gettid() lstat(&(0x7f00000005c0)='./file0\x00', &(0x7f0000000600)) getegid() getpid() getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000680)={{{@in6=@local, @in=@loopback}}, {{@in=@multicast2}, 0x0, @in6=@loopback}}, &(0x7f00000046c0)=0xfffffffffffffe37) getresgid(&(0x7f00000007c0), &(0x7f0000000800), &(0x7f0000000840)) gettid() getuid() fstat(0xffffffffffffffff, &(0x7f0000000880)) getpgid(0x0) fstat(0xffffffffffffffff, &(0x7f0000000c00)) getresgid(&(0x7f0000000c80), &(0x7f0000000cc0), &(0x7f0000000d00)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000d40)) fstat(0xffffffffffffffff, &(0x7f0000000d80)) getgroups(0x0, &(0x7f0000000e00)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000e40)) lstat(&(0x7f0000000e80)='./file0\x00', &(0x7f0000000ec0)) getresgid(&(0x7f0000000f40), &(0x7f0000000f80), &(0x7f0000000fc0)) getpgid(0xffffffffffffffff) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000003480)={{{@in6=@loopback, @in=@remote}}, {{@in6}, 0x0, @in6=@remote}}, &(0x7f0000003580)=0xe8) getgid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000035c0)) geteuid() getgid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000003600)) getuid() getgroups(0x0, &(0x7f0000003640)) gettid() geteuid() stat(&(0x7f0000003bc0)='./file0\x00', &(0x7f0000003c00)) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000003c80)) fstat(0xffffffffffffffff, &(0x7f0000003cc0)) syz_execute_func(&(0x7f0000000180)="428055a06b6969ef69dc00d99069203737c3397c2a060f38211a40a564a741dfe0400f01efe5e54175457d0f2e1a1a01460f01ee31a3b786e2989f3f") 15:57:07 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = gettid() tkill(r1, 0x2b) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)=ANY=[@ANYBLOB="00000600000000000000000000000000"], 0x10) 15:57:07 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x2, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x4, 0x800) ioctl$TIOCSCTTY(r1, 0x540e, 0xf4b) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r2, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:57:07 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x600, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:07 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x9effffff00000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:07 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x48a200, 0x0) setsockopt$bt_BT_VOICE(r2, 0x112, 0xb, &(0x7f00000000c0)=0x8, 0x2) sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) 15:57:08 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x8000000, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 310.084136] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 310.092680] binder: release 15456:15457 transaction 760 out, still active [ 310.092702] binder: unexpected work type, 4, not freed [ 310.092713] binder: undelivered TRANSACTION_COMPLETE [ 310.093052] binder: invalid inc weak node for 761 15:57:08 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x100000000000000, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:08 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x400000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 310.194831] binder: 15456:15457 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 310.224903] binder_alloc: binder_alloc_mmap_handler: 15456 20001000-20004000 already mapped failed -16 15:57:08 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)=ANY=[@ANYBLOB="020000003ef800000000000006000000"], 0x10) [ 310.255809] binder: BINDER_SET_CONTEXT_MGR already set [ 310.261140] binder: 15456:15457 ioctl 40046207 0 returned -16 [ 310.312882] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 310.342845] binder_alloc: 15456: binder_alloc_buf, no vma [ 310.343546] binder: send failed reply for transaction 760, target dead [ 310.348461] binder_transaction: 7 callbacks suppressed 15:57:08 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x300, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 310.348480] binder: 15456:15475 transaction failed 29189/-3, size 24-8 line 2970 15:57:08 executing program 5: select(0x40, &(0x7f0000000680), &(0x7f00000007c0), &(0x7f0000000800), &(0x7f0000000040)) init_module(&(0x7f0000000080)='ppp0nodev+\x00', 0xb, &(0x7f00000002c0)='&{,\x00') socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000180)) fdatasync(0xffffffffffffffff) keyctl$set_reqkey_keyring(0x10, 0x0) seccomp(0x0, 0x0, &(0x7f0000000100)) lstat(&(0x7f00000003c0)='./file0\x00', &(0x7f00000004c0)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000006c0)={{{@in6=@loopback, @in=@broadcast}}, {{@in6=@remote}, 0x0, @in=@multicast2}}, &(0x7f0000000400)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000840)={{{@in6=@dev, @in=@loopback}}, {{@in=@multicast1}, 0x0, @in=@remote}}, &(0x7f0000000540)=0xe8) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) getegid() getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000640), &(0x7f0000000940)=0xc) lstat(&(0x7f0000000980)='./file0\x00', &(0x7f00000009c0)) getegid() getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000a40), &(0x7f0000000a80)=0xc) getresgid(&(0x7f0000000ac0), &(0x7f0000000b00), &(0x7f0000000b40)) fstat(0xffffffffffffffff, &(0x7f0000000b80)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000c00), &(0x7f0000000c40)=0xc) fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_default\x00', &(0x7f0000000c80), 0x24, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='trusted.overlay.upper\x00', &(0x7f0000000580)={0x0, 0xfb, 0x15, 0x0, 0x0, "811f54820836ed26b1baa53f56ee07e2"}, 0x15, 0x0) futex(&(0x7f0000000280), 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x1c9c380}, &(0x7f0000000040), 0x0) clock_gettime(0x0, &(0x7f0000000080)) bind$inet6(0xffffffffffffffff, &(0x7f0000d84000), 0x1c) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000380), 0x4) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000440)="42805da06d0fef69dc0f01eeaf6c41ff0f66410f3840e934030f38211a67430f4bc5c19086d9f28fc9410feefa6b20784175450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") eventfd2(0x0, 0x0) syz_execute_func(&(0x7f0000000340)="428055a0876969ef69dc00d9ce41ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175450f2e1ac4010d64ac1e5d31a3b706e2989f7f") 15:57:08 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200)='/dev/rtc0\x00', 0x0, 0x0) ioctl$KVM_SET_PIT2(r2, 0x4070aea0, &(0x7f0000000240)={[{0x1, 0x9, 0xf9, 0x9, 0x7, 0x52bb, 0x100000001, 0x3, 0x2, 0x972d, 0x7fff, 0x0, 0x2}, {0x0, 0x5, 0x7, 0x8, 0x1f, 0x25f3, 0x3a, 0x1000, 0x66, 0xfffffffffffffc00, 0x8, 0x3, 0x4d3}, {0x1, 0x200, 0xfa8, 0x8, 0x0, 0x0, 0x4, 0x4, 0x7f, 0xe8db, 0x44000000000000, 0xd9, 0x6}], 0x7}) r3 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x3f, 0x4) ioctl$FS_IOC_GETVERSION(r0, 0x80047601, &(0x7f0000000080)) ioctl$sock_bt_bnep_BNEPCONNDEL(r3, 0x400442c9, &(0x7f00000000c0)={0xffffffffffffff2a, @local}) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000140)=ANY=[@ANYBLOB="f6264b27d213a2a2c647964cb1e9e1700520e08e3f49d378e10e3ef9eaffc08460103155d4ea18a6f8f727733057ea26a039d9d4f6759893d274bd2bad85605fa7715d9f24b5211f70197176a62d5fbf3114163a2ce3c1b7804425433d304ea1dabcec29cbbe4c5841a425bedf45e94976be9c1e60b31f07310c0d4b2ef88e5a5b959d7cd7454e19576b97416bb1b44c763fd5b705573fd10a4dedeb94106e44498cc8d6e5c70f22bbc97e5c1d74bd3ba0c26fc0eedb"], 0x10) socket$inet6(0xa, 0x80000, 0x5) 15:57:08 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x48000000, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x1) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:57:08 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x805}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 310.461902] binder_release_work: 6 callbacks suppressed [ 310.461910] binder: undelivered TRANSACTION_ERROR: 29189 [ 310.532217] binder_alloc: 15497: binder_alloc_buf, no vma [ 310.552360] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 310.563880] binder: 15497:15502 transaction failed 29189/-3, size 24-8 line 2970 15:57:08 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x600000000000000, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:08 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x4, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 310.596826] binder: undelivered TRANSACTION_ERROR: 29189 [ 310.614184] binder: 15497:15502 IncRefs 0 refcount change on invalid ref 1 ret -22 15:57:08 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x3}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 310.670570] binder: BINDER_SET_CONTEXT_MGR already set 15:57:08 executing program 5: clone(0x40030000, 0x0, 0xfffffffffffffffe, &(0x7f00000002c0), 0xffffffffffffffff) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) socketpair$inet6_udplite(0xa, 0x2, 0x88, &(0x7f0000000080)) accept4$packet(0xffffffffffffff9c, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000001c0)=0x14, 0x0) getresuid(&(0x7f0000000340), &(0x7f0000000300), &(0x7f0000000400)) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000440)={{{@in6=@remote, @in6=@mcast2}}, {{@in6=@mcast1}, 0x0, @in6=@remote}}, 0xe8) syz_execute_func(&(0x7f0000001580)="42805da0aed1d1ef69dc0f01ee660f3a608600088041cb64f30f2b073591913d062900770f78993d233d23410feefa633917660f38302fbae5e5e575450f2e1af0442975e1c44379dfb9d6adbe90dfe2989f567f") syz_emit_ethernet(0x2c, &(0x7f0000000280)={@local, @local, [], {@ipx={0x8137, {0xffff, 0x1e, 0x0, 0x0, {@broadcast, @current}, {@broadcast, @random="cbe749897d69"}}}}}, &(0x7f0000000040)) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000180)) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f00000001c0)) syz_open_procfs$namespace(0x0, 0xffffffffffffffff) seccomp(0x0, 0x0, &(0x7f0000000100)) openat$autofs(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/autofs\x00', 0x0, 0x0) setsockopt$IP_VS_SO_SET_FLUSH(0xffffffffffffffff, 0x0, 0x485, 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000040)) openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0) write$P9_RFLUSH(0xffffffffffffffff, &(0x7f00000000c0)={0x7}, 0x7) ioctl$RTC_WIE_OFF(0xffffffffffffffff, 0x7010) seccomp(0x1, 0x0, &(0x7f0000000140)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x58fe4}]}) openat$ppp(0xffffffffffffff9c, &(0x7f0000000380)='/dev/ppp\x00', 0x0, 0x0) syz_execute_func(&(0x7f0000000500)="1cd2805da0616969692295d3200f01eece41ff0f1837370f38211ac4c19086d9f28fc9c81ceefa6be27973e5e54175450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90df55b498985fc3") ioctl$TUNGETVNETHDRSZ(0xffffffffffffffff, 0x800454d7, &(0x7f0000000200)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000300)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) ioctl$TIOCLINUX5(0xffffffffffffffff, 0x541c, &(0x7f0000000240)) syz_execute_func(&(0x7f0000000300)="af8055a0596969ef69dc00d99066410f60bad33f00007c2aaf200f3821c2437373a7c4a2f930b80e70714b400f01ef71c58ef59cc48ef5f5ec1a1a01460f01ee31a3b786e6989f") 15:57:08 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x8000000, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 310.713498] binder: 15497:15512 ioctl 40046207 0 returned -16 [ 310.723491] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 310.734274] binder_alloc: 15497: binder_alloc_buf, no vma [ 310.744581] binder: 15497:15519 transaction failed 29189/-3, size 24-8 line 2970 [ 310.752331] binder: undelivered TRANSACTION_ERROR: 29189 15:57:08 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x800000000000000, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 310.782787] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:08 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000040)) r2 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x1, 0x0) write$input_event(r0, &(0x7f0000000080)={{}, 0x2, 0xf5, 0x1f}, 0x10) ioctl$DRM_IOCTL_VERSION(r2, 0xc0246400, &(0x7f0000000300)={0x365c21e4, 0x7, 0x5, 0xa, &(0x7f0000000140)=""/10, 0x8e, &(0x7f0000000180)=""/142, 0xbc, &(0x7f0000000240)=""/188}) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000340)=ANY=[@ANYBLOB="e0000001ac140100000000000600007c4dffe90ac11aeabbaf18942200d99ab03d7c72a62e7c57c72f2359736562fb228b27178ef5c19b3736c3802bdb4701be76aade598462671c72d32fa038de2d32347361da2c3c6d8f691e42ef41464c90a83b939c2329d7b6f58475ec5ddbf0dd0f69e6c7fd004fc6a80aa78bb9b8c91a87a4c25a8ca908bfad46642b2a4e8c6bb8d6dc4bb7a3acf9732bae4ee54b4400ef7578c3b25c1e7c1fc531fbbc312d7ad822c03b50aff79ca0c9f0a346368b89374f4a68a4593a312f7c529d187810dcd3b7f43f08e744"], 0x10) 15:57:08 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0xfffffffffffff000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0xa, 0x9) getsockopt$inet_sctp_SCTP_DELAYED_SACK(0xffffffffffffff9c, 0x84, 0x10, &(0x7f0000000040)=@assoc_value={0x0, 0x7fff}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp6_SCTP_MAXSEG(r2, 0x84, 0xd, &(0x7f0000000140)=@assoc_id=r3, &(0x7f0000000180)=0x4) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r4 = dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f00000001c0)={0x5, 0x400, 0x800b, 0x5, 0x4, 0x8, 0x42c, 0x1, r3}, &(0x7f0000000280)=0x20) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:57:08 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0xfeffffff, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:08 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x300000000000000, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 311.033497] binder: release 15544:15553 transaction 768 out, still active [ 311.045590] binder: unexpected work type, 4, not freed 15:57:08 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x4000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:08 executing program 4: r0 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000100)='cgroup.subtree_control\x00', 0x2, 0x0) signalfd4(r0, &(0x7f00000001c0)={0x7fffffff}, 0x8, 0x80000) r1 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000180), 0xffffffffffffffff) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000000)) pipe2(&(0x7f0000000200)={0xffffffffffffffff}, 0x80000) getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000240)={0x0, 0x76b8, 0x101, 0x5, 0x7, 0x4c83dddd}, &(0x7f0000000380)=0x14) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f00000003c0)={r4, @in6={{0xa, 0x4e23, 0xff, @remote, 0x178f}}}, &(0x7f0000000480)=0x84) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f0000000540)=ANY=[@ANYBLOB="f016748d6b93e5ef16692dfa2d6fc92a59c02ad482c4ff58e14dd2b795377d57191edd26695a16f4aba50a0045d95d9126b18a4b0f376dd49ff0e9014f682f2c25d7f692d9eaba9e7502757b2282f21f99563a7aef34811eaadd235f391260d93bc07ae72e936405858636aa35682410ed5f5d08a186fbacfddce5e7dfc379bafca5f9bddb6fcae012238aa8239b0689ad323a05a057b2d172905316e8ff097485702fd8561938cd6cd7496ac76fdd6482c3898ad53ac5d0d2a142d0819c75513c242d297dd9512054fbad3bd9c4fbb4da1d7a499bf15eb0cd092e552279c3b8ed8fa1b1c8d57fc61f9a539c23ec6e7f555b86abe2eac5917f5da9f7e685181bad8d284eace7bc8636352b3050841cb3ec2b224c5af3e7dabce5db7fe82c834ac8d8fca8a2cf446f50f831af503c4278eec8ccb9af1ba0703a5254966ab0799e7f6d7e38a2695df18f0776b8353fc2a2b835527e54"], 0x10) r5 = syz_open_dev$vcsn(&(0x7f0000000500)='/dev/vcs#\x00', 0x81, 0x2000) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r5, 0x84, 0x1e, &(0x7f0000000080), &(0x7f0000000280)=0x4) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r5, 0x84, 0x20, &(0x7f00000000c0), &(0x7f0000000140)=0x4) 15:57:09 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x2000000, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 311.074891] binder: undelivered TRANSACTION_COMPLETE 15:57:09 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x600000000000000, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 311.160912] binder: BINDER_SET_CONTEXT_MGR already set [ 311.176475] binder: 15544:15563 ioctl 40046207 0 returned -16 [ 311.192780] binder_alloc: 15544: binder_alloc_buf, no vma [ 311.223853] binder: 15544:15546 transaction failed 29189/-3, size 24-8 line 2970 [ 311.247804] binder: send failed reply for transaction 768, target dead [ 311.260542] binder: undelivered TRANSACTION_ERROR: 29189 15:57:09 executing program 5: pkey_alloc(0x0, 0x0) pkey_mprotect(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0xffffffffffffffff) openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) seccomp(0x0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000240)}) openat$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f00000000c0), &(0x7f0000000080)=0x4) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000280), 0xffffffffffffffff) chroot(&(0x7f0000000380)='./file1\x00') syz_open_procfs(0x0, &(0x7f0000000140)='attr/fscreate\x00') write$P9_RRENAMEAT(0xffffffffffffffff, &(0x7f00000008c0)={0x7}, 0x7) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000001c0), 0x4) ustat(0x0, &(0x7f0000000300)) getsockopt$IP_VS_SO_GET_TIMEOUT(0xffffffffffffffff, 0x0, 0x486, &(0x7f0000000200), &(0x7f0000000240)=0xc) setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000480)='tls\x00', 0x4) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000a40)="428055a032b6b6410f140506000000ff0f183736e35cf364dee5d2d2d5f2a60e0e0970020fe9c09f66410b850f00000062c463cd6829f3c4028d97a8587a8f6fee8f2a1812cc789471fac4e14bc22a49052d052d3b19fddd4008356d0000000000f047305cccb241801b00656464f3446da03333420f709427771a69a500e3c4c13b7c12c4b641dcfdc9c4427d0d1aa4212dfca50000262666430ffb348b1f7f") mremap(&(0x7f0000d8a000/0x4000)=nil, 0x4000, 0x2000, 0x0, &(0x7f0000b6f000/0x2000)=nil) getresuid(&(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) gettid() syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='attr/exec\x00') socketpair$unix(0x1, 0x0, 0x0, &(0x7f000000d000)) write$P9_RVERSION(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[], 0x0) ioctl$int_in(0xffffffffffffffff, 0x0, &(0x7f0000008ff8)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000003c0), &(0x7f0000000400)=0xc) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000440), &(0x7f00000004c0)=0xc) fstat(0xffffffffffffffff, &(0x7f0000000500)) stat(&(0x7f0000000580)='./file1\x00', &(0x7f00000005c0)) getgroups(0x0, &(0x7f0000000640)) getegid() setxattr$system_posix_acl(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)='system.posix_acl_default\x00', &(0x7f0000000680), 0x24, 0x0) recvfrom$unix(0xffffffffffffffff, &(0x7f0000bf5000), 0x0, 0x0, &(0x7f0000d93ff6)=@abs, 0x8) fcntl$setown(0xffffffffffffffff, 0x8, 0x0) 15:57:09 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x3000000, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:09 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = dup3(r0, r0, 0x80000) ioctl$sock_inet_sctp_SIOCINQ(r1, 0x541b, &(0x7f0000000040)) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)=ANY=[@ANYBLOB="e00000000000deffffff000000000000"], 0x10) 15:57:09 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x9effffff}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="6a217de052e6f7f6"], @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00 \x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="0f63044001040000"], 0x0, 0x0, &(0x7f0000000500)}) 15:57:09 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x5400000000000000, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:09 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) socket$kcm(0x29, 0x5, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x0, 0x0) write$P9_RGETLOCK(r2, &(0x7f00000000c0)={0x2e, 0x37, 0x1, {0x1, 0x1, 0x2, r1, 0x10, '(*cgroup\\$ppp1#:'}}, 0x2e) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)=ANY=[@ANYBLOB="e00003000000fb000000000006000000"], 0x10) 15:57:09 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x3, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 311.404782] binder: 15587:15588 got transaction with invalid offset (35184372088832, min 0 max 24) or object. 15:57:09 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0xf000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:09 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x6000000, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 311.482108] binder: 15587:15588 transaction failed 29201/-22, size 24-8 line 3033 [ 311.510253] binder: 15587:15601 unknown command 1074029327 [ 311.519039] binder: 15587:15601 ioctl c0306201 20000080 returned -22 15:57:09 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x7, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:09 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) getsockopt$IPT_SO_GET_REVISION_MATCH(r0, 0x0, 0x42, &(0x7f0000000040)={'NETMAP\x00'}, &(0x7f00000000c0)=0x1e) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) [ 311.537376] binder: undelivered TRANSACTION_ERROR: 29201 [ 311.573608] binder_alloc: binder_alloc_mmap_handler: 15587 20001000-20004000 already mapped failed -16 [ 311.610072] binder: BINDER_SET_CONTEXT_MGR already set [ 311.646291] binder: 15587:15588 ioctl 40046207 0 returned -16 [ 311.673734] binder_alloc: 15587: binder_alloc_buf, no vma [ 311.702324] binder: 15587:15619 transaction failed 29189/-3, size 24-8 line 2970 [ 311.718586] binder: undelivered TRANSACTION_ERROR: 29189 15:57:10 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0xf00}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:10 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0xfeffffff00000000, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:10 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0xfeffffff00000000, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:10 executing program 5: select(0x40, &(0x7f0000000680), &(0x7f00000007c0), &(0x7f0000000800), &(0x7f0000000040)) init_module(&(0x7f0000000080)='ppp0nodev+\x00', 0xb, &(0x7f00000002c0)='&{,\x00') seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000440)="42805da06d0fef69dc0f01eeaf6c41ff0f66410f3840e934030f38211a67430f4bc5c19086d9f28fc9410feefa6b20784175450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") eventfd2(0x0, 0x0) syz_execute_func(&(0x7f0000000340)="428055a0876969ef69dc00d9ce41ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175450f2e1ac4010d64ac1e5d31a3b706e2989f7f") 15:57:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x452000, 0x20) getsockopt$ARPT_SO_GET_REVISION_TARGET(r2, 0x0, 0x63, &(0x7f0000000180)={'TPROXY\x00'}, &(0x7f00000001c0)=0x1e) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x22, 0x0, &(0x7f0000000140)=ANY=[@ANYRESHEX=r1, @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) r3 = dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) setsockopt$bt_rfcomm_RFCOMM_LM(r3, 0x12, 0x3, &(0x7f0000000040), 0x4) 15:57:10 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) tee(r0, r0, 0x400, 0x9) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) 15:57:10 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0xffffffff00000000, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 312.271236] binder: 15638:15641 unknown command 808482864 15:57:10 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x8, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:10 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x600}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:10 executing program 4: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x9c0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, 0xffffffffffffff9c, 0x0, 0x3, &(0x7f00000000c0)='@*\x00'}, 0x30) r2 = getuid() ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0186405, &(0x7f0000000180)={0x9, 0x1000, r1, 0x3, r2, 0x3, 0x5, 0x1000}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r4 = getpid() sched_setscheduler(r4, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r3, 0x0, 0x29, &(0x7f0000000200)=ANY=[@ANYBLOB="e0000001ac1414aa0000000006000000b4c139b75f8089d6bc6de0e44669c372cd3ef6f2c0f0c02a5f012139a961213db00c6e4e9a78bf6a0773f0615195c47e0154c88a1e1fb6b421e856bb027474be06817c19b40680ab85939cb1e4950e75f8db922ba6829929e7786a1cbe8b2deefc6600c83da3b2760798788ecefa420b6d5067363cfb6e9e8f64ca5d3dae9b921abbe7f97ce2f78d35d403aaf1174ac89972c32ac1fb3dd182b5f8ad3a99e4e23a38b86b59fd223823762b3cea8d287daf7baa63"], 0x10) [ 312.340279] binder: 15638:15641 ioctl c0306201 20000440 returned -22 [ 312.340607] binder: 15638:15647 IncRefs 0 refcount change on invalid ref 1 ret -22 15:57:10 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x4000000000000000, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:10 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x200000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:10 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x5c, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 312.473925] binder_alloc: binder_alloc_mmap_handler: 15638 20001000-20004000 already mapped failed -16 [ 312.491796] binder: BINDER_SET_CONTEXT_MGR already set [ 312.498883] binder: 15638:15665 unknown command 808482864 [ 312.504691] binder: 15638:15647 ioctl 40046207 0 returned -16 15:57:10 executing program 5: select(0x40, &(0x7f0000000680), &(0x7f00000007c0), &(0x7f0000000800), &(0x7f0000000040)) init_module(&(0x7f0000000080)='ppp0nodev+\x00', 0xb, &(0x7f00000002c0)='&{,\x00') socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000180)) fdatasync(0xffffffffffffffff) keyctl$set_reqkey_keyring(0x10, 0x0) seccomp(0x0, 0x0, &(0x7f0000000100)) lstat(&(0x7f00000003c0)='./file0\x00', &(0x7f00000004c0)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000006c0)={{{@in6=@loopback, @in=@broadcast}}, {{@in6=@remote}, 0x0, @in=@multicast2}}, &(0x7f0000000400)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000840)={{{@in6=@dev, @in=@loopback}}, {{@in=@multicast1}, 0x0, @in=@remote}}, &(0x7f0000000540)=0xe8) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) getegid() getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000640), &(0x7f0000000940)=0xc) lstat(&(0x7f0000000980)='./file0\x00', &(0x7f00000009c0)) getegid() getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000a40), &(0x7f0000000a80)=0xc) getresgid(&(0x7f0000000ac0), &(0x7f0000000b00), &(0x7f0000000b40)) fstat(0xffffffffffffffff, &(0x7f0000000b80)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000c00), &(0x7f0000000c40)=0xc) fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_default\x00', &(0x7f0000000c80), 0x24, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='trusted.overlay.upper\x00', &(0x7f0000000580)={0x0, 0xfb, 0x15, 0x0, 0x0, "811f54820836ed26b1baa53f56ee07e2"}, 0x15, 0x0) futex(&(0x7f0000000280), 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x1c9c380}, &(0x7f0000000040), 0x0) clock_gettime(0x0, &(0x7f0000000080)) bind$inet6(0xffffffffffffffff, &(0x7f0000d84000), 0x1c) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000380), 0x4) setxattr$trusted_overlay_upper(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='trusted.overlay.upper\x00', &(0x7f00000015c0)={0x0, 0xfb, 0x15, 0x0, 0x0, "714b25b8ca55cbb96b40b04ddc47f682"}, 0x15, 0x0) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpgid(0xffffffffffffffff) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, 0x0, 0x0, &(0x7f0000000140)=""/251) syz_emit_ethernet(0x0, &(0x7f0000000100)=ANY=[], 0x0) syz_execute_func(&(0x7f0000000440)="42805da06d0fef69dc0f01eeaf6c41ff0f66410f3840e934030f38211a67430f4bc5c19086d9f28fc9410feefa6b20784175450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") eventfd2(0x0, 0x0) syz_execute_func(&(0x7f0000000340)="428055a0876969ef69dc00d9ce41ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175450f2e1ac4010d64ac1e5d31a3b706e2989f7f") 15:57:10 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x1000000, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:10 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() r2 = syz_open_dev$adsp(&(0x7f00000002c0)='/dev/adsp#\x00', 0x6, 0x400800) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffff9c, 0x84, 0x6d, &(0x7f0000000140)={0x0, 0xe3, "0f17aa6ff4262b22077b254c8ff8a53fda9862e6e96afe4d21d5f974a2536779d20c526b35d434fbf22a3798d27a0fd4298341a28906700e9b2a47f7c0347ab01a3d104cab742a635a1d1cef0897f1dea1e4e06842c0ccee4f69be645d724e53af732253a74a1934961e6d2f555bfcc1b4b0878e07a68852f581b3206f3e0579fdcaa96211adb10b12c831f29b2fbafad0512d8397ba32fb1089c1e72b834b53b3dd1275291f5c52d184d21d849dfc05b3de60a0491d9d9a29ce85fd7186a187af5b0fb0a85dd01c54adc162f2c8eb388a4b82e534066d063ffbe22618f9f1dcfc25f5"}, &(0x7f00000000c0)=0xeb) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000000240)={r3, 0xda9}, &(0x7f0000000280)=0x8) sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) [ 312.521246] binder: 15638:15665 ioctl c0306201 20000440 returned -22 [ 312.550625] binder: 15638:15641 IncRefs 0 refcount change on invalid ref 1 ret -22 15:57:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x4081, 0x0) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffff9c, 0x84, 0x6d, &(0x7f00000000c0)={0x0, 0x2d, "294df5caa24611b5bb00cd49bc6a60b0cc4a68a5198e4c0bbac6c8e19a7103383c7dba275f54cf743b33d0b5ca"}, &(0x7f0000000140)=0x35) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r1, 0x84, 0x5, &(0x7f0000000380)={r2, @in6={{0xa, 0x4e21, 0x1, @ipv4={[], [], @remote}, 0x7}}}, 0x84) r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r3, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:57:10 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0xffffffffffffffff, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:10 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x1, 0x0) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r1, 0x40505331, &(0x7f0000000140)={{0x1, 0x3}, {0x9, 0x4}, 0x0, 0x2, 0x8001}) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) [ 312.617409] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:10 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x2, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:10 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x34000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:10 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x6000000, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 312.764738] binder: release 15690:15691 transaction 777 out, still active [ 312.781819] binder: BINDER_SET_CONTEXT_MGR already set [ 312.787615] binder: unexpected work type, 4, not freed [ 312.809966] binder: undelivered TRANSACTION_COMPLETE 15:57:10 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$TIOCMSET(r1, 0x5418, &(0x7f00000001c0)=0x5) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000000)) r3 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0x3ff, 0x20000) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f00000000c0)={@dev, 0x0}, &(0x7f0000000140)=0x14) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f0000000180)={r4, 0x1, 0x6, @dev={[], 0xf}}, 0x10) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000040)=ANY=[@ANYBLOB="e0000001ac1414aa020000142bbbac1414aaac14149fe000000100000008000000000000"], 0xdf) 15:57:10 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0xfffffffe, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 312.813927] binder: 15690:15695 ioctl 40046207 0 returned -16 [ 312.843788] binder_alloc: 15690: binder_alloc_buf, no vma [ 312.849393] binder: 15690:15691 transaction failed 29189/-3, size 24-8 line 2970 15:57:10 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x100000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 312.910079] binder: 15690:15708 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 312.910286] binder: undelivered TRANSACTION_ERROR: 29189 15:57:10 executing program 5: perf_event_open(&(0x7f000001d000)={0x200000002, 0x70, 0x0, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)) open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000280)={{{@in6=@mcast1, @in=@rand_addr}}, {{@in6=@remote}, 0x0, @in6}}, &(0x7f0000000200)=0xe8) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f0000000380)) recvmmsg(0xffffffffffffffff, &(0x7f0000003ec0), 0x0, 0x0, &(0x7f00000040c0)) openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNGETFEATURES(0xffffffffffffffff, 0x800454cf, &(0x7f0000000080)) ioctl$sock_inet6_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000004100)) futex(&(0x7f00000000c0), 0x3, 0x0, &(0x7f0000000140)={0x77359400}, &(0x7f00000001c0), 0x0) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000480)="428055a03b6969ef69dc00d9fbfb69203737c3397c05bd060f38211a40a564a70f157a9e400f01efe5e5417545c462010d42002e660fe095000000003ef0f6585501ee31a3b786e29885c4227992dd289f9f") 15:57:10 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0xb00, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 312.961302] binder: send failed reply for transaction 777, target dead 15:57:10 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0xb, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) write$binfmt_aout(r0, &(0x7f0000000700)={{0x107, 0x7fff, 0x1, 0x2ef, 0x101, 0xee, 0x35a, 0x7}, "1c8f1e9d377793071e380ef403b36af0d881e46c461acc579e6281096733cd9bfb3f03a36ad3e6a28117195aea602de594ef6e875dc732badad6c56e8b9b22c2e032b51bc51c2d677708c34a475a1258505426a45d6f7b01dfba74c8344db9c8519813add3b7eff188c23f8cccbc319d83d3672de63b4badc43497e6dea30cc709bfd7076a4f6e79791ff18fb16750ecb76949c816a3fac79eeae7b2d791a4f70989625b19b0b1c64d3cd9d1fa61c2f7429c636b68369cf6f555d2513c7c0ef490017ecb6c2705211122de23762e8b4538f0f33e450b9f84c02c2331f57e03aa2374", [[], [], [], [], [], [], [], [], [], []]}, 0xb02) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) [ 313.021391] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:10 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) kcmp(r1, r1, 0x0, r0, r0) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) 15:57:10 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x3, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:11 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x90, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000140)={r1, 0x28, &(0x7f00000000c0)}, 0x10) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) 15:57:11 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x400000000000000, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 313.141335] binder_alloc: 15729: binder_alloc_buf, no vma [ 313.152753] binder: 15729:15730 transaction failed 29189/-3, size 24-8 line 2970 15:57:11 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0xffffff7f00000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 313.201337] binder: 15729:15730 IncRefs 0 refcount change on invalid ref 1 ret -22 15:57:11 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x5c, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 313.245382] binder: undelivered TRANSACTION_ERROR: 29189 [ 313.253559] binder: BINDER_SET_CONTEXT_MGR already set [ 313.261448] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 313.265908] binder_alloc: 15729: binder_alloc_buf, no vma 15:57:11 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x54000000, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 313.298038] binder: 15729:15730 ioctl 40046207 0 returned -16 [ 313.317601] binder: 15729:15739 transaction failed 29189/-3, size 24-8 line 2970 [ 313.322297] binder: 15729:15749 IncRefs 0 refcount change on invalid ref 1 ret -22 15:57:11 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x200000000000000, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 313.505673] binder: undelivered TRANSACTION_ERROR: 29189 15:57:11 executing program 5: select(0x40, &(0x7f0000000680), &(0x7f00000007c0), &(0x7f0000000800), &(0x7f0000000040)) init_module(&(0x7f0000000080)='ppp0nodev+\x00', 0xb, &(0x7f00000002c0)='&{,\x00') socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000180)) fdatasync(0xffffffffffffffff) keyctl$set_reqkey_keyring(0x10, 0x0) seccomp(0x0, 0x0, &(0x7f0000000100)) lstat(&(0x7f00000003c0)='./file0\x00', &(0x7f00000004c0)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000006c0)={{{@in6=@loopback, @in=@broadcast}}, {{@in6=@remote}, 0x0, @in=@multicast2}}, &(0x7f0000000400)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000840)={{{@in6=@dev, @in=@loopback}}, {{@in=@multicast1}, 0x0, @in=@remote}}, &(0x7f0000000540)=0xe8) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000005c0), &(0x7f0000000600)=0xc) getegid() getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000640), &(0x7f0000000940)=0xc) lstat(&(0x7f0000000980)='./file0\x00', &(0x7f00000009c0)) getegid() getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000a40), &(0x7f0000000a80)=0xc) getresgid(&(0x7f0000000ac0), &(0x7f0000000b00), &(0x7f0000000b40)) fstat(0xffffffffffffffff, &(0x7f0000000b80)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000c00), &(0x7f0000000c40)=0xc) fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000240)='system.posix_acl_default\x00', &(0x7f0000000c80), 0x24, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='trusted.overlay.upper\x00', &(0x7f0000000580)={0x0, 0xfb, 0x15, 0x0, 0x0, "811f54820836ed26b1baa53f56ee07e2"}, 0x15, 0x0) futex(&(0x7f0000000280), 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x1c9c380}, &(0x7f0000000040), 0x0) clock_gettime(0x0, &(0x7f0000000080)) bind$inet6(0xffffffffffffffff, &(0x7f0000d84000), 0x1c) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000380), 0x4) setxattr$trusted_overlay_upper(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='trusted.overlay.upper\x00', &(0x7f00000015c0)={0x0, 0xfb, 0x15, 0x0, 0x0, "714b25b8ca55cbb96b40b04ddc47f682"}, 0x15, 0x0) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000440)="42805da06d0fef69dc0f01eeaf6c41ff0f66410f3840e934030f38211a67430f4bc5c19086d9f28fc9410feefa6b20784175450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") eventfd2(0x0, 0x0) syz_execute_func(&(0x7f0000000340)="428055a0876969ef69dc00d9ce41ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175450f2e1ac4010d64ac1e5d31a3b706e2989f7f") 15:57:11 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x5000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:11 executing program 4: r0 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x6, 0x4000) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req={0x3f, 0x5, 0x8, 0x6}, 0x10) r1 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000200)={'filter\x00'}, &(0x7f0000000080)=0x54) r2 = getpid() sched_setscheduler(r2, 0x8009, &(0x7f00000000c0)=0x7fff) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f0000000140)=ANY=[@ANYBLOB="e00000014d30bd2b2875881e926eac1414aa000500ca610e673e708906bd4435cdb8a4eaf5cbaed101b7aada3a21cbe6cfc65cd5dfd0a0ce91e94b983555449c6426bd07e20936c805ef838c931a820f90067ac889b368ebe4adbd06cd15fb60293377cb329fae70c1cb0afbc7b674c13c71a9afc78066c307fc18b4137f35f8905161d2ea1e2333c018e99f5c9f20825a"], 0x10) 15:57:11 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x800000000000000, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = dup2(r0, r1) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) mkdirat(r2, &(0x7f0000000080)='./file0\x00', 0x80) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000001c0)={0xffffffffffffffff}, 0x2, 0x1000}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r2, &(0x7f0000000380)={0x16, 0x98, 0xfa00, {&(0x7f0000000180), 0x3, r3, 0x10, 0x1, @in={0x2, 0x4e22, @multicast2}}}, 0xa0) fcntl$F_SET_FILE_RW_HINT(r2, 0x40e, &(0x7f00000002c0)=0xffffffffffffffff) socketpair$inet_udplite(0x2, 0x2, 0x88, &(0x7f0000000040)) getdents(r2, &(0x7f0000000480)=""/212, 0xd4) init_module(&(0x7f00000000c0)='/dev/binder#\x00', 0xd, &(0x7f0000000140)='/dev/binder#\x00') 15:57:11 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0xb00, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:11 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x20400, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) 15:57:11 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x54, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:11 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x300000000000000, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 314.001091] binder: send failed reply for transaction 785 to 15764:15772 [ 314.009110] binder_alloc: 15764: binder_alloc_buf, no vma 15:57:11 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x3f00}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 314.043369] binder: 15764:15777 transaction failed 29189/-3, size 24-8 line 2970 15:57:12 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0xfeffffff, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 314.096637] binder: undelivered TRANSACTION_ERROR: 29189 15:57:12 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0xffffffffffffffff, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 314.200358] binder: undelivered TRANSACTION_COMPLETE 15:57:12 executing program 5: select(0x40, &(0x7f0000000680), &(0x7f00000007c0), &(0x7f0000000800), &(0x7f0000000040)) init_module(&(0x7f0000000080)='ppp0nodev+\x00', 0xb, &(0x7f00000002c0)='&{,\x00') socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000180)) fdatasync(0xffffffffffffffff) keyctl$set_reqkey_keyring(0x10, 0x0) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000440)="42805da06d0fef69dc0f01eeaf6c41ff0f66410f3840e934030f38211a67430f4bc5c19086d9f28fc9410feefa6b20784175450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") eventfd2(0x0, 0x0) 15:57:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_QUERY_BPF(r2, 0xc004240a, &(0x7f0000000040)={0x6, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:57:12 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/icmp6\x00') ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000140)={{0x2, 0x1}, {0x400, 0x67}, 0x400, 0x1, 0x7}) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r2 = getpid() getpid() sched_setscheduler(r2, 0x8, &(0x7f0000000040)=0x378) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) 15:57:12 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x6000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:12 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x1000000, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:12 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = memfd_create(&(0x7f0000000080)='security\x00', 0x1) ioctl$IOC_PR_RELEASE(r1, 0x401070ca, &(0x7f00000000c0)={0x10000, 0x2}) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000040)=ANY=[@ANYBLOB="e0000001ac2114aa0001000006000000b94a3f3171423f000000e6944d879e33242765bad6df0800f48e8f271b4142b883f6187034afc2461734c874967ebce4"], 0x10) 15:57:12 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x3f00000000000000, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 314.293758] binder: release 15804:15805 transaction 791 out, still active [ 314.307615] binder: 15804:15805 ioctl c004240a 20000040 returned -22 [ 314.320597] binder: unexpected work type, 4, not freed [ 314.329403] binder: undelivered TRANSACTION_COMPLETE [ 314.340980] binder: invalid inc weak node for 792 [ 314.363093] binder: 15804:15805 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 314.411873] binder_alloc: binder_alloc_mmap_handler: 15804 20001000-20004000 already mapped failed -16 [ 314.448140] binder_alloc: 15804: binder_alloc_buf, no vma [ 314.448653] binder: BINDER_SET_CONTEXT_MGR already set 15:57:12 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x200000000000000, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:12 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x5}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 314.463995] binder: 15804:15805 ioctl 40046207 0 returned -16 [ 314.483976] binder: 15804:15823 ioctl c004240a 20000040 returned -22 15:57:12 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) ioctl$sock_SIOCSIFBR(r0, 0x8941, &(0x7f0000000040)=@generic={0x3, 0xc29, 0x4}) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @multicast1, 0x0, 0x6}, 0x82) [ 314.514047] binder: 15804:15828 IncRefs 0 refcount change on invalid ref 1 ret -22 15:57:12 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x7}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:12 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x700, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 314.577530] binder: send failed reply for transaction 791, target dead 15:57:13 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000200)=ANY=[@ANYBLOB="9e749f640000000000000000000008009693adb867484ecc5d8d8be64658fcc39f8b33c2f904c178e22a3f1e066269e4f25ec0e8289b93aba6955e741ea026e37d37b3b465e7cba01bc4d65b38f9e80ccf13094824edc25a654523eee06b37a73415952630e5dd9f9d5472ec5a9d813900ae445cda6390e20d558b8fec4441981b44cd5c26101ed000a0919f52efd41e570348e47cb22853d8d75abafed5f240ac2bf45e514b3cd49d398dd445426b91ec753e5354eecd86b9fc3859de4ee68fe1c6ceb57a2820d4fd8c674c7c9bf42cf84e0213100cc09400631df8f763909279c9debc8fa24567cb937034fdaac54976fa88108b3b08fce98d00785a7da26ec3dbd7ca4301e9cca12bf95114fc7b59ce8dba27e16825da6a28a416be73e30e4a42bc9a3bb52488ee3860e8a2e07bfc1ce0c0e90fd893bdbdadc457cc52a8fe50bb3a1a96c63c2966ae9961960ae8e32ec4e1241db7ae62e86f70009dae527bc22c83be3a6d8271eb7a11fc04"], 0x10) 15:57:13 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x3000000, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:13 executing program 5: clock_gettime(0x3, &(0x7f00000000c0)) socket$packet(0x11, 0x0, 0x300) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000140)) connect(0xffffffffffffffff, &(0x7f0000000040)=@l2, 0x80) openat$vcs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vcs\x00', 0x0, 0x0) ioctl$KVM_GET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000280)) shutdown(0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f00000001c0)="428055a0626969ef69dc00d9c421a05d2f8a20f2420f58410dc3397c2a0f0fcdae300f38211a40a566470fe76a00e0400f01efe5e57d0fecec1a1a01460f01ee45dfde9f") 15:57:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000fc7a883d3ee3b56e0000000018000000000000000800000000000000", @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="0463040104000000"], 0x0, 0x0, &(0x7f0000000500)}) 15:57:13 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x48, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:13 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x8100000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 315.254715] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 315.264000] binder: release 15854:15855 transaction 796 out, still active [ 315.270999] binder: unexpected work type, 4, not freed [ 315.278023] binder: 15854:15855 unknown command 17064708 [ 315.285866] binder: undelivered TRANSACTION_COMPLETE [ 315.294203] binder: 15854:15855 ioctl c0306201 20000080 returned -22 15:57:13 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) keyctl$session_to_parent(0x12) r1 = accept4$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, &(0x7f00000000c0)=0x10, 0x800) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r1, 0x84, 0x1c, &(0x7f0000000140), &(0x7f0000000180)=0x4) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) 15:57:13 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x3f00, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 315.306046] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 315.320701] binder_alloc: binder_alloc_mmap_handler: 15854 20001000-20004000 already mapped failed -16 [ 315.343512] binder: BINDER_SET_CONTEXT_MGR already set [ 315.349609] binder_alloc: 15854: binder_alloc_buf, no vma 15:57:13 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x6, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 315.375832] binder: 15854:15855 ioctl 40046207 0 returned -16 15:57:13 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x400000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:13 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x6, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 315.423803] binder_transaction: 1 callbacks suppressed [ 315.423820] binder: 15854:15868 transaction failed 29189/-3, size 24-8 line 2970 [ 315.458621] binder: send failed reply for transaction 796, target dead 15:57:13 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x600000000000000, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f0000000480)={0x0, 0x0, 0x4, 0x0, [], [{0xffffffffffffff01, 0xff, 0x9, 0x9, 0x7fffffff, 0x101}, {0x0, 0x5, 0xc88, 0xfffffffffffffff9, 0x7881, 0x6}], [[], [], [], []]}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) [ 315.475846] binder_release_work: 2 callbacks suppressed [ 315.475853] binder: undelivered TRANSACTION_ERROR: 29189 [ 315.488053] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:13 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)=ANY=[@ANYBLOB="e0000001ac1414d8ef383e9144ded5c87dac53174c507f37dae8ed4cf78a0fdb45bc51c825b434b5d583d9213edd512591d901ce0f1a09f7ed802fec1a66a2fe28d7a100000000579e0a6e00000000000000ff8f6e4c2da135a99f1d6035e6c66b78f4a62e4513f15ef55596346b08394211a3fb8c317a47976fc07bc61500dfcbb744fecead7957fc811fca5f26e66b48bd7bc40c1f8f6796ad45e6297a93cb0d07cb0ffdd1c169f8c757c9078f655179cd7d508871b104ce637d0aa85142a45125788d02028219c6ee7beee7ff4d6887bbce1eb43970c403817622d7cc1bb5c199d0cfbded06762982d58f5b77e84fd1731e60ba186368414e88cb346c4634650000ac86ad678048e31106175523fde790b0e9b989cb694c31dfefa557a0710ed3ae"], 0x10) [ 315.621331] binder: 15889:15890 ioctl c0c0583b 20000480 returned -22 [ 315.675937] binder: release 15889:15890 transaction 801 out, still active [ 315.688148] binder_alloc: binder_alloc_mmap_handler: 15889 20001000-20004000 already mapped failed -16 [ 315.690503] binder: unexpected work type, 4, not freed [ 315.723159] binder: BINDER_SET_CONTEXT_MGR already set [ 315.742831] binder: 15889:15890 ioctl c0c0583b 20000480 returned -22 [ 315.742941] binder: undelivered TRANSACTION_COMPLETE [ 315.762657] binder: 15889:15899 ioctl 40046207 0 returned -16 [ 315.776635] binder_alloc: 15889: binder_alloc_buf, no vma [ 315.783284] binder: 15889:15890 transaction failed 29189/-3, size 24-8 line 2970 [ 315.784569] binder: 15889:15901 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 315.791065] binder: undelivered TRANSACTION_ERROR: 29189 [ 315.813452] binder: send failed reply for transaction 801, target dead 15:57:14 executing program 5: memfd_create(&(0x7f0000000540)='*\x00', 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, 0xfffffffffffffffe) unshare(0x0) syz_open_procfs(0x0, &(0x7f0000000240)='net/if_inet6\x00') socketpair$inet_udplite(0x2, 0x2, 0x88, &(0x7f0000000280)) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f00000000c0)) getitimer(0x0, &(0x7f00000003c0)) write$P9_RATTACH(0xffffffffffffffff, &(0x7f0000000140)={0x14}, 0x14) getsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x0, &(0x7f0000000300), &(0x7f0000000040)=0xfffffffffffffdd5) time(&(0x7f0000000200)) openat$full(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/full\x00', 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='eth0cgroup(\x00'}, 0x48a5bc844f0398af) fcntl$getown(0xffffffffffffffff, 0x9) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(0xffffffffffffffff, 0x40106614, &(0x7f0000000340)={0x0, @speck128}) prctl$setptracer(0x59616d61, 0x0) ioctl$BLKDISCARD(0xffffffffffffffff, 0x1277, &(0x7f0000000400)) getsockopt$IPT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000440)={'filter\x00'}, &(0x7f00000004c0)=0x54) fcntl$getown(0xffffffffffffffff, 0x9) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000800)="42805da0bd0fef69dc0f01eece6dfa19fa380f38218f8978972bf0817e768cc80000000081b5e5bc2b0000002167f00fbab204000000ca6b2179dae5e54175450f2e1ac46279db67444472e671fb0703") write$P9_RSTATFS(0xffffffffffffffff, &(0x7f0000000180)={0xfffffffffffffe0e}, 0x43) 15:57:14 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x100000000000000, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:14 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz1\x00', 0x1ff) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) 15:57:14 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0xf0ffffffffffff}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:14 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x3000000, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000000040)={0x0, 0x28f61674}, &(0x7f00000000c0)=0x8) ioctl$PPPIOCGMRU(r1, 0x80047453, &(0x7f00000001c0)) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f0000000140)={0xfd6a, 0x0, 0x401, 0xffffffff, r3}, &(0x7f0000000180)=0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="010400002000c905"], 0x0, 0x0, &(0x7f0000000500)}) 15:57:14 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) personality(0x400000f) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x400, 0x0) ioctl$TIOCCONS(r2, 0x541d) ioctl$VT_RESIZEX(r2, 0x560a, &(0x7f00000000c0)={0x68f, 0xb652, 0x1, 0xb6, 0x4b00000000, 0x5}) [ 316.199252] binder: release 15909:15915 transaction 806 out, still active [ 316.207557] binder: 15909:15915 ioctl 80047453 200001c0 returned -22 [ 316.215280] binder: unexpected work type, 4, not freed [ 316.225384] binder: undelivered TRANSACTION_COMPLETE [ 316.232453] binder: 15909:15915 unknown command 1025 15:57:14 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x40000000, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:14 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x8000000, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:14 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x8050000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 316.250582] binder: 15909:15915 ioctl c0306201 20000080 returned -22 [ 316.310175] binder_alloc: binder_alloc_mmap_handler: 15909 20001000-20004000 already mapped failed -16 15:57:14 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x7000000, 0x54, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 316.354980] binder: BINDER_SET_CONTEXT_MGR already set [ 316.382980] binder: 15909:15915 ioctl 40046207 0 returned -16 15:57:14 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x5c00, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 316.433419] binder_alloc: 15909: binder_alloc_buf, no vma [ 316.447405] binder: 15909:15938 transaction failed 29189/-3, size 24-8 line 2970 [ 316.489398] binder: undelivered TRANSACTION_ERROR: 29189 [ 316.490570] binder: 15909:15926 ioctl 80047453 200001c0 returned -22 [ 316.563469] binder: 15909:15938 unknown command 1025 [ 316.578304] binder: 15909:15938 ioctl c0306201 20000080 returned -22 [ 316.592853] binder: send failed reply for transaction 806, target dead 15:57:14 executing program 5: select(0x40, &(0x7f0000000680), &(0x7f00000007c0), &(0x7f0000000800), &(0x7f0000000040)) init_module(&(0x7f0000000080)='ppp0nodev+\x00', 0xb, &(0x7f00000002c0)='&{,\x00') fcntl$getown(0xffffffffffffff9c, 0x9) getpid() setpgid(0x0, 0x0) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000180)) fdatasync(0xffffffffffffffff) keyctl$set_reqkey_keyring(0x10, 0x0) seccomp(0x0, 0x0, &(0x7f0000000100)) lsetxattr$trusted_overlay_upper(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='trusted.overlay.upper\x00', &(0x7f0000000580)={0x0, 0xfb, 0x15, 0x0, 0x0, "811f54820836ed26b1baa53f56ee07e2"}, 0x15, 0x0) futex(&(0x7f0000000280), 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x1c9c380}, &(0x7f0000000040), 0x0) clock_gettime(0x0, &(0x7f0000000080)) bind$inet6(0xffffffffffffffff, &(0x7f0000d84000), 0x1c) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000380), 0x4) setxattr$trusted_overlay_upper(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='trusted.overlay.upper\x00', &(0x7f00000015c0)={0x0, 0xfb, 0x15, 0x0, 0x0, "714b25b8ca55cbb96b40b04ddc47f682"}, 0x15, 0x0) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpgid(0xffffffffffffffff) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, 0x0, 0x0, &(0x7f0000000140)=""/251) syz_emit_ethernet(0x0, &(0x7f0000000100)=ANY=[], 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_execute_func(&(0x7f0000000440)="42805da06d0fef69dc0f01eeaf6c41ff0f66410f3840e934030f38211a67430f4bc5c19086d9f28fc9410feefa6b20784175450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") eventfd2(0x0, 0x0) seccomp(0x0, 0x0, &(0x7f0000000080)) 15:57:14 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0xffffff9e}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:14 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x4c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:14 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000000)={@multicast2, @remote}, &(0x7f0000000040)=0xc) clone(0x10000000, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) 15:57:14 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0xffffffffffffffff, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB="0000875b292b0000"]], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="046300f3ff000000ce3b8004a7b1b4852e300800000000000000b5a335457ed596c302de96370e2d6b74f6bada854b4df15fcf5fdcf4fb630da0744dd4fbe29696ed715e2b5d3eadbd1290a723b4080000000000000000"], 0x0, 0x0, &(0x7f0000000500)}) 15:57:15 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x500}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:15 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) r1 = getpid() r2 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x4800) ioctl$UI_DEV_CREATE(r2, 0x5501) sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) 15:57:15 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x5c00000000000000, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 317.146168] binder: 15958:15959 got transaction with invalid offset (47456629227520, min 0 max 24) or object. [ 317.170584] binder: 15958:15959 transaction failed 29201/-22, size 24-8 line 3033 15:57:15 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x13, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 317.199269] binder: undelivered TRANSACTION_ERROR: 29201 [ 317.206246] binder: 15958:15959 unknown command -218078460 [ 317.212050] binder: 15958:15959 ioctl c0306201 20000080 returned -22 [ 317.262191] binder_alloc: binder_alloc_mmap_handler: 15958 20001000-20004000 already mapped failed -16 [ 317.298360] binder: BINDER_SET_CONTEXT_MGR already set 15:57:15 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0xffffffff00000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:15 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0xfeffffff00000000, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 317.319212] binder: 15958:15959 ioctl 40046207 0 returned -16 [ 317.348022] binder_alloc: 15958: binder_alloc_buf, no vma [ 317.374527] binder: 15958:15968 transaction failed 29189/-3, size 24-8 line 2970 [ 317.403981] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 317.417057] binder: undelivered TRANSACTION_ERROR: 29189 15:57:15 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x100000000000000, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:15 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:15 executing program 5: alarm(0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000240)={&(0x7f0000ffa000/0x3000)=nil, 0x3000}, &(0x7f0000000280)=0x10) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000140)={'ip_vti0\x00', {0x2, 0x0, @multicast2}}) prctl$setmm(0x23, 0x0, &(0x7f0000ff9000/0x4000)=nil) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) rt_sigreturn() dup2(0xffffffffffffffff, 0xffffffffffffff9c) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000240), 0x4) ioctl$GIO_SCRNMAP(0xffffffffffffffff, 0x4b40, &(0x7f0000000380)=""/109) memfd_create(&(0x7f0000000140)='\'\\+}ppp0\x00', 0x0) eventfd(0x0) ioctl$BLKROSET(0xffffffffffffffff, 0x125d, &(0x7f0000000200)) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b6c, &(0x7f00000001c0)) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000002c0)={@multicast1, @dev}, &(0x7f0000000300)=0xc) connect$packet(0xffffffffffffffff, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x14) accept4(0xffffffffffffffff, &(0x7f0000000040)=@generic, &(0x7f00000000c0)=0x80, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) seccomp(0x0, 0x0, &(0x7f0000000100)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000440)) connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @dev}, 0x10) syz_execute_func(&(0x7f0000000400)="428055a06b6969ef69dc00d9901837c4c3397c2a060f38211a40a564a741dfe0400f01efe5e54175457d0f2e1a1a01460f01ee31a3b786e2989f3f") syz_open_procfs(0x0, &(0x7f0000000440)='mountinfo\x00') ioctl$VHOST_RESET_OWNER(0xffffffffffffffff, 0xaf02, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x0) 15:57:15 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x40030000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:15 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000040)={0x0}, &(0x7f00000000c0)=0xc) sched_setscheduler(r1, 0x0, &(0x7f0000000140)=0x3) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000000)) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r2, 0x8, &(0x7f0000000180)={0x3}) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) 15:57:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_GET_SERVICE(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x2c, r3, 0x400, 0x70bd25, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_SERVICE={0x18, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x8, 0x8}}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24040001}, 0x40) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:57:16 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x4800000000000000, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 318.063663] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 318.082924] binder: release 15995:16000 transaction 814 out, still active [ 318.089931] binder: unexpected work type, 4, not freed [ 318.097763] binder: invalid inc weak node for 815 15:57:16 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x5400000000000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 318.121162] binder: 15995:16000 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 318.129262] binder: undelivered TRANSACTION_COMPLETE [ 318.164745] binder_alloc: binder_alloc_mmap_handler: 15995 20001000-20004000 already mapped failed -16 15:57:16 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x700}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:16 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x700000000000000, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 318.210725] binder: BINDER_SET_CONTEXT_MGR already set 15:57:16 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000003fe8)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000013e95), 0x4) getsockopt$inet_sctp6_SCTP_RTOINFO(r2, 0x84, 0x7a, &(0x7f0000000080), &(0x7f00000000c0)=0x10) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f0000000040), 0x4) close(r1) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)=ANY=[@ANYBLOB="df609001ace11ae1d93bd70006000000"], 0x10) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r2, 0x84, 0x65, &(0x7f0000000140)=[@in={0x2, 0x4e22}, @in6={0xa, 0x4e24, 0x83f, @dev={0xfe, 0x80, [], 0x21}, 0xffff}, @in={0x2, 0x4e21, @local}, @in={0x2, 0x4e21, @rand_addr=0x120000000}, @in6={0xa, 0x4e21, 0x1, @remote, 0x5}, @in={0x2, 0x4e23, @multicast1}, @in={0x2, 0x4e22, @remote}, @in={0x2, 0x4e22, @broadcast}], 0x98) 15:57:16 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0xb00000000000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 318.233711] binder: 15995:16000 ioctl 40046207 0 returned -16 [ 318.287690] binder_alloc: 15995: binder_alloc_buf, no vma [ 318.323096] binder: 15995:16015 transaction failed 29189/-3, size 24-8 line 2970 15:57:16 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0xffffffff00000000, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:16 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x60}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 318.340668] binder: send failed reply for transaction 814, target dead [ 318.351331] binder: undelivered TRANSACTION_ERROR: 29189 15:57:16 executing program 5: perf_event_open(&(0x7f000001d000)={0x200000002, 0x70, 0x0, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)) open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000280)={{{@in6=@mcast1, @in=@rand_addr}}, {{@in6=@remote}, 0x0, @in6}}, &(0x7f0000000200)=0xe8) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f0000000380)) recvmmsg(0xffffffffffffffff, &(0x7f0000003ec0), 0x0, 0x0, &(0x7f00000040c0)) openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNGETFEATURES(0xffffffffffffffff, 0x800454cf, &(0x7f0000000080)) ioctl$sock_inet6_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000004100)) futex(&(0x7f00000000c0), 0x3, 0x0, &(0x7f0000000140)={0x77359400}, &(0x7f00000001c0), 0x0) ioctl$sock_inet_SIOCGARP(0xffffffffffffffff, 0x8954, &(0x7f0000000580)={{0x2, 0x0, @multicast1}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @dev}, 'nr0\x00'}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000480)="428055a03b6969ef69dc00d9fbfb69203737c3397c05bd060f38211a40a564a70f157a9e400f01efe5e5417545c462010d42002e660fe095000000003ef0f6585501ee31a3b786e29885c4227992dd289f9f") 15:57:16 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x40000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:16 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) mkdirat$cgroup(r2, &(0x7f00000000c0)='syz1\x00', 0x1ff) sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) sendmsg$unix(r3, &(0x7f00000008c0)={&(0x7f0000000400)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000880)=[{&(0x7f0000000480)="9b83860372acf47dc04e784b6d774437067efffdbe99525b55726bd5ddea6b48342d81e55fa64ca487eb17e32d00a82f7c3cdd85e2fd79e6d748243d2e7ec5809b10546d65d6e19917feca965b3dc38d4f9e2f6f6ec13eb4fe06282c30fc60b785a6bf350c4b88bd23400275b8690afc9c540b2cad90a32bc6418092176f91d515e1de63a1b5708bdd213a2325235e8dead969044f4d301fee78d18217f3a58257d3bde5ccb459129ecffc6c09fa427430", 0xb1}, {&(0x7f0000000540)="5976907d7d8a94ee23474f32cebcd84e", 0x10}, {&(0x7f0000000580)="6d277f8d9861d219a23a20fc1b9274560d8b3a351e31a6633f5027e04d3c067efcef51e63c9af5fcdd61e8b1bced3adf0268d8a12518ea6975d138de259213115ccd75658f8854098032660b07bb1d2b216f300c2a1f5998e1b197c4b00bb3969ba676cc9dd88c772f77a6bfd7a8d5cf143099dab3ad297ce5142386db91ce6010b2573c0362a785498dcb724e1f3a4c629512e3cf2a8e767cc8d64b1c3b1cb030d7f1d20c80240c8f51db557bc927070a88d58f12799045d4cb4e88374a5ebdc1ed8b491020da5c7708b95f8bbbcae065959cf0bcaa018dc44287725d8fbeab90f69fb78bc3", 0xe6}, {&(0x7f0000000680)="737af53a0526c94a2de852b0f424e2139932f2472630c5f710b787b6b724ee9a2a44ac57702e064c1722be9b276d8b6251f6128fe768e20a6b648ab04f8af016c17d87ec9757ab2b2f111ec4652f22f1b1d5c1d669f748cb9974658be6cf0842ee8d6fb4539b277b576a968c6746e236bb448d0b70c2991d6cc15be33f5b880805f65c77a74d0d1ca63d9659945e696eacd5f27485", 0x95}, {&(0x7f0000000740)="0603c0abc61f6156ba2862491cc4ce723c6f982d637d5920cd13cee5fb14b70db00e5e50476fc57cfac7d40ab58d7706a342c6b0f6ec6c40bdd2c1b52115cb8ef6a0b8bc1221bfc111a9d46b34c344950911c9788ee55af8885c27c4619d64f7635f334bfa6e8edd6371f7e11fce72a9971fcce8872305b23c32af02858de3ed8b305e0a1afe217e67a45f9fd7c95c8c38904a9e2649fa047c09a74e0de0bae36d5145e4be86fa763bbafb61dc1888d0833de6a1a3f50c47e97f6254a1f16a49fb2b7e27bfa8a453fd67e51b4cfa74", 0xcf}, {&(0x7f0000000840)="6288d23602d6fec7dbee5739094efbe503f75e80e81d57b75f2080c6d02457a2df8c8aa29bd82fe544997d264a", 0x2d}], 0x6, 0x0, 0x0, 0x48001}, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000340)={0xffffffffffffffff}, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r3, &(0x7f00000003c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000140), r4}}, 0x18) 15:57:16 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x40000000, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x80000002) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x200200, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) syncfs(r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$TUNSETTXFILTER(r1, 0x400454d1, &(0x7f0000000700)=ANY=[@ANYPTR=&(0x7f0000000380)=ANY=[@ANYRES64=r1, @ANYRESDEC=r1, @ANYRES32=r2, @ANYRESOCT=r0, @ANYRESOCT], @ANYRESDEC=r2, @ANYPTR64=&(0x7f0000000480)=ANY=[@ANYBLOB="9b8ba1db72a6a0a34372122029a458b25ef95518bc9b1037e4625b816e57f197423c60ad61a7", @ANYRES32, @ANYRESOCT=r1, @ANYRESHEX=r0, @ANYPTR=&(0x7f0000000040)=ANY=[@ANYPTR64, @ANYRES64=0x0], @ANYRES32=r0, @ANYRESDEC=r2, @ANYRESHEX=r0], @ANYBLOB="03bc7f7002ef390ba674343346b8548739c9a0b694f45720eaea91866807f7c840c484b128bd7109ef3b102c4e99576d02c140c9dac6d93f133dc366f1a73cc73865a3b1a9395a611d096fec8826a5291703dd1de42b47a44b8cb63f7bd3ef2a412abf1ec93025e686b92c2d0841df3c6d450304ff773880697cca85a50f91cb9dbbc09bedc025283916976e19b0c6bd95cf07e1fd9ae34e8bf253a2831448788e38bff447a89d9553eaf00582aea07b449be8ade4405999c463bbe1dfc20db88dee777314586f1d18feed8e4667023bd2ffe3ccc723248d22c833e0a3e8585ec182cab8c0268d57c84a74cce40d3d73f72845c9e9f5e51df6edc12d6b143efc9940630691e3393c5ff8d4aa693786bd66afca97c7c6045cdf25d2d1e6b6a49564b582dbf15eb3a336f8e104f47cbfbec8897834b5e423c079cea6e2a9f4d4329c84bce5b1dc1e8a6c06ab6cf856f8fbddd8f6ea0c208e34cea547f66d3d38321d2ffdaf4efe3fceb97c1e1585f183f8ea0c223d48aaf485ac98e7246418dac29704f4340956fd09e72d41307ea9607ce570521021b99372e6b18a19e82487fb5e0f7c3223d653988a1b1b9fcca8ae60b3703700425d11a50efbc40100904499aecb719f30c073906bddd87079562bb545b97213845d28f8f1fcde582a68917338d5e18fc895f839b310bcdca947e0cd1cd6323c47280e035212f29d211260798b453090271eaca8648af988598d0b3f02ae295e38013e2499471a88a45d146da7a118dcf45b309ce54df537666762e8ae6fafe62f53a2f130ee5c09a5f1628cb7b09c1bd48c96a0efb2451082a2ea0267fe9ddeb18184d4121e62becd4edafcb85d49f8da462c34a803d98eafc2c472fbbee591a4a61e29b94a03861d7db9c4bc6fbd4afabab4e4c0bdc536bdbb85dd83d7cecefbe3961046aa9432d7bb7199e28922fc4a7c1ab07c569d133f8d4e9efe3c2c615e6a7b9f24405b9672bcd3f08a738f00306744975f3b28cd42dfcdb2dfb2cf70176940dd0c35627d800a21c87006545fd4aa85620f886af709f02527423fb6de29abe4832c06b240f1f2c06f06dcca7ae4e4be61ed4318754bc18da41474f214d181b7710c1f6cd84a6745982d79213eb7a71e572286d661efa699e76d8b6edf0019e85364182d9920bec6246a7928700dbcab6a3ba5ba4017e2645ab4fd7a8611baa98c8eb1e0b025c09f8343ca052fc2eabde4cce7c9ccf6530b41ac83f410bfdea20b597bd4c044535728277d99d7ef584955219a4ff702dc3b824e35a3732e1d7b2db2679f6e2a92ee216140bd7fab1a6d0217f2178c88cfb64e71d8742f1cd8b0e856c44c0b5077bf6bcefbeb7b609d39341c4256e088f6b4bdfcacb0d8ab25edf130465f8de51da165b6d4e7d9c71472280a4d65e126e0870739c3177619671d6b139aa2531c90ec8436bf72dab57d436e9f48a67fe99f5273e03ddc0dd7f58acd5cb2441805905b3c6f861323d54511234ee490e62f761c8b519f8ca69bdfa0105301df00c9811ad2bc4e1b3675f8539b6321f5d6e0018ce3fa9db570981bbffd7d2d42db52785cf09fe58ea1a4bd630d17873a393e30ffa1316d283e30000f562ce76f6d290bc1b3e3c45fe96bef7a88584fb33a27a73b0698d764c82b92497a437da4f4e96568f333eb5077ffc4be6be0f778221114955620ff1e6f0130ee80207ab1e5db63cc6facbad14e75490c59eb2f53fbcd15e9bb29b48c90217ec6f27f1fc9735d42ba712cb9f7ab935f09adaef57d1d496bfa243c84a3e3bc5d25b8d39e803c9d97796a905cbf61f2331899c1b1ade1e06b2feac06320d044301c68aefadf183bbc8fdce7703e0d741c8de908857f87f7d3423bef3ff72a8c15221e58b16110f0503f8d91a6ff60502142b099bef9e8f1efa85d11732d44e1597c7fa21661e6c9a07092bfc5179954577dac4095a28e9de01c706492f95f225c2e6f2d846085a183c82d1a53abe0e64f5832dc02485f14c3f32f3f51a460025443dfa185e9d4f8eecba57fc1477184d6fd841ffebdbbd74dbf1df0ad716132a8514d1cc1a89de3b098d920262ee059be15bb67ea46a739e6a478f2a0cb902d185466d4bfef984f253e1139c38b7ce86bd4e78dcf16cb5099c508a6d02d25c90e8cbb154e64a7b0388d5c65fa044ffd2a603caaea2b080c54e6eb42058bdc39a31c6e5e0ebcfe599fd7fee6acde806d7e6538ab05db670ff0798c899848e932620dbe30681365a49838f80fd619bf3ffe3d2d6cbe9387f178587851a81d18c76d8c564a3b111679dd74de1c844de2c225c71bc748964a861b1451d09cd2ef8fde24da5f85aea81ef91c8cf778b5cea5347f7d53bd6a90fbbe0e1acda7f947c08660ac33bb0212e02f95af7d5a871a5955efa600965ccad585d1c6433531e08d44d47ab262d91033333e5f027f4e151f95b669d557fbe6cde251c94649645fe1691542a3d65870b3fb9a873d52893680a8a0acb588fa173f8a2cd7e99d8bb60f32e5186532c30031b88cf8f3f7482cea887a6db38d7076bc468ead5b83690580ecab81b75bd0066cd9c392a61353002545fc079eb10a8a13435a01b2733d00ff3471e558747839aaca61a6468043db493b10bcb4ad865cd19fbd757cb3bad61d64b710cbecfb301f6ae2e9d5110a104ce0074e07f81cf281a9c834423d559213de8e7616a661d20615f8fcc10fa9470b1dc82d5fdf0ca57c60340cccefa342e4c852d82eb4cd5be13a4ba0c1cc074a680237f96a2da4f402888ca723ab9f6973d5d492bd627d256b4617918b5ace86380af1151054f177f050a4a3f2fcdf71724e04e3ed35dc9c6a95106c1df22a4aae399bf244ec366c34a62ad9d9e2b28c8bc38841329f5cf3060b30ab98300f108d0cb6051623ed9b4ef0d67da564597ad53cd5962e5c2b53265420afd48964c3c496a7126bfe0309ed1052b53371a481187aabd0c78e4959b0525493c43eef266bd41cffb46f40c8d36fd2087673a60dead5f7250a185537945efb22708002b7007da162fbf7f50784055625ee60ee43b3684e655cc4f6769158a7aee121bec2107917397bf20e70c280a281950af8dca919dbf9967345b13eb55944e3e5aee24022f5be96c13cbed339b39d49dee5cfb8f45981347c431dd17667a92c708d618f3bf19cdb53ac03418097e82e5d4a5e655de4509abefd0f700ddd9b1ca7cb84a5f2cb58a058c5d75a79b0dd131739ead10ee5cfae47ff169cca56a83461fc0ce17b6a88d88e693178d8d174e0ca119c5461876867f03321ce8c50d9fcf47a780f8ba5aaee2943f836781e66f939e8452cdad84be9c46fb70487988f07bda8242ab8276159c2a689e4dc293d314ff4fe5850ec8131786f71815f67c6ffbe9f90956443abb37b8e117d230b56a6d98683a3acff58becbfd61e14798fc3942601489af70ed17664f0ab9ec5959211e21bef7825e70adf42cb83a2426e802d8e54118b9d590a61ccf1651fc2bd5f79dbbcb46f833c1aa91f15c29b62288af53ee31b0c0426079516ec5c69aabaae78103a1401db208433c25b319397c59f7d8a4567c2d8a4430a7647970a51aaa8abfeab04cf7cbf90d6eb3a611a61971a91b61a2ed080850fc533b019f28727953d3ca6fe1b50d27ea56b4d578906a5ccfaf5149a6457697bd58672472723042d5db65edc6146f93e0cac5ad8e46e43b592384977fc8cc1d381f30a45e2f617271ba4933e8b2fa5901b5b5ad941588c26e405f810a0f5503a41f13bd6257dd0c2b583975cc6bfb7108deceb5659dd3e0e00a9d4a194bbe6b57c2d5ea7233fdcb6eddc3798e3580377b61bfff5c0e801d9711448c93138112dfeebcff280d2c9d5ba8e6d01710dedfa9fc5364744c1f9b56fa55bc49e75b2fb8a099756280db11e89e97a199fe259f2570c8001d6e488ccba544141a57562efa52ade833bbbb1163f0b44d6f582620b77559a22ec9e9fd9039a22bd241b661bb4a2d87e0c443634f8feb1a96468a3dcd40700d7707d29eeae1345aabd352e87a9759f5550f7898b9190eb6a68a961156ba68d732500e4ceaa1600be0926d10eba6a11f263e24f752920e55a565977b643735cd6eb4d795d36dc62aae533ad3e86be72e856589688c7fdcb4e39278bdf3d841e149b331da00a6d149017215e99a4bd6052d8304cc19c850c924f197a82fc679d9710bc305881702ed32b697d9fa22eaa4db854cb26d8c109ddd7f95b28b4e603e5f8fd42b5cfb397b345bbc915a380dd18780a3c575dc7df968484019fbb5017bbdfa7d145349b2215109ec3d05747a81ed77c76aabec643b9679c80422260be80c59a4bdea4932cc0644e8cd3d868baa9e599fe19b4b05e823060261f3aca6573d034cf3b63ec09bdad9a7038e3c0637a722b1b91fee8274775ddb9625a04a732fd16970705d6f8be331cec6b8bb33d97d4cfa990cd451ad03ab8c7a7f9e4db3c540afcd12b434fb5eadb694cea038d5f6e02e2b689edda8e0bc7a25299c405fbeefc25818dec882f95a2a35155afdb3547af507b56693985d7005f6b460f8654c11bf5df09d5fd091f10fcfc7606bd708d37d34c0d14aeb9f2d0f988eafcf7eb96447baf2cd0e1bac328339d29e0bc2963c9c0084957005e730ccc47029ed736f5b6083d01226974527b497dbd09f73aebbc5ebf217c24156d141689ec574d78f6d955f7bef78f74e188ba7f3df2533f639f7ff66d0194adde52491c990ebfff7bef4f5dcf0084ed07e36bb018d2209d7191435914ee05a9a0078cc73573c24a6f0ae7c5f63029dccce8bd6e8d2887e2febe3cc6025abdfe30a51853b115e62a2674a8ad2aeff24efb90d47c4ac252d7809a3ff5cfecfcb41e9ea83d53faeafdcc87e180c9cf8887b32a5f5bd8392956f37887b7127946f0d8f6b81f07e32300463c6e0a81671742aca81f09c567f1fa3700912f0fef30535296c7406fd2dd98ce06851a287fbf93eda00f70376dd55e442ccd43ace81f1ad25ef761213805575c7169ca655de7278fc1a670f462f1bf77427794c21dc4b89dccfe35e55aa117e71c04e02f405f5f7edaa3b8a8869505cdb1f02eb8b8d5577e3ca17f5531d84c2ca6553fa9f4c4ea599777fc9d662737f9b836ad25ae97197119831700308e003542d687e446f3163863d7e41eed8299b6d5a5968c49e991694d3aefcf3ba95d8d3a8ce1693f2b223ccd78e0cc6bcfdbb4249e5d6d797232af21a00f36b046331c5fd5a3d1d99a9a5e8ec79bfdb7756d28d829e078f1170e657c8ca9508f6c167d8a7f8d9e1b278a0dc55233c2457af7dfffcd2b4f9c3741fb645008eea09455f533e1cc625f951b3ebbe3b143ed223baba0bd0ef802fdbb6b8002a9343d69c44a69ae5b303517a4cd75a05d010c7d5cf6bcecc033aed3ce27df3cec707ab7c2cb6d21817acf16d3c98ab9743c92db3e4fca6801f4ddfa522078639eb5a0723b4a49612cff9a63a88fa1d9cb50015b4c15ecbe9e86ba5337f715de7a9b74ad2cee01f547cf8f22e984ba974011076b79bc9401f804186c502a5eedb44b6c5689731cdd549e1bbedb2a23bc68d2226b1cecfd20f9f30ddcf97485da11ff7c6b3bbb03826d5df2668a160ad1c8e1674db7c45fa8fa81e7733a91eb560d0fcff1d478109e101092dde3f722db09d1d8626ac4aa5081d85c09583f26290359a86fa16c78acf81b41db22e2cfd09adb418824f03529b1a96f13b3b9e6f937ac3eeafec38d3176de808ab0e5caebead26d945d4cd220c0c47725f0ab7584b830341cb38954b76", @ANYRESOCT=r0, @ANYRESHEX, @ANYRESDEC=r1, @ANYRES16=r2]) dup2(r0, r2) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:57:16 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x3}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:16 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0xb, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:16 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0xb00, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 318.999357] binder: 16042:16052 transaction failed 29189/-22, size 24-8 line 2855 15:57:16 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x4000000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 319.087953] binder: 16042:16057 transaction failed 29189/-22, size 24-8 line 2855 [ 319.117221] binder: undelivered TRANSACTION_ERROR: 29189 [ 319.121511] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 319.132965] binder: undelivered TRANSACTION_ERROR: 29189 15:57:17 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x44020203, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000140)={@multicast1, @rand_addr=0x2, 0x3}, 0x10) socketpair$inet6_sctp(0xa, 0x5, 0x84, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_mtu(r2, 0x29, 0x17, &(0x7f00000001c0)=0x3, 0x4) socket$bt_bnep(0x1f, 0x3, 0x4) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1, 0x0) ioctl$RTC_UIE_ON(r3, 0x7003) ioctl$KVM_SET_DEVICE_ATTR(r3, 0x4018aee1, &(0x7f0000000100)={0x0, 0x1, 0x81, &(0x7f00000000c0)=0x401}) getgid() 15:57:17 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0xfffffffe, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:17 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x3, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:17 executing program 5: alarm(0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000240)={&(0x7f0000ffa000/0x3000)=nil, 0x3000}, &(0x7f0000000280)=0x10) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000140)={'ip_vti0\x00', {0x2, 0x0, @multicast2}}) prctl$setmm(0x23, 0x0, &(0x7f0000ff9000/0x4000)=nil) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) rt_sigreturn() dup2(0xffffffffffffffff, 0xffffffffffffff9c) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000240), 0x4) ioctl$GIO_SCRNMAP(0xffffffffffffffff, 0x4b40, &(0x7f0000000380)=""/109) memfd_create(&(0x7f0000000140)='\'\\+}ppp0\x00', 0x0) eventfd(0x0) ioctl$BLKROSET(0xffffffffffffffff, 0x125d, &(0x7f0000000200)) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b6c, &(0x7f00000001c0)) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000002c0)={@multicast1, @dev}, &(0x7f0000000300)=0xc) connect$packet(0xffffffffffffffff, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x14) accept4(0xffffffffffffffff, &(0x7f0000000040)=@generic, &(0x7f00000000c0)=0x80, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) seccomp(0x0, 0x0, &(0x7f0000000100)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000440)) connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @dev}, 0x10) syz_execute_func(&(0x7f0000000400)="428055a06b6969ef69dc00d9901837c4c3397c2a060f38211a40a564a741dfe0400f01efe5e54175457d0f2e1a1a01460f01ee31a3b786e2989f3f") syz_open_procfs(0x0, &(0x7f0000000440)='mountinfo\x00') ioctl$VHOST_RESET_OWNER(0xffffffffffffffff, 0xaf02, 0x0) 15:57:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) 15:57:17 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x60000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:17 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x7, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:17 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x200000, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000140)=ANY=[@ANYBLOB="06000000000000000000000000000000724ca1bb3e86efae0b4b12f1857ddde41aadc1d02d1bab1f4b1c5e852071b9812b65eae23a146946478862d13c89e2522e167bb95d55b7d2dbf12851790e8c51df607182ed9f1934fbd8f7317e2e0d330fa89e7283c0fe4da19084a978067f2d666764a4b8d0b8d5215d"], 0x10) pipe(&(0x7f0000000080)={0xffffffffffffffff}) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f00000000c0)={@mcast2, 0x5, 0x1, 0xff, 0x2, 0xf4dd, 0x1, 0xc9b3}, &(0x7f00000001c0)=0x20) r3 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x9, 0x200c00) ioctl$TIOCSTI(r3, 0x5412, 0x8) 15:57:17 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0xffffffff00000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:17 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0xfeffffff00000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 319.952378] binder: release 16083:16089 transaction 823 out, still active [ 319.959996] binder: BINDER_SET_CONTEXT_MGR already set [ 319.983689] binder: unexpected work type, 4, not freed 15:57:17 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x300, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:17 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x81000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 320.001719] binder: 16083:16089 ioctl 40046207 0 returned -16 [ 320.009244] binder: undelivered TRANSACTION_COMPLETE [ 320.037862] binder_alloc: binder_alloc_mmap_handler: 16083 20001000-20004000 already mapped failed -16 [ 320.062222] binder: BINDER_SET_CONTEXT_MGR already set 15:57:18 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x2000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:18 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x4800, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 320.083234] binder: 16083:16089 ioctl 40046207 0 returned -16 [ 320.105106] binder_alloc: 16083: binder_alloc_buf, no vma [ 320.111600] binder: 16083:16098 transaction failed 29189/-3, size 24-8 line 2970 15:57:18 executing program 4: getpid() r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x40, 0x0) getpid() ioctl$TCSBRKP(r2, 0x5425, 0x7) sched_setscheduler(r1, 0x800000005, &(0x7f0000000000)=0x3) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) [ 320.159055] binder: BINDER_SET_CONTEXT_MGR already set [ 320.177810] binder: 16083:16089 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 320.224251] binder: send failed reply for transaction 823, target dead [ 320.231397] binder: 16083:16104 ioctl 40046207 0 returned -16 [ 320.244034] binder: undelivered TRANSACTION_ERROR: 29189 15:57:18 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) socket$kcm(0x29, 0x5, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x0, 0x0) write$P9_RGETLOCK(r2, &(0x7f00000000c0)={0x2e, 0x37, 0x1, {0x1, 0x1, 0x2, r1, 0x10, '(*cgroup\\$ppp1#:'}}, 0x2e) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)=ANY=[@ANYBLOB="e00003000000fb000000000006000000"], 0x10) 15:57:18 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x20000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:18 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x4000, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:18 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000100)={0x0, 0x0}) fcntl$setown(r0, 0x8, r1) clone(0x200020fe, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) r2 = getpid() setsockopt$inet_buf(r0, 0x0, 0x3c, &(0x7f0000000040)="55796f83f52323c3a2dcb80b74cd5b724ca48cb3118705c57f54843480f54cbd87ac90950645aa75714b9beca5da9ad3a45e", 0x32) sched_setscheduler(r2, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) 15:57:18 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x5400, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r2, 0x84, 0x7, &(0x7f0000000040)={0xbb07}, 0x4) 15:57:18 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x2, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 320.925480] binder: release 16131:16133 transaction 828 out, still active [ 320.935774] binder: unexpected work type, 4, not freed [ 320.943062] binder_alloc: binder_alloc_mmap_handler: 16131 20001000-20004000 already mapped failed -16 [ 320.968589] binder: undelivered TRANSACTION_COMPLETE 15:57:18 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x9effffff00000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:18 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x4, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 320.987171] binder: BINDER_SET_CONTEXT_MGR already set [ 321.018512] binder: 16131:16133 ioctl 40046207 0 returned -16 [ 321.038319] binder_alloc: 16131: binder_alloc_buf, no vma [ 321.049074] binder: 16131:16151 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 321.051228] binder: send failed reply for transaction 828, target dead 15:57:19 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) msync(&(0x7f0000ff9000/0x1000)=nil, 0x1000, 0x100000000001) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x40900, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x210000, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r3, &(0x7f0000000140)={0x28, 0x2, 0x0, {0x0, 0x7, 0x1}}, 0x28) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000180)={0x0, 0x0, @pic={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}}) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f0000000400)) seccomp(0x1, 0x1, &(0x7f00000002c0)={0x5, &(0x7f0000000280)=[{0x1, 0x10001, 0x3f, 0x8}, {0x15, 0x9, 0x9, 0x536209c}, {0xffffffffffff8001, 0x7fffffff, 0x7ff, 0x7}, {0x10000, 0x7f, 0x7f, 0x2}, {0xfff, 0x55ba05e1, 0x865d, 0x7}]}) ioctl$KVM_X86_GET_MCE_CAP_SUPPORTED(r1, 0x8008ae9d, &(0x7f0000000080)=""/54) ioctl$TIOCGLCKTRMIOS(r2, 0x5456, &(0x7f00000000c0)={0x5, 0x10000, 0x3ff, 0xbb, 0x20, 0x8, 0x4604, 0x3ff, 0x4, 0x2, 0x5, 0x1}) 15:57:19 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x54, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:19 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x48000000, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000040)={0x9, 0x80000001, 0x80000001, 0xda0, 0x3}, 0x14) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) [ 321.057671] binder: 16131:16138 transaction failed 29189/-3, size 24-8 line 2970 [ 321.066983] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 321.108448] binder: undelivered TRANSACTION_ERROR: 29189 15:57:19 executing program 4: r0 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) ioctl$EVIOCGLED(r0, 0x80404519, &(0x7f0000000140)=""/163) r1 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f0000000200)=ANY=[@ANYBLOB="e99352116e01588f565cbcecd3b8d1c1b8f0455f61e0bee6ff2e067d1a0796a5413817da710e1b447fbb3e450b2c9fa48d0658ddcba9c88a2fe5814c105961eb0acd8ccb1be20c67f256455aec14bf8e8c1a60f2b6acb732f58e25aa8328cb2613197126c25080a6828cfc9d5fcc0d9becaa088fa290421974c5afa38582951f86df0af4a49a80ffffb243434b6f03908092e7d23a6491aa43c7160000000000000000000000000000"], 0x10) 15:57:19 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x700000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:19 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x3f000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 321.251067] binder: release 16167:16171 transaction 833 out, still active [ 321.260385] cgroup: fork rejected by pids controller in /syz4 [ 321.270410] binder_alloc: binder_alloc_mmap_handler: 16167 20001000-20004000 already mapped failed -16 15:57:19 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000140), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) 15:57:19 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x600, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 321.297884] binder: unexpected work type, 4, not freed [ 321.310771] binder: undelivered TRANSACTION_COMPLETE [ 321.318954] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 321.327684] binder: BINDER_SET_CONTEXT_MGR already set 15:57:19 executing program 5: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x54, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:19 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x700, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 321.371905] binder: 16167:16171 ioctl 40046207 0 returned -16 [ 321.398228] binder_alloc: 16167: binder_alloc_buf, no vma 15:57:19 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x7000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 321.444320] binder: 16167:16194 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 321.451956] binder: 16167:16186 transaction failed 29189/-3, size 24-8 line 2970 [ 321.477808] binder: send failed reply for transaction 833, target dead 15:57:19 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x7000000, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r2, 0x84, 0x7, &(0x7f0000000040)={0xbb07}, 0x4) 15:57:19 executing program 4: socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000000)=0x10001) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x400, 0x0) ioctl$KVM_GET_VCPU_EVENTS(r1, 0x8040ae9f, &(0x7f00000000c0)) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f0000000240)=ANY=[], 0x0) getsockopt$inet_sctp_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000000140)={0x0, 0x2, 0x7, 0x100000000, 0x8, 0x44cf2dad}, &(0x7f0000000180)=0x14) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f00000001c0)={r2, 0x0, 0x7, [0x7ff, 0x6, 0x400, 0x5, 0x4, 0xafb, 0xc16]}, &(0x7f0000000200)=0x16) [ 321.511457] binder: undelivered TRANSACTION_ERROR: 29189 15:57:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR64=&(0x7f0000000340)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00e0000000000000d1bbc7d9ca03b20711c02eef196f312f5439266e93970372ede90922ad942d964e924171ca2eba5add5280a9c2e0ad1511be0358772454628e55e6aed8ad4cca09812dcc64b7ec79dfce2dc0fca1661da552f374868340ce8079a95165bb07ea8d948f41db06af30e7e9b4d888e92b6f0f61424650d8e4d45d97412f87c4614cca948a"], @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) r2 = dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$SG_EMULATED_HOST(r2, 0x2203, &(0x7f0000000040)) sysinfo(&(0x7f0000000140)=""/65) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:57:19 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x300}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:19 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x200000000000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:19 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x4000000000000000, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:19 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) [ 321.690399] binder: release 16216:16217 transaction 838 out, still active [ 321.701922] binder: unexpected work type, 4, not freed [ 321.707787] binder: BINDER_SET_CONTEXT_MGR already set 15:57:19 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x2}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:19 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x8000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 321.731567] binder: undelivered TRANSACTION_COMPLETE [ 321.738994] binder: 16218:16221 ioctl 40046207 0 returned -16 15:57:19 executing program 5: r0 = socket(0x40000000015, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f00000007c0)=0x2, 0x4) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00006dbffc), 0x4) mkdir(&(0x7f0000000140)='./control\x00', 0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mount(&(0x7f0000000100), &(0x7f0000000140)='./file0\x00', &(0x7f00000000c0)='proc\x00', 0x1, &(0x7f00000001c0)) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) rename(&(0x7f00000001c0)='./control\x00', &(0x7f0000000180)='./file0\x00') bind$inet(r0, &(0x7f0000000840)={0x2, 0x4e20, @loopback}, 0x10) ioctl$int_in(r0, 0x5421, &(0x7f0000000900)=0x6) sendto$inet(r0, &(0x7f0000000000)="ba671368d1010000004900000001000000018be49e9301442865319997d0efdb2f54b6a10c7327757482bfce945c2a91fb8dfafc1d3f56bc543ab87321e12cca08a744a2d128b00634bc882151d36809229a96bc3437ef159489384ade077ba295eac2882dbfd3781dd4d4e609c42628dbb709b3eb1fa030009045dd98b9e6d77b6cec9ceb685595d43995e0f04c32260943add79831e661c6a351dedc8b9d220fbf9fb6e44fb6a629ce9a82025124fec9f3ee751f7da0cd7e799be88ddbdac20b48e890ff81d7fa28c2d017d7932f2569038740461accd4582f576e4fdb6150a3399f8266bc19eb943648ad1ad81420ed6c382436e474390c8995e829e4f9df43eed85a60b9ee254e31eb62900857fa134e76cc64880334adbff069a2e5e647d2ed36a96b23834b6f6ca6b8113baf4cf30347fbb7ffc30aea99872cc0dba03b07d3347b2d257edbe2733c26b7337a79962d8ce85469e3bcbe0e4a48a6ae69d13f2d4b5155b390ef67aa714b82b6313ee277cb8986eca5db2e97cb1ae2243bba80274f614ece521baef443394b4c161cb9ae926e21892578b49cfd6efe1cb1572148c10d92218ed73ec116a18de80ac42d2726a4523a764fc6dc356c5fbbf9d2c947ae3bc9a3dc76099f3257c8d5952876151b0326d8cb1d5683ee4ad5ded9a34c00ac1b03f34627ec18a7c2e92c87b7896549cfab5eb55fa85a970994bd4b22b5f0d045e241256d06f485a47b4a55ed389bc1734541232cd41908b5cfa4b8fcfcafce500a0c7ae99767713a98e7927aa69f6ccd7daea62f19ceb82559f41899c9a9aee99113e7e64b5f8b9824be9fdbfa4dd4995673d882bb4daeb64413b334e114965d2ba3cea8051e692508701b9400cb12eae457f8b8549944091b729160939918d8fcae611a5ded665f770db637487a236da1a58ba7566668651a77171fc4fe506496d19059343dbe4f426625d3f2b705f54581372361770bf5a9098a9fafefaf546426b294239ac33e3186e4d58ad2fa995a6ad4dc074e7cca11aead109563b2076c7c6e9f57ec63df960804e2e7f9d8444de9550cca3df7834d864e9777291c2e1f6205de2e43dc995ab8bb1515a365efc2830fa3e7a1dd137f550d6035212bc1f51c3b4ceea430df49ffc9210084ef156ad7e0d219efd6c116693735b44521d389969a3a65617cd2fd6e14060601cee4cd054cf36fe048b57d1d9ee3cad2a73552449926b4a6b03fbe9c0ec68357e1fbe52ed77b67f5870c0aefb7ee8236747e0d67a26725fb515544cbbe8464da94cfd8c0b94bb4e51a263b1749bd0a7cf651931f806d1b928d1f9994f1ad4d50e6a5cd7a8e4e687f8564fdacc864013d095ba9d5709eced3c28eabda476d177a7836400a01e02beeb5a6636d4064fdda344967ad8682d14b87c71727cb66be27d1d39191f4223c545b62fb4860262ba8076a65dbc194cee1df846c584b7bbe9dce6e6895b2cbbb64b03b55548b845cc3de2f939ef918421af9a5e9157e837651245299c03992d0ddee06bd22a31522aca0f309b1feccebc0b1c0ed9d21c19bfd15cd313ff64394fd6a10904890c9f6d646b026f27253e8f584c3ffd20ad67e8b62ed7676706d40bc5c80e376980b81", 0x481, 0x0, &(0x7f000069affb)={0x2, 0x4e20, @loopback}, 0x10) sendto$inet(r0, &(0x7f00004b3fff), 0x0, 0x0, &(0x7f00002b4000)={0x2, 0x4e20, @loopback}, 0x10) poll(&(0x7f00000004c0)=[{r0}], 0x1, 0x4) [ 321.777614] binder: 16218:16225 transaction failed 29189/-22, size 134217728-9007213213384704 line 2855 [ 321.804102] binder: send failed reply for transaction 838, target dead 15:57:19 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x5c000000, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 321.824743] binder: undelivered TRANSACTION_ERROR: 29189 [ 321.831665] binder: 16218:16221 ioctl 2203 20000040 returned -22 15:57:19 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0xf0ffffff}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 321.883053] binder: 16218:16221 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 321.922748] binder_alloc: binder_alloc_mmap_handler: 16218 20001000-20004000 already mapped failed -16 15:57:19 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x800000000000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:19 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x2000000, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 321.933187] binder: 16218:16221 transaction failed 29189/-22, size 134217728-9007213213384704 line 2855 [ 322.001956] binder: 16218:16252 ioctl 2203 20000040 returned -22 [ 322.042424] binder: 16218:16242 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 322.053098] binder: undelivered TRANSACTION_ERROR: 29189 15:57:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) accept4(r2, &(0x7f0000000140)=@in={0x2, 0x0, @loopback}, &(0x7f0000000040)=0x80, 0x80800) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:57:20 executing program 4: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffff9c, 0xc0086420, &(0x7f00000000c0)={0x0}) ioctl$DRM_IOCTL_SET_SAREA_CTX(r0, 0x4008641c, &(0x7f0000001140)={r1, &(0x7f0000000140)=""/4096}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)) setsockopt$inet_msfilter(r2, 0x0, 0x29, &(0x7f0000000040)=ANY=[@ANYBLOB="e000324e985a14aa00897ce94b4d5da6000000060010007868b758d0b7e16e"], 0x10) fstat(r0, &(0x7f00000011c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getresuid(&(0x7f0000001240)=0x0, &(0x7f0000001280), &(0x7f00000012c0)) sendmsg$nl_netfilter(r0, &(0x7f0000004840)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000004800)={&(0x7f0000001300)={0x34fc, 0x11, 0x1, 0x0, 0x70bd2b, 0x25dfdbfd, {0x7, 0x0, 0x2}, [@nested={0x2134, 0x96, [@generic="83f5e2a705e223c0c6786c9500e4", @generic="4e7d706280eda0aae31560e3085fce505aa1851ebeb4c25f58620341ed0be5ce4f9c5dbf70080f70578b934ef8ec317bfc3fea76c2daab3667d207898593e6bb2d1ae53b1b0dbc4e1b20751ce05c57b5dd7f1520a6cd07c7c8a6208ea7f81daa5e57a67f3b1adac91ebec4dc8b43930b6ba26878abfd200963", @typed={0x8, 0x96, @pid=r3}, @generic="6e8bbb88ea6f2dfd3246e2b94dedb5ba5ae7bb68806486b89f36a49f7a549ba1bcaf9fdd7f9d38a575648f278c11d2369c5e27897dbea7bae0993f59e55c184d469b380929718ed68444e814cb75088b2a9f36999294890f3968f7", @typed={0x28, 0x19, @binary="d0febd6466161c605490e291b1462e999d554c1eb3fcfe4322cfbb7a96484881b6"}, @typed={0xc, 0x3f, @u64=0xffff}, @typed={0x8, 0x21, @uid=r4}, @generic="2f64ddcd42c685a66c4f30c03f28fb563a3276ded79d4a3cdaa4688a85817e5e3ae750635edef94c477c5d02563a1b58a65345eabc92ab3b607cbef1ddd20908e54a39f21efd4d805db86cded0492bceb01934825554a001d1594c91a93978cee3dc8e5fba36c261e8765caec58ac5e3f429f762438b282726b2ba237f58b510bd00cac69cab92091b3af137fa98b008fa1d84f905187fe8a1202397f11011c7cbbaeef6efedd4c6555c8d4d0364fa8b00ab514587f338c86ab543ce7a82d586909e55519f1dff79f5ceb4d9f519f35839e433ed809bc619a4eb66593b17f6365fa6881bb0f9adad5ff337e767ef5f3c71e90d74fb622c5db8bc625c82025d547f624be3d69b668bb338fc94e8d017f3d0187dbc596ed5089b4ef636a363e8c2cea6c777c2095fc48b5715ca0b722229414f47346cbead49a6e9017bc00bfd7bb0095686d7c7787a8bfcd97e62e5e27a5f70de87ea0b2ec97c9da3e3a1aaf561358221bd08e83b5c2fec3e88adb7f5c6e90351aa3f168e773f678b7d5593928dab9b4a85093ca9d2867e583a5e9a337e2f7bc5a652df3e9e75bda36ae2f7b9ba6ce645ccc1d8ce5e182d537ec5a880fa233a46aa7fda5c01c388a36f065151af455a930dae0757bf800aece76ef5d670284d4ef52e1fbb371f6a324300812ac58ed6425b77fd596ed48484a6b321740f84a541c025d96a3c83e3381ffc336468c89c89430d8ef6b66df12459588e684a25c9fac534ae11885bb1f561faffed774861fb0f6ea09c6fa5f19b14e9a0622be49e62420d0b51e07b85248da921e29d1204bbf673ca288f1716b2b78357200ea0700377ea79b8cbfb3874be0ed8f311df3c3d204e6fb19b18ad5de20b9c002f94ac61f85a532515019776c4092b1530ae3a67b0893863d6f39c6ae2b770eb39e0f1850718b478094e4470360d68a218c9696ee3a49f5f9c57e29c73b40ec569d3a0699b2162da9fb765befdb73e7663d7b19900e1413c4578203668facc3546d93cbcd698d62f7e713b2d6b4023069371f314eaa0c128d67211a22cdcb08a25e312cf4874f6e5fb8ef81c75b6c5e83fc9729c31adf99fc09810303b83f7be65141ae210374656616bb0c09fdb2e15f8e87b1b99e333270656108beb7aed57275b7b4f7bab35b9405a0c4bd62be0d6c1d26db9133bbbb9b0d3b26c8b7c085e53872078b6589f28e14b797334bae0aca071ec54d91251046b03f8cc5c8f25cbc42a5cf9978e23784dea0ee30146f35ecfd65c232401b917b16c166282362b55567ff56ed36e378209bff5182aeeb5ec9c4237775dcf902e030628c3d21befe20289a7f058efd369dc39fac53e1da96ffbecf45e71845cbf0a8cf6ed6bb4ad056067295cd9176fb87bad049d8bfb8c59e0e123c2c61241a9b5fcca758c0573a2350f369a66cade609e94157c8524966af60c29df90214255fd29e276e21e37c00c7a0f1d1c0b0afb63483b80378dd5a704c0a72791188e05d66b58982e94b29f3e4637704ab89e6b467189548b6da5b3e5fd9ed7c67805a38ec5deb3fef79fef5a67132edeeca6f73c940cd269bfe17127f0106486444f5695d370d3cbc3222ad26a6bb1888724d9601df959c75b7d9d1325266c67372b921d3f8523cca1a81f436d399e3030539a933691a30ba319c9675b3aece29d97c69a2072ad9c820fc48c0d45ae62d7875b293c7ae7d1aa0f01c23fc6c73fc8a06f818997ddd0db1ed903a74decb9c4a972c0a202baf797c9ddb39aced9e6127a46ac1817e755fce7c63ad1672bda7a8a4af7fa6c0082f5a88c6b9e7e1a3f06297ab78131883093e9003e9675c401f3fbe20d62e8df2d20949b97be130ffe5d474f74837fa47a03c21b80417d7dbf68470c771299c3d8529a4610325a22100ce175dd5813b6303cf7cb97f8cde64bbd5e003286e1546ac4e0dfb9cd0344dbd88c66904dc44856607e478541d3219bcc9bb1c145930faefad91b134d850594bcaf2b3070a8e4d4b5b2a5f98f74a1179cf16cec2a8a5b4fad776af1b0274cd9ece9036e46a31d2014026d5187d3f14582c578121393a7677d2eaf3579611fc1b3dbf35e2109d777f776d32b1e385e566240ee59906d9823c43aeeb05fca72ed73dc5bdfd60485f123ec205da809a1481d948405a23042d50ae884087149c5fa6aa98e5120bd3e1b71d8aa16138fd609126f06b4b14670a5da02e4ec32f5e6485eb2066e03505394db25f502c01bec276e16c3fc78200aa0075da3fda40443900011fc08418725c94cf5d05647ccc1edef6c800af2d498dac7a6edd7c0d85e088d135c2a14fdc372a184ec59c8ea1f50e6d3efafcbcdfcd52b0783072c69643929d2721d19dec2a4619a17614bbed0bd3327f69cbac43452796898a397663b1a1c407f31cbdd8952ee9cd2d105de063980e325977a180cdc0286295d61eb593594d85a4c82e65f6a8aa80019a02ae9a7e58d3b11577bd032f49489f8518a9f9581f55e2ddfb33a3acce37d5ceafdfba2400d6f92707a10280aec547b9895ec3ee0e32ea4784fcdc4e4cf75914e20ac9c82c5d3cbcc078fe92b729ae9dddacf9faa82f0904b8e164bc4b3058c3a1eaeabf2d072a871be47eb5eb9d88fd09a01fea1b4c3db1460760788cd977565cfdebe1b4b09f67541091a71d9616fd4610cc7166a24013b7b042bc4c7e4844d84d951036f20bf12f42be4063d1bab6dd8e97d983648722e7048ff974688c584aa28cc81364984b7ddb7153ea8ab49bc6ecfdc9fa8054eb070f5704944ff91707eb2f9781d7206131f484d32ce559fd54abadec6e773735cc26e6d5b490b6b31838626d1469aa0e092955944a5bc4e9fa5bfa65610bdacba3c4f85e59a8d196df3a23c86ede289b73a02e7b236d52e8337d7e78c447cb5358d9b252b783edb4f89da6f0458f642371fb74af29304eef36ee160787524f5d4a37e865ffe9eb9223b3032e098db81fde4b2db85b2646556ad0c21874daf49adf6b06ad87e16819972e31e9325ba650c563581ef0cd608be2ac94868aa9d29b4b45d7bf21bef74ffab6b1e371d1ed548ab20df2ea9b4177934cd37030add240f6688060afb40dcc659ff58935b33c1933910505d3b432cc9c73b29dd7e3e8b0bdca6030b0ffff2167d5bbf4920b2f722484bbc17371cbf69ce863f0cd5478704d791ead11f281e8af59aa1b2b5963f4158989975de5038d495bdaff84364b47ea236f7f35b07070c6f63f2cd4dad7770ee8ec9ee7d3d2580a90dbf7c061fad67408df1848407da0d897057cab2dcf6cd426a9dab55d5a0c7a9bf6e475fa57929968a41f2f2ada519dd15c7edb4877b70a4d5731be9f7ef44c1d0b2273fc5ba34371e7ebe030e4e6252504d2ff6df1fc3be1fbb572cfaaf1686b1c302c2c932b5d91a1950659e25296bc74b0e3b756931439d88ed8c05cc4fce4b15a028ad69645ff7e5933435ef3528dfbf0875b34fe35751e6bfe38b1077c758a00c563747210940981df4b0a9fba7865675e675b4cc15f718dd6c7fd454224572296d22ee7227740f83fbbb6944431f8aaf2d94597c2fbb9827edca95f6737233d7fa28c5af895830e0fda4d4e3fd623fe542c71b9235b875a09fa5c376db4c039bd29b5de8655ed80dee0eaea432a386dcef0d32cdaf8ec0c0d924dc24c867373e3e2539b93cafc5e6b7c007234dcf90b5e2ff850bbfefcee7ae404c4bd8836cd8ab6041b8c02aba0da90265e3e6fe56a00ac87cf5361fd0b4933191863a39dc92abac15ad5ee34a3395084a38f0f5b51cf80500516c230dad555391930bcb3fc132304a0cb0c9fc878c4527077f012cad7ca9aa4e163a7c97f7998c9c4249670db7be604593c22a65d66425835ae5ecc6c7bc439d568b30a5f4fd6ed3c5f0ee00121029682a90ea33cce07e7fbf417d8f47436a9a9306a3b93813359e117b23958d51a4c00435c69467c990eef6cb068f0abbbcfec0d9b66b24296d9c1e263fbd24cdd2f83839c3859f91bb41d19b95244dcabea63322750f2aad787c2b72af5c247711095e995fe0e8f8aed1bf6919edd57d669251d524a437ef949ce0fdc8d319977e2742b7e32aeeb64dbcafcb50b98523d12f468918384bcf820ef0a57b5dbfb730bd8328a355bc6e3f1bf792048e6ea2795717fb8f9f0935cff3f85f3d14c1722f96dcae16ff5afa6c6ea9d2b9f348aea1efe224e4e57e7b89e9d832286b7237dde26c95f880a546fbdeec8f785decd7821f644e195660867bab341de8ae8ff9711db770db95431927da9a10fe29767c416c05b37e7639992f4dcbd5e2a53cb1a7c9917899d7ef27495d7ed0839848dc34fb11ebf5a9207840584797d85cc652dcc63e59f7ab1bcd251523759c2632d99ae8ef50162f0473e6de8743c402463c3de51b43a671ca94f2bb9cb521ddf07ef340c5f7c14daa7def2244f34114159a2df0ea81b522480bd291fe1fe30b9b3529b4e0b85782cfb22c2908b2662355e20b378e1e970647f973b4b277826a6af284df4b44e87d7a999307822ed143b3a75bb507dce2465f10591dc389151f14467dee86aa95c540a74545f116aa6553896662199d318ee8e45e70e82ed23334ef2d14013d4a8cb237cc3618c82224090284e003ae81af5faabf6ca1ea3ae1b4904bdd41c41e30e8d4ad32a5dad1315ac089f236023a0abc61a0af4ef7825f4fe7ffbe030e1091707bc38ba6e5dd3b57a921c8bd3c51cc0e46fc9b3e335d9f180aef33516efeeca98aa0ea051176af375c41c479d984e31083f3a51f04d30b46b0d6d1ecbefcde8400320337bf4baf2e943ef8768b8c28163b6ce5ee4a824bcfd299edcaa0edda4bb5a8f0b83edd08d86e2d62eea33ef6148bf3fdc49ed6b4ee13893f59042dc1b4bf769e2762d3a7e17bfce378ab24d075296b52719c1ba6c01a39ad8b2c811935f4ac3a1a8b5d2fb7926ec0a66ad4837b8e63f41042d0308825b9aceb32d57d5d6af34f16638c92ea64adb13da49306fbf152c3c81c5690c6835a9cdc924e8be52e9db7ccdefffb53e327278b57c4782b554357045fcd1adffcaf6b161be7b986464a78e27763f5962dc96c53fc8fb6d76c5aaf1b1f42ca12dac88516d792b15289f230b826e2ed998a28a7a32c044106d0643bfb043bec2b79c84778f750be7c40d1be7a02aa10bded7a684a8695eb05cd5db0d4ba58938b638f50e46b35ada15794b37dc6a7499dab98d747c24b08a770cbcb66546510e172561cb305d3426afa697b4188a11df02cf9a482ff75f856a77b1254483fc425d5bcc2db39f8cf4e644baf46b2b03141ee0a242f414ec9250885ab5afe97f864e0474e79fdeda436a8b76ca776662513945c47cb83391c76d01fa5c798cdf6856f44f8f526210d9f8ef9d5f1995f0a3822396278bfd9ad9b3e4b6140e1fe1342d1d2add2211c0520719a346dafc421a4455ec80848a9d09ee5b732a7b5aa97e5c442cba99d8941eda4a272783d444ccd97bbcb349886f15b11f6931af307967de568696cc15dec16b3020916cd3596acb46bff49b3020d1f1df020b5fd61faf7bcac7e775a170566c9590496b2f5b03cad2b4d8c353843f39df2d2e7db66c0548ddeea4645aef592485bd0dddc049c6c2337cff637e8e4c65da0887f1494e7cec7fee6637edefaf888abb2d29ff76e5864cd324e68620f0bba4a3af9c8fe7f03dadcd4c51c1b9a7fcef93eea37066f66914235f2b7f4022f29a57c0a7e2a55399cd3b54cf944eedcec6f46079b3faf728153bda41af797360be16a720c40202472cfc58ef9d90ea24879", @generic="10b5a6b0917818a7a598948466aa773edf4c465df24afbdec5063a9135cd95334895fc92757f703ca4843340676a8fcfce0ad02733975e82236c20f9c9c27219ee5a79a40df4c0313a8841590b0768e3e714925c20821a316d88536996d29819f3f727c128ff7b0611ef72c1787524d97d078a053342241fe68acde5ceabf8c9c9004a7c3582174b87b5c5f68456d418c83015356ab0c746f66525981b1b8a2a2452d4482f486df869e3c856397f6c2b3383d1e8b5b19e831504669f6ec800a0129c2b9cb223971124c30b4a9a5f934f47e8e2bcaef53ac6fa5efc98a4e705ab9b1b81334155b5c1f19a9557ffc48f465f65842e442ff79de945fb82ba271c233d810f2e96ff06ddc3fe1727f3d36484967596edff0a75054bdb404cf00d21de64f2e1a3a5bdcd34fb3cd75a36fd65632acd05418b6ba5914a44122c165903eed9062c0989ac573730beab6b5b0aa4702d312b4c52df15dd375af9dc8e79b62c058b5af02528cac4010b6e0b9c3e8743b1d8bc698cd29d0447fe931433f1b368254a9f45d067daaa11429cc379e99e006046e5b2e6a14374379e68c7009a230aae75e58134b463c953158315b9d118eb241c0f80c7a6a385fed0ac225acf3262db7031fd3542e6d6c708a2597155a3676067290a86f9694506b70b661b773b97ebb40b1a8ca42d23aac1bb9d2124fb9a926ae27f19a4d493bcea23400ad26487b5b8ca516192975aacf5ff46bcb4f01aa3415beb035c1b227842cc1065dd0b6bf3fc07d822f2c26a077a04e6c8fb8c4c339d8fb458f1b71223d72847a13e98a5129d4f59fe2f859c29804ff4978965430ffd79fcce18a63046d20724d148a8b526d3e1bdc46b87ba76cbde5f8606b796794ce94c3b200790ca3c9ca3d83272cfd9ad6a32e9fc0f42887a3ffb7ec2c08173f672d2dd2eeafe17313c6586eb028d5adaebf2a6a7d27dfd79f774cf697e0a1e41d105034ee6d051a77f1ae751ea0ce34cdd388042acb474709125977ea8b06a6675643f5961cd6094ee70046a1e6c67abe35e8c9d44f1facbad90bcf09003c701e976ca53eb2388cf59d6b8ac4f20ec67b212c8879d3e7784405dc077fd970b87a17f03ff15ac5e13946d0ebd5402b6cedd0e0f9a6d40e5838d676ff82c5353d6b9b5ce5db8bcc80413a9cdcea62867b5d1d00a0eb3a8adb82f280b3085f80b97cc9388f6cc6fe225030a1bb3aca3c51e2c10fcd5f6692e5dfafaf736cc3e2abcc1e1c83a70d295b617cf6da7e41b895aef8f0a085502cca296d3a03e959c9ddeeff59d8f8e59879ba6565482b19988a000fc7f35661abdc29d976f2a5c30bf86263ed2bb8409d8f65586ed859683967832f62ece13e7dcc0b21b586f959be4a0b66a0a1e46f4b30884c5174ae7cefa09ac46cb1a04730ffd586759a36a7eb34d5dc9ffd0117c8f6393ae2adffa3f79ac821d2b2e1c3e380ce512a8d197743cfbe87ab96b0c9c0e24a79b2df3d9d9073c84d7c2ead5dcb5016d06c2b225b56ae0d9630778e074f8f1e9a8dfaa9018075ff1455afc80637d83a134cec96839924a35eb75dfa26f93d1f93afa6fb83ab0d5e92d251f507964e26bbfbe0bce4fe5210a306c17f86eacfb6d60d803a1c03a3295e4d38aa4784d9a9de0caf9f418b9180f4881c11b78daf5e9381138e3a83aec37ee25232cb7dad78f3edfbac6c097019ccf142565acecc4e66fdf17e08204a044eba95976fbd5b756dc8ca41c0fcf7fc56d17355edd2478638a4eca3f6e494fd29f671961cf6ef2030387d7cb5ac46ddc8975b5191ba54b62de535c31c5589f400470d24e0ef686d86317a8ea19814bb2866c11ff6ee5b826cd6492dd7bc0193369bc651f800ca04a3e1ad5a343407da0c43124b73671a3717270e11e8d604d3e65004c6adb40a681a6986fae5819f0d6bb9845200933d75a59e01de954a1455cfd72121d19f4d32eb9b1f707c3c15255ec2c3bcbaf8df94f7a7d120e851ec22f19cada58ddf23963dc580556f496f3e763418c476d7d60446aae71225bcd8ae91a56346ac8310a1df4689631ee3f0680bfe4f2920edddde1abf18b5e8bdfc31198a40b8f9409e7bfdea5ac550a3ec5820c251a2c0cb1ed86c48470c0a56abf0fd0766c382a7fbb4b03c8e367dc4d39446f2ff673e86b15485786397054fac4695bbfdbd0d6de43e2d109af8df04b7fde12c0f5dc26054c0cc5e9ad2c8092b341e0547ff9db2e98d37f3cf92ec11c76843e88035ad3899165618901a49e4cecc36cdf3597c633c90bcb15da60d2dabd173e3512c8f93fd454ac8592af28059c0d01eab583591518ea022b7891254f89bf15687eaf2c3d9b6f5bad8ad10f00462917d6021881b0faff122ca2c87866f7263792ab4e51cfdce24287e91e5d5487394260c1efc4f01e94123416abb4a602765ff9f8a4fd992a44176421d0e1c42833a6df356bf7f0489d9fb7c0db43ade9f37eb09c7a3c90774798e2466c903dd4a95597ca9379a64ecd51be78897abe7907909191e5131f69f35c3cac8ca1c984276a925bae4dbffb5327114dfa075597947e812487bc9bc5b2c2e9e9329191906a886c36f0b1dd5c28996a05bdfc0057215816b25d1d54922321497c687810ee16eb58e9d3c9c58c95ed38555c690b28763921f8513d1296a85e28479fb9711bc188118321be8017376b556fab3073b7227a12e92469113be54f9508f4523f83f37c7b88ffbccd87da893150cd118ca00a5a3c8d388924226c6ff44a2f28c6a45d2783fc868ff751827ab23641384d2a43d28780ca239c4b7875301d6b4cf902ffe872161299d1c7e4f50f6be592341a155fe1abe5f9f040c21ab2c646f906dc03be58097a6c75f3549f9d383b03842537eae2de3710daeab97bc2e0d45605a8935ec5fc59161e3d5d5cf36d9bcca84a440c5c256a8b2aa0a645b36fd9d9cb6730388910b891a35ba3586e3ff47056139c8fa29842a29e6421ad0a2bab27bb0f2897c54fddddd9a096ec05b159b5b1555e45e1cbd13fdf0ee41c27a9a9562e74843514f1cf3080f468b20eb537eb38502d817eeeaa270a8cdc201981ef3ee4b49877fa0cc55302e5ba2248c4ca10c8c4c17b7fd55c884d32e8638ad6ef19fd500ce990d3546c5230ee824a551d0ae6dee3923a4bf5c5634cfd070d615e46d45b2b2e870bd9df3b864ea4edc243bbd6b917686621424f3540239180e07be5d85d32ec61f92c96f3ef53eebd7a3facf12c149569a75b4a485835db89bc958f8bbd6798acd1a3282f6efded926d947a587b088c576afaf3406355c27dc34f60f5dbf02342c81c5bd3c8405d068eb286c2bfe5e1d5034c4809ebf3859edacf3144ff69345a3611e8f16cb5df2693a56aa1c3a0ba28aa62fd46ccfdd3989253223ad8c0f1a18f18913a3236f56921b1feeec2f305599cae6af532b7519c4046c97ba2d89ab86fa0888333264725d67def95050daf29572a1ae52507049eb13cdbffdfb01964539f2114e32021b8e63ffa4273892ee2e2106602fb8f16c9e90e8f25a867f5165b0a75dc9ab85377b992d1fef7d53e18ac75ea1b21d5e3ace214833ec93593f166dd0fd70fc955e24df20885e3b76e7a9a8251b8605e4739eda305514e539792f036529bcad2e711cbf4e3b9cf8fef1876f44073a8e42d0bfdba8e7d58637aa36903cbbb2558642d6355837a0a3bd1cf27c10d9c96e3f2234c88b963c67d3deb5070c23c5d8b91bed9de53567cea4b139247ebd3abe877bffae9aa12342165b682c1813ba429f041345efb6c7ee41c160b1a4332e178ea6542fa7c651ffb7c16122e52c5998a259091b19cdd18327a32fa113feca4e03072d0fd39ffbd9cd3fe073403ba7b110cb6f766ed305d2491e536927e30f9ff47ca623d6d6fc6a99e20b112915b6aad9dcc01d547df532ae5e3c0831402b9bad1d466f77685976ecf4addff78cfd6441ea876f2dd480045b4694dee2b42c073542bd167ef5992cd4742ce06d581a7e2a89d56f789e435e08ee387b59a9e99d2e0497012c83ee5fd17fbf15630c6c14cd2f04fb8904795c1ca9be6b9390cdeb7d945a9482ee1adf79ccbfbbdb5fcef85a06d62f979e5775be7e5469ab91a7139144d53696911be14961db7ba775ad1997ae5547542261ac179d0b07502e49066a7b4909454d75ca227e53367ee0c723f7f7818c8bd3b4a00d080625b373db91f290060c3f69c464d8db144e303aba28406c4173b9efc9f77c57e61057bd0b74eaa9f0a1aa0c5f14ec521fec7ccb167ee69697b602b2f62cc033acf1c07c412bc49de12ca51eab7ede255834806472900e0a851568d7b9346982774f8e49dd6dbe2cfe451f1bcf81aa908086f030f63e12c3a6accaa63e2c1af29533508d011bdab92ace61d324c2af7e9edfd923456ec499adb4110c0142315c370db72529ca5f9b404d3f75a7c28b33079f69048d533992637b1ce11981b71374d4c76155b37be8e11684ac7390eedd71c983683ed594bdf41372238a0ad2d0d12f72d203ffea4789fe3f29b8a9565e2d37c30273df4940a0a140f5e122e714ea6410384ef6563cc00d12b83b988eb20f1259795c84add03dfb41a738692601ff830b7ae931a4401aec24ed31e052e473fe2401ff9a78fdffe05871faa0d65d13c42faad295154ab63f7c64b2adfe2156921e2a04f384dda8fafa76a1d3220dd67c234ab285973b1a58b564b1767449f5c78b260afe391da36d1824ee189ffe09a86a0fc0eabab8e77d73b710d81e1613ce490737eaf8aad68f3c5715c320eb76c01004bef28c1b09151c7a72ee46ef3c2e9ab4896bb4d70a6e21bf79f3191011fa53851bc295f6a8e270a60dee05e3f3d23ce1df704d415859a4d7fa8c7f1758db637cf56cea3bbf10a750835b7a81e6343beef6c11eef431302a875d55314b9c0c880fde163a3d5338f6bd56aff96d0b5c3df20990d3c6c57ab7a2dfa06e32bbaa4009cedd98316c48c5d8871db018d96f8b88470eff9877f0e8689597d5debd41c6d085a15b207452dce3c2d2f299382b4e6ceca9ca6c732133114bfb604570a05f9bbf7839ad9d854ceeb7aae364c16a6ed7302f1d8aec4487f6c3dde5a6a4d74869af5a829bf4d797739da6abfea8663708eb771427efa3079e3d10bcb07d43a8a32fc78d9d77b9de7c5f3e8791ff7349294ccfd013071fcc5aeec60be2eba7868123798b32c1989e13124939997022b49c32e864c937388bed228e0ab17446f3dfdba39680fba3cc99aa9fb1de721feb8ebc9f687efc02ca8a2b4b7b19fad6965a9566c5f3c7288ba7b01085aa412d555e43773c71ef21498fd8c7e647ba82719829c81ee42e0f42f0b1cc778acaf12e2d6319bcda688f816686b42ac30f078fca87ec879f7b698c72fefb7aa95aee6804c419ab653584b1ef12332099da3bb03dd24f75cb3e9fa4ec9a371c516a083628e69c7c1861b7f8d38118c9dc95781902f17430cb4d3a18a5fbf1242488e5f742113f3981a17bf642810378e840a21461593f23781fb6ee327e1f2525d260e4f7dc7ca21c4d1f24fbae7f1cee54341f7183bf80769e5d6ae4c23266685a9e083565b553c10444e77f9d122ad320111fc347de77dca173a9986f03ef469505ba718e6550ff74c01429cbb8571ee0736bdab67d4ffad0c3aaf96e993e3e02a51f2c16e2d66cd5e2202bd94211a5507a7e1288a2e2cb98fa8228703706246a889f699dfedea47f7c8feab8a242044102c184fb06d4aee4de97b71e2fd38e06cef7fcdb76e0b8d0a6f1eac72f4616b6e3fd471afe56fe9e2b41", @typed={0x8, 0x3e, @u32}]}, @typed={0x1c, 0x18, @str='/proc/self/net/pfkey\x00'}, @generic="61279080f03130a34c20016010f00da8bc36a3ae3dd1d0e2664fb57ce36d60add37e5fb814749cb1138e0f010a24ac979953c73a2dde6496c631fba370152a40a2990ddba592e4dd59c20b50a1a04a6cbb25532dc1a7d80b3fa208b890e85148989cb884264810d23a57190a3b5c066680a911e7a82bb36d8a3ea9e9391c02c8b8523d7467534a5692299cb8aa869056199c1e98c07a7c2ae6892743a6a115970474f5327513dc82c80416b1faec6c190324e7a4b67ae87b6b5e687a0c337fd9474b153a8a6981b5242c907d246384d1b0af68c3029948cd659c298c62a169a7e05c4ea2fa4dda88", @nested={0x12b0, 0x4a, [@generic="1ace84535bae67b15882ec89444a88e5f351059334c829d8751dc2593678e28d16351bf540abdcea884d9890891249a9a1a9b87b2bd0cf537a968fd39531856d71ec350d77edc3cce15180f0ea363e3f6271492fcf9ffc5ae240ec2e8cf89b6c8ff46f6e795572c5fcc4d16c97a7d4cb4f1fe6cc61f036e519f7c969f2c38fde3a889f3050744fb9734a5ed4251c6edb9006ce5186cd6e368566dc394fe7dd4decf383419f8bb29b20772afd2eb48481e0ca26e3d6c8eebf8cf8", @generic="dcebf492449fe7fc94e7c75e8f72c80d8dadbc57a7a5c17e8025d0f7e05d32f39a5c74e1f3e18862288f0747fb735d54945ba9d75c41d74b7384c93f6f380d3f89008727e40cf32a02c21ec9e4a2220940a2102a51d5a9bde34ed04e57619009c1da729e96930ad43689aed37bf2703e140f99ab4509aafb0ea2d9c6fe2d506130033371d1f0cf320ece176e79ed8d71c1738c0b7e8d61038f1b7d9a8767ba36df78c2cd6adb202b79b10060610ed58fb3881c5dc12413bb9a56d3d5edd27a29ce4a820921efc833b1a6b3c88757773d702348f3ae255044df8350c498f6f56e78e4a9096e6b6417b8c912a79b901cdbe9f5b8f37fd8619a6297023cc1c297b85408b14287a3322379d0a74f754942fbb595701bdb54712154adf202bb96d848b79e9464825b124cbd2a0f0913e325eb45d8d0dc343e381a8bc547b1cd8bca77f1b2f36952d86cbed59ac770e084d011b47f33fd3ac08fbb2e197319b650bc262d2747c7a53950141c4cc8dd82d63bd754d714fd0817482e01c707d23700c321ed7cd29c448ed70f98372e3b6768d431bd7ea52ebfac78133e500fd6c5e933ae597c8d5b90d1e8106a4174008611ab05bec56b13d2fe0fe95551271e22ba454d71409f5279b665be9785df206e7e5b8c7377ec2cc19d1b9902042049575aeda8c2de953429bc9c3d07ac65a14488e12badb8461b529e3a031412ab5393c91c14775684ad62ee51b60c2794c60e2d5a3e8c1f57d129540522595eea9e18de3c068b94d0f8ba0ca5e6700d213c6090bbf5b7922f9b32d3e2dfbbf3af75e54c330dc893c5c46076ddc4cc27e5bfdbcaba7ffb7393be8f35af34ad9427bf6a439dadfca811779d21bc23a3f678038b7e5e49d3e97eef6c67b8d13aec43a93ab4c9d534c9b808de907a70be080e02469555587c96542fdd1cda4a9462779d7474a85e3245a58a3bb2d67bd55d19f478e7f3735169a7de303a8fcc5e3b8fcb61161a6cdf306402a7dcd246730325a31193f8595c0bebe45b24b17360704bde4dbfdf8b8fa6e8bd1c90cf296719729936e5cbae1b4fea13c28bc02c598546ec08ffbec1a47085b1f673cab4b515720c626859cf9d94b345d275a9ec0ddffd8299885728890e2879c0f187b6c80d2771f6901bad29d3887f1e0b50846ac1d2b93355fe34da619b9e0697eb9aa8cd9a4b0602281c028186449cc110405bce64a68273830e87adb61b61c158290554e49d09ac3f53436dc3edcb0f4311d195f8339964c715e8684e014b7fb475fb49f5568c60a00fae05a6ed4617aa053605b9dc8d110c470b7000a60749daafe55bd2582145865cdd6542df4acb6d05944976d044340e209a98304d18814fab18271811a19cee6f44f42e6c1aef0ad30d7ad55ca3d5b5e6d62fa7307232344aab8facb34722f09c0935d5a76995a30d7a77ef38836993242ba9aa7be4ab9b2b6dcd85cdfdb4047c87108458af055d1f06dc3495c7a7b5cb103ce62dfb37344171ed006b00f414ca9f753bea16dc8b8abbe8577ecbe338de8bbe08b13cbb495830cf6216411581abec217cee3d419bffad54212e152317a073862fe932ee781d67f09573d4dcb20f2dde7edf6f67e4b288f0f2fd7b45b2cae713667ef970f5b31ef2d258c3555a7fa8170381d52d5f6f69abbfdba3c06d69a273c9076323db772d1cc595a7479008ba9e2e8fdbb77e87440d1b3c9bbff38305efdcdf0106ee11fb0c4c014ea37de20a19879db4d05289975cd052c66b722338fcfc0cfc9460c8dc1c7c1bf2f92d327d2a5e854c4d7dc8ac232c2127ef8123e2afbf11594010796a946b682076dce48ed288dab57378fa66fd98e6e41721e4adeb122b34824bd0222b7f4529c00112d6fc214251adab94b1bccb4d2ae080a4718833577ae505f2a32e828d639692542d75d2ca3cfce7a2dd77bb6b1500d6251c72d2726207f551141f6183976ef3b43426cc015fdcda86fd65732efc2c043c1e56583fd1f71dadbfaf61e98d97f2dc9d709384894af55f75f1ab06aec28934e044b50a19c0c7083d03f6c5ddccdd70eb29b866c97463374692c247092a5617b570b9905134e084db29aa24e9db1236f0c9dca8ee4417c0a6f43fe66516b8654a591bd31d68464ed28cb35db3677b2028dfea4224a79a96ce95f80a2cff4139a27dd166ce27fc63237e7b4e66ad4c5e88258f0adcc745a5c2e164af9d2e97777dbe1fa05c041f91217e0e3a82d38665d9db572c1a3f55594af888231bdea7d7427e2c947585f757245e7012701b7d89da462f9ced1ef37f69936605f7f7bbbdfed7f1b676d82755706244b920197c5e36a0ca8277bf26fb2d48b5292b4d3903f11a54c738931d4c73fdd0732311f6a4b159406e1b5c81d896162e2dcdc6767e9ba621cf3fd2a2262fd807ed1b306e75555c32f24cb4c0745c5e320be9f46c50f71b12ea544292cb28db059724bb3983f6335029f736e66974ce26266a9ca5fa4a5647d619e4f836b2794d033bbf96617d4edbf0007cd8affa9268561e21d11e94f2e74d66ff1fc7b2942ba052bd07fcd8d00dac1d4daf41703fbb160e5930514e65049011cad841b10fe2b3531a10a191055cd471af8db6edf2d1d4a6f4f6bf62d5e854c17b083275c7147a1d48102402a00379e1f24da37a517f9702f13e5f399a5789ddfd975e14d4fc867cd4dc499086b2a62aeed28d52094829d041fe2a4948cbff04c3904927ac8edee92c5f10ff125ca574e428ce093e4bfb54a3b6672ce5b1bb54214e240718a491c45f1ba3f46d715ecb27757f9deb431cedf2568ae828ce95fa4106d494bee2c97adca9a077c31c72c62fc88f309b0a02c328f757da4e73212014e3a618d6b7b3bd5d78436adddbd1200f446d275e7ffcc5c5f476a53259f4b0c88515b3f0574523fb91bc474c58b0c2ca37655a75dc34caa8d4bc6d92605fe0fed18b6a1a64a4f22090211b2a0df3d4298a7f35f1f548c90c805bfbadd8793db7fd6043a050843c21151f9f4c180dfc5b11d7c86ed141795e82b2a2d306d2a1de557121f59fe6454e50c784c8a4335022a25a3f788499b5134c5908b0260eab4980f40b6143cbfc57a7d706a175e53f5a1dda42afd0a9bd9004a18f2ca6d12b6b3b4c2d7951bb17d12d90ae5c819ed947a1b8b86d1e9c897f1d197be523e736f37ce5e2e1a463366a508c2ab3aa4655213d331d4ae70d16b4df9abacb8b5505e37b3c8d010e2d13bacda9b11bbd8f7ea1ed79bd4603847a34db13e98bac1ba4c23573452f4b9b2c333a4ad3d825a5a9713ce274e5fc403a8f4b89d75a37acf354965f40600d00f0042ccaf0bdbb5795c76745599041ce40971adb78630127d8cd603df882f431085f6dfda9d69dd8f61566f7f2abf76ea60d3faa11869a7f0d1b23c46cf30e23fe805a5a83b080241f501fc6b0dc0cae4076a09e2c8958b6fe29645469212bd8b4c5b5de5f648497bd39006de7dd36e9c0f21609adeff63660488c93a15729edf2cdb5064292a588c4790fb69dac1053ac5530662b06e55e9c71a5b58db4f49a7165c8ad9f2e8b4ed60980cfee2a0a74a535959ad4f5b2ae0ae56b64e0ac28d13a76c5dfad1771ff392db2847bd8fd63d0c921f98e62d611b0cdc6f49161d8c7e495d7d0805aea78421942d25f894c398d82bd2372a26d1fe7af45d1a056ae771de32fc24cf4ccfddcbce4c6fa4a62d029e85c061964dfdc6b786d801b1144ff2cb9db84b8533421361c3b889b787fbaf6fdd6133002cb4ea07c2a19e84af01a6938c986f669375d4944817d3a4828d9cbd23dc7ece30f6122f0db89e11481feced197bbc93a7d2ddf89a99a465f6af5e43520b08b37dec14ebb99430e3861720ad612b556c5fcf391721f54027398a34b748058d9486447661aea30ac3d9356a1fd1cb42ed03a36813fcbe42d124da9adbdbfd05ec63c379856fe8c3032f607cb4c0c9b3c4adaf20828bfad14b055e5623e18540b54e99c6b757adffdcc931434fd5ad0561001b05851857e62affe624602ae52b5a442206bbffe24b403ed83a3de0fe7d61de9c34024e3631b8864c52bfd7eea8dd749d1e157f871c80978768af6910d21d6f35d7d59f12ac61e96be3308cdc410656ed8e36b9080b7e713abed3147aaeb56a874bfdd5e9efee58b2ba9b5c1a1e12d152bb1e0a4c2dd474918ddf79d2d85a73aa4288a35351a22e3c296e9ac0f1eca6155fa3fc6a21d3a9072545133ca872910d5d6b5b38cee06a7087f4a80233cf044090eb4378c4710969723a6ce03085a6d849785e09b0db9ebd3cc429b493e8786385fe694350658ea016f629c1e35e25dfa7098c4e669661bb7fae255b98a32803b3a94bb61043e9e48b317445ae7b1dcad157a2b188c0e1f4069646486d63b6f9e22fd071333564a6fc80fb04e8041f3182aec8eed4fbf7892b83879e4dc88ccf3a8ab89c30f44599e3bf1dc2b01ffd783ff93db7449c56c4840acf02070f8e7a32b444d838c9fe67b540ad84e1ffadeb1f2263eef0a0320a12eab54ba4c59758f2405affff5ad5ca80ed9770e95ad2bf1e795a79f0d4018720039feb6916484a61c960a51475f21107b716e646353eb987235c7621a9cf4876f2b6463cd5277b15201ce9cd7df21114049d0768c734d8e4e903272d56fea6269616ebae717bb9074730fc1b08eb8baa464fe6483bbb465c20980da94714dce369013275614a3acb60adbd31ecbd9268d0c98ac7f872511ae5ae9bed59de1e9bc33701ea34bf842c800abd8562065c13d861992561171f1ddeee2342580fff72d87e00e14bd788b6f2879bf1f45c644dfc5d4b52eb77bd41c68599d746529bbdd5345e87fea9b43f87a73d940ddd9a1469b7d463171a83ff5b0c3af338b012d7d035d8df2611b4970f14af2f3f887c4803d922ad7351cb6b30769ca88597388a58cc305e5df7f0c49e0066fa985b6a36992471f8d85c202ff0ec0d170de1e541848367ecad22ccf0402b67e492e47e2b8b7d550ba75c7378eb1a0cd81620acbc601ebb2a4a29fff6ef25210ba1e88c75a078ff36221bbe41aaaa92ae393504ea351731c2ee510afa589ab9d1525e3a2206a5a9a5066ea7a626997cadac5d358700e2fd49cc49134c6e6e630ce6b3405908b37787910cf90c8a89cb99142f33104d9cf581add4ad1d77223e98d0f826f5ac9a615f072b8e824340fe3263bfdc026357f5fe8aef3b569d8ca5edb12adddd322ad2c9a5b98b1be249300e8601d4306aa215382a010cb3dfcc4f6067dfac93c2d51decfe57a4636ffde99b16b8b3ffdf9216fb3a329c4623dca780fe1f8ae7982b8c404bd627fa02554503516cdf65059b2b7187428ed464d914d705659725ff1965579a8831ef542f2c1826acf768d0c7122a92f04eb3c3eb0957bde0b19a43d0f8160cf94869415925f50d390890158be2158e6c8d87a24fcf08904a4ccc011b5d76f1a7e82e56cebc53a0aac53ce84cd28edc8173c7b30066eaafbd614a24184bb48ea53dfc4f958bba0b9ce9e66fe461e8f34a04403d8694c4749fd9896023d5313ce430cda574cb85adbdeb9ff6df0fd2a941f6ff3ff072dafff618accbee1fee60dc0a10f52969ffbbdfb6a1043405178939e60b269fce9204d225bca1f3d7865f391eeb92031e977067428511c3c659c4771ea6fb0bffedf77af6a04d1ae50272e78462dbcdb3ede399dd502bf6b38afa0015bfa13ff942d0eb71491cda0e329c1b41e9e09fdc4d87283d775bd7f89b795f2f40f4035e5b9092e4fb420374957c6e6b8f3a60938eeee67b1a66743f5", @generic="dd669b853be40776fa1b48784ba61be9c8e63af66ccfa859bc15f69080a99ce982859ceb35f381ec650ba4d4879db4ffa6ed1bfe88d0b4c79d158df3295ee7eac2d2160912da298028a5f5f2a9404b18bbefac034ce09898a0ea091f6c38247ee89586f561de3e7efe2359074163140e81d98acae1f38358d198fb937ec377428787f683650b2fc28cf548bbba61482367094e238e2c147f26349a775755afc56860dc0abff9f975cef1f8322cd85530951e7e93e639dd37d69f833097ff1ae4e11ef71ab6518b1670f7b0eb06934851bf808d14e7f54b52bdbeb3", @typed={0x4, 0x14}, @typed={0x8, 0x6a, @uid=r5}, @generic="818b49f5be1e181ae69de1345e2c47b3c35f7c03baebba52b2fec654ce0090bfce092f16778867c3291bb9adab4c0a282cbadfc5785e6e9fc3f87a717cc67eb7a2a03ce49eb17967dbce6bdb250e53f8f26d7fd864765ae56ab2828064164b90092393e0eb9d8c51846558b2a0e18e86b6a66454804c2f6c8a924c83f182f5097b518ab2dff874ddca97fb131db7db6916560780e0b2241ed9ce298b3b664bef028c273f729a6bd729ad152872ed8b2699bba0c0ac95649ad8b3743ce2f55dc0f7c4239526ab42e59a680395818216a5bfbcf434b49616734df627b33801639932a904297c77343517a61dddfc", @typed={0x14, 0x45, @ipv6=@local}, @typed={0x8, 0x6c, @ipv4}]}]}, 0x34fc}, 0x1, 0x0, 0x0, 0xc004}, 0x0) 15:57:20 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x3f000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:20 executing program 5: r0 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x4, 0x2) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000040)) ioctl$FS_IOC_SETFLAGS(r0, 0x40046602, &(0x7f0000000080)=0x94af) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, &(0x7f0000008000)={0x0, {{0x2, 0x0, @multicast2}}}, 0xfffffe92) getsockopt$inet_buf(r1, 0x0, 0x30, &(0x7f0000008000)=""/144, &(0x7f00004ed000)=0x90) 15:57:20 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x8, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:20 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x600000000000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:20 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x1, 0x0) ioctl$VT_ACTIVATE(r1, 0x5606, 0x100) r2 = syz_open_procfs(0x0, &(0x7f0000000100)='/exe\x00\x00\x00\x00\x00\x00') fcntl$setstatus(r2, 0x4, 0x46000) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x4013, r2, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000000)) syz_open_dev$audion(&(0x7f00000001c0)='/dev/audio#\x00', 0x7ff, 0x200) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000140)=ANY=[@ANYBLOB="791fa908213ea6b167c929a467ac88064615c253d8291e8af28c4d9f01741e7de5a79708bd7cd442bf7a0370ca971f47de25afa4815126b50e73a319d6d7ce43245871cf799dae5f089fc53e6c01ff28ff458ee74744ebb719a14636d9eb6f6ff263acbc9ab2524c0ba348b43edb"], 0x10) 15:57:20 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x4000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:20 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0xb00000000000000, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 322.200090] binder: release 16273:16275 transaction 845 out, still active [ 322.211873] binder: unexpected work type, 4, not freed [ 322.228785] binder: undelivered TRANSACTION_COMPLETE [ 322.237029] binder_alloc: binder_alloc_mmap_handler: 16273 20001000-20004000 already mapped failed -16 15:57:20 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0xffffffffffffffff, r0, 0x0, 0xd, &(0x7f0000000080)='^]em1selinux\x00'}, 0x30) r3 = syz_open_dev$usbmon(&(0x7f0000000100)='/dev/usbmon#\x00', 0x800, 0x200000) perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0xc, 0x6, 0x7, 0x8, 0x0, 0x3, 0x8, 0x4, 0x400, 0xb71, 0x9, 0x3f, 0x9, 0xfffffffffffffff7, 0x100, 0x71f, 0x7, 0x25, 0x1f, 0x7f, 0x7, 0x8001, 0x6, 0x1, 0x8, 0x100000001, 0x9, 0x80000001, 0x10000, 0x101, 0x4, 0x790f, 0x800, 0x6, 0x800000000, 0x20, 0x0, 0xfffffffffffffd3b, 0x6, @perf_config_ext={0x2, 0xa53}, 0x48, 0x2070, 0x4, 0x4, 0x3, 0xfc8a, 0x7}, r2, 0x1, 0xffffffffffffff9c, 0x1) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r4, 0xc018ae85, 0x0) fchmodat(r3, &(0x7f0000000140)='./file0\x00', 0x0) 15:57:20 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x8100}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 322.263127] binder: BINDER_SET_CONTEXT_MGR already set [ 322.268446] binder: 16273:16275 ioctl 40046207 0 returned -16 [ 322.324308] binder_alloc: 16273: binder_alloc_buf, no vma 15:57:20 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x600, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 322.368605] binder: 16273:16286 transaction failed 29189/-3, size 24-8 line 2970 [ 322.421511] binder: undelivered TRANSACTION_ERROR: 29189 [ 322.429902] binder: 16273:16297 IncRefs 0 refcount change on invalid ref 1 ret -22 15:57:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:57:20 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0xb000000, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:20 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0xf}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:20 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f00000002c0)=ANY=[@ANYBLOB="e0000001ac1414aab37200000020000096d74fd12e8f25d1fe48e5af20874d896728b3508ba52a2539739ee7a3e944641bc78543b5173663de66070b39167e33150706587b4315b8f9e1af5dc0fa5c822bd0e850410106f18606afc1d30065cd339350d48f0617f20d5f23b99ccb896f8b70a8e781563d1a965064ef269b4d48b7e550fea45eae55eda8d3611ab7d731c24a4506dc572acea5f71042d2975a3f0830d2b18d94e4d8f7ff2182d835c875b0ba9b9d6772cf10ff69c87c3700e57afe35665ac850392dd3c35a2b7da6d4e5695d397f1eb703685ce5eec8249ddb387b145f6427d6bbe16539e4d925ecb7e3ccf6c9674da4e0791af17b3f35b781a61e23f2c1cf7b6d2efd53e90b6175b07fc0fe9a6cd0544534e58ef37c9a4636fb9a7f8edceb52ef3f5dcf3d9c1b5ed81f5c0a38a4810000000000000000118453c61dc9a4b33fb10c0ef854a8e2af1a6788ee214efe57a942a650606add4d8251ede0d6de1fe1fcd4efb7ae4ef5dae37818e1fbbdb6166197e1db1c5b9fec63d8af70f90277262416566e0be0d51bd01dde27f3b3f7939d326be360ec078e1490f8ed0e2eef45345ccdeb7a88f22fee81c46973bfdf05bb40e317c0588a01d61582091687b296d3edd357b24270e336f50100dce56ffd89d009c28665ccc6bc350e0c52172929d77d887ee10c7d52e922b5b81ce467bb53968de9af2cca8f1e9c42a2f5432b00000000"], 0x10) 15:57:20 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x6, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 322.475885] binder: send failed reply for transaction 845, target dead 15:57:20 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0xf0ffffff00000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:20 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000180)='hugetlb.2MB.limit_in_bytes\x00', 0x2, 0x0) r2 = openat$cgroup_ro(r0, &(0x7f0000000040)='cpuset.effective_cpus\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f0000000140), 0x400001) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r2, 0x10e, 0x8, &(0x7f0000000000)=0xcb8, 0x4) socket$netlink(0x10, 0x3, 0x5) 15:57:20 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x13, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 322.576265] binder: release 16312:16313 transaction 850 out, still active [ 322.585564] binder_alloc: binder_alloc_mmap_handler: 16312 20001000-20004000 already mapped failed -16 [ 322.602646] binder: unexpected work type, 4, not freed [ 322.620231] binder: undelivered TRANSACTION_COMPLETE [ 322.636653] binder: BINDER_SET_CONTEXT_MGR already set 15:57:20 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) r2 = creat(&(0x7f0000000040)='./file0\x00', 0x80) socketpair(0xf, 0x0, 0x3, &(0x7f00000000c0)={0xffffffffffffffff}) fanotify_mark(r2, 0x1, 0x8000020, r3, &(0x7f0000000140)='./file0\x00') setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) 15:57:20 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0xfffffffe, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 322.657277] binder: 16312:16313 ioctl 40046207 0 returned -16 [ 322.657362] binder_alloc: 16312: binder_alloc_buf, no vma [ 322.673504] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:20 executing program 5: r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80240080}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r1, 0x400, 0x70bd28, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80000001}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x80) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$ARPT_SO_GET_ENTRIES(r0, 0x0, 0x61, &(0x7f0000000280)={'filter\x00', 0xf4, "77aee87730409f3f9ec81681e903a5cb87eadaa88f37c6ecbad4fad6a50462f550ba9163fb11552b19d56c7cc5bd0997f6cd7d3ad29aea2bd4e5f0780c1aed1dd178227bbe29e0cad5a7f40513c15faa8ac2c777ec25e34dc7703334a4768d6a6dd19e587086144f091feee7bd55bc986005b2a5892e728c4e3dff37465db6d1306be800cb1a3c47d13a66dfe6355ca588828cc28ddc8c73c1ffe57af7c4bf4f2934a5ca63f0130f8c603d1cfb3b85c86ca87d3024a864505afba75b1b7b943ed689bb2290eae5480107381edf68335a35758ffa278921e14a0973fc8e8c3e9cbb5641669f5872864d1c820877062d82a21c1c1f"}, &(0x7f00000003c0)=0x118) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$amidi(&(0x7f0000000200)='/dev/amidi#\x00', 0x2, 0x80000) getsockopt$ARPT_SO_GET_ENTRIES(r2, 0x0, 0x61, &(0x7f0000000480)=ANY=[@ANYBLOB="66696c746572000076c346974c4300000000000000952e00000000000000"], &(0x7f0000000500)=0x24) syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') 15:57:20 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 322.744951] binder: send failed reply for transaction 850, target dead [ 322.752166] binder: 16312:16319 transaction failed 29189/-3, size 24-8 line 2970 [ 322.766019] binder: undelivered TRANSACTION_ERROR: 29189 15:57:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x20002, 0x0) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000480)={0x0, 0xe6, "9b294135c0db257bc98f5d2a1f6994e375b1f3523f19e551d812ab7c84c496958256363c40aaab549e5b70389f1fcaa587badb4043b95cd216715097cd332349b1039b2f80d909ef47eef851372a77404f8c77ee58b4deb4f1d991ff6122278eb43755750011d8fc8b955fd29fdff159f4b385b44f9913a46bfc48dcf4e77423d163f4920d7f0642918cf9b33b6f8552fe62bd3e3dbaaf1dfe0ba1d051cfd892520a9b031db9f6788818cfaa81592b1d14aac4eaa38020f4b794b69f860c4803c737112933b6ad028cd6fe6028bdcbc2c9dbf728e7868020656f6fbf1bb25851ffa053ef6d22"}, &(0x7f00000000c0)=0xee) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000140)={r3, 0xfff}, &(0x7f0000000180)=0x8) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="e4ffffffffffffff"], @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:57:20 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x6000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:20 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)=ANY=[@ANYBLOB="e0000001ac0214aa0000000006000000"], 0x10) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x0, 0x0) getsockopt$bt_BT_SNDMTU(r2, 0x112, 0xc, &(0x7f00000000c0)=0x7, &(0x7f0000000140)=0x2) 15:57:20 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x300000000000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:20 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x48, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:20 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x1000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:20 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0xb000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:20 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x50000c00, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)=ANY=[@ANYBLOB="04000000000000000000"], 0x10) 15:57:20 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-generic\x00'}, 0x58) r1 = accept4(r0, 0x0, &(0x7f0000000000), 0x0) ioctl$sock_inet_SIOCSIFNETMASK(r1, 0x891c, &(0x7f0000000040)={'bond_slave_0\x00', {0x2, 0x4e22, @multicast1}}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000480)="0a0775b0d5e383e5b3c06639d476a0bf", 0x10) sendmmsg$unix(r1, &(0x7f0000003600)=[{&(0x7f0000000300)=@abs, 0x6e, &(0x7f0000000040)}], 0x500, 0x0) lstat(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000380)) [ 322.964489] binder: release 16355:16356 transaction 855 out, still active [ 322.971579] binder: unexpected work type, 4, not freed [ 322.978574] binder: invalid inc weak node for 856 [ 322.991867] binder: 16355:16356 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 323.005216] binder: undelivered TRANSACTION_COMPLETE [ 323.057498] binder_alloc: binder_alloc_mmap_handler: 16355 20001000-20004000 already mapped failed -16 15:57:21 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x2000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:21 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x3000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 323.130511] binder: BINDER_SET_CONTEXT_MGR already set [ 323.140001] binder: 16355:16364 ioctl 40046207 0 returned -16 15:57:21 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x300, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 323.176813] binder_alloc: 16355: binder_alloc_buf, no vma [ 323.177805] binder: 16355:16376 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 323.202930] binder: 16355:16356 transaction failed 29189/-3, size 24-8 line 2970 [ 323.252957] binder: undelivered TRANSACTION_ERROR: 29189 [ 323.274011] binder: send failed reply for transaction 855, target dead 15:57:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$FS_IOC_GETVERSION(r1, 0x80047601, &(0x7f00000001c0)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$FIBMAP(r1, 0x1, &(0x7f0000000080)=0x9) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0xffffffffffffff35, 0x0, &(0x7f0000000380), 0xffffffffffffff8c, 0x0, &(0x7f0000000280)="6688d5d70c74ff6da8fd9eb0fbb33df1f171b5c801af51a9fb6fa0557e47cb8f45d3df4a5fcbe62df6925f6fff2f4004c3e00d4cc44eec0f1120b85cfbccd15ad368c36af00ed165c637780a8a6225a48279307b951c61cf9d1ba090a32e086c750afb518c4a93327deda410d7f37a410d5806ddfe7e822fa6f52795"}) r2 = dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) fcntl$setstatus(r0, 0x4, 0x0) setsockopt$sock_int(r2, 0x1, 0x27, &(0x7f0000000040)=0x1, 0x4) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x12, 0x0, &(0x7f0000000180)=ANY=[@ANYRESHEX=r2], 0x0, 0x0, &(0x7f0000000500)}) 15:57:21 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='lp\x00', 0x3) sendfile64(r0, r0, &(0x7f0000000040), 0x7) sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) 15:57:21 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x2, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:21 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x400300}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:21 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x3f00, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:21 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x3, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:21 executing program 5: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x48, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 323.432035] binder: 16394:16397 ioctl 80047601 200001c0 returned -22 [ 323.439450] binder: 16394:16397 ioctl 1 20000080 returned -22 15:57:21 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)=ANY=[@ANYBLOB="e000001101011414a26eaa218691a7e5"], 0x10) 15:57:21 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0xfffffff0}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 323.493875] binder: 16394:16404 unknown command 808482864 [ 323.502872] binder: 16394:16404 ioctl c0306201 20000140 returned -22 15:57:21 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x100000000000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:21 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x802, 0x0) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000080)={0x0, 0x4004400}) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000919000/0x400000)=nil, 0x400000, 0xffffffffffffffff, 0x8031, r2, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x0, 0x0) ptrace$setsig(0x4203, 0x0, 0x81, &(0x7f0000000100)={0x1d, 0xff}) ioctl$BLKPG(r1, 0x1269, &(0x7f00000000c0)={0x8ca, 0x0, 0x99, &(0x7f0000000200)="337c28f895c9bfa4dd36464537d85775219cfaf58666c195c109e1fedb2376855e87461e864e252fced326ea0a1edbaedcf26eaa75f6b24d902c79b82b391e3ed6018674297a7992e450560e2cb3bb707c1beee683ab05a8e3c3c820c2fec6a3ca32d79cc3da2c0d020b27c8c6aca91fd6560626fa5a9346a6873f3b443e01a1d15811f152593523bd1022c020e2318458ff94978740d9ce3f"}) ioctl$sock_inet_sctp_SIOCINQ(r0, 0x541b, &(0x7f00000001c0)) 15:57:21 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x300000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 323.740528] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 324.232162] binder_alloc: binder_alloc_mmap_handler: 16394 20001000-20004000 already mapped failed -16 [ 324.241963] binder: 16394:16404 ioctl 80047601 200001c0 returned -22 [ 324.248659] binder: BINDER_SET_CONTEXT_MGR already set [ 324.254173] binder: 16394:16430 ioctl 40046207 0 returned -16 [ 324.260304] binder: 16394:16404 ioctl 1 20000080 returned -22 15:57:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) getsockopt$netlink(r2, 0x10e, 0x9, &(0x7f0000000140)=""/78, &(0x7f0000000040)=0x4e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:57:22 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000140), 0xffffffffffffffff) r1 = getpid() ioctl$int_in(r0, 0x5421, &(0x7f0000000040)=0x8) sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) getsockopt$inet_buf(r0, 0x0, 0x36, &(0x7f00000000c0)=""/23, &(0x7f0000000100)=0x17) 15:57:22 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x6, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:22 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x700000000000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:22 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x2000000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:22 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0xf0ffff}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 324.343682] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:22 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x300000000000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:22 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x6000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 324.436276] binder: release 16443:16446 transaction 861 out, still active [ 324.454964] binder_alloc: binder_alloc_mmap_handler: 16443 20001000-20004000 already mapped failed -16 [ 324.471221] binder: unexpected work type, 4, not freed 15:57:22 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) r2 = dup3(r0, r0, 0x80000) ioctl$KVM_CHECK_EXTENSION(r2, 0xae03, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r2, 0x29, 0x45, &(0x7f0000000040)={'HL\x00'}, &(0x7f00000000c0)=0x1e) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) [ 324.482683] binder: undelivered TRANSACTION_COMPLETE [ 324.512129] binder: BINDER_SET_CONTEXT_MGR already set 15:57:22 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x3f00000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 324.553628] binder: 16443:16446 ioctl 40046207 0 returned -16 [ 324.553861] binder_alloc: 16443: binder_alloc_buf, no vma [ 324.624613] binder: 16443:16449 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 324.629009] binder: 16443:16460 transaction failed 29189/-3, size 24-8 line 2970 [ 324.655052] binder: send failed reply for transaction 861, target dead [ 324.672319] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 324.690665] binder: undelivered TRANSACTION_ERROR: 29189 [ 324.705817] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:22 executing program 5: r0 = memfd_create(&(0x7f0000000140)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) ioctl$FIGETBSZ(r0, 0x2, &(0x7f00000001c0)) pwrite64(r0, &(0x7f000003bfff)='/', 0x1, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r0, 0x0) lseek(r0, 0x0, 0x3) sendfile(r0, r0, &(0x7f0000317000), 0x7f8) symlink(&(0x7f0000001000)='./file0\x00', &(0x7f0000000080)='./file0\x00') ppoll(&(0x7f0000000000)=[{r0, 0x148}, {r0, 0x410}, {r0, 0x100}, {r0, 0x100}, {r0, 0x1000}, {r0, 0x4100}, {r0, 0x20}], 0x7, &(0x7f0000000040), &(0x7f00000000c0)={0xffff}, 0x8) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000100)={0x0, r0, 0x4, 0xd60, 0x4, 0x1f}) ioctl$UI_SET_MSCBIT(r0, 0x40045568, 0x1) stat(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880)) 15:57:22 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0xfeffffff, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl(r1, 0x7, &(0x7f0000000140)="6e49fba1b4004d316e6bc5cf39e735379c4517e1c470f7c50930b825e384f568f3e56cb5c2cddffc15288b544426dfe6bb8f626cbb0013f32118e58d712093a8be60b0e11ee68ac6e3907cc278e996ac40d9eb59613c7e84636eb6b498db949d3e852d2ceada1402") dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:57:22 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x700000000000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:22 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x805000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:22 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$SO_COOKIE(r0, 0x1, 0x39, &(0x7f0000000040), &(0x7f0000000480)=0x8) r1 = getpid() r2 = syz_open_dev$dmmidi(&(0x7f0000000740)='/dev/dmmidi#\x00', 0x3, 0x0) sendmsg$nl_xfrm(r2, &(0x7f0000000840)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)=@flushpolicy={0x18, 0x1d, 0x100, 0x70bd25, 0x25dfdbfe, "", [@proto={0x8, 0x19, 0xff}]}, 0x18}, 0x1, 0x0, 0x0, 0x800}, 0x4004) r3 = socket$unix(0x1, 0x7, 0x0) sendmsg$unix(r3, &(0x7f0000000300)={&(0x7f0000000140)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f00000002c0)=[{&(0x7f00000001c0)="0425c8952c0a9d8bb6fdbd4dcbc4bac09543714bce57f94435520e05121501ffe0712417d618a0d8b93cda4590bb98454ec8153b4c1302cb98942c47992fe794475df0d081fc16d0e1f5928499312e560747a9ea0920f4471969ac166bd7b007220e981a69be088de83ba4c5efc253576e7c850502f715dea64607f920f80061dce5811a9b42ea8a7219ea0532c5a075f231a5ab75bc387e63c6909aa3e233b7961d26365d101a832fc9cdd39aeb03d6e2855cfb4d3a284f401ae7b699befc5425b6afba4778dc82d555d7af4e814becb61348d84338560f39", 0xd9}], 0x1, 0x0, 0x0, 0x44800}, 0x8000) sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)=ANY=[@ANYPTR64=&(0x7f0000000340)=ANY=[@ANYBLOB="444f0ba3ef924f9b5146617d73c8616fb9affb7cf5ca907b247df6e47ae9a6da70aed1ed33dc09f1b0a70733d31d738867bd6830889cc77191172e7d02068121589da3597f54ae3dd84eddba33841d5ef52cc717460ea539c3e1190fba9f5159a83e8a98ee8be45b5d64a586b15f5f6a6ca8a527ff8d283cc5b23f5281e07740e3ff1f59705919b0a1b749098afcd03f33e01580129c67c2d6ab724bfabeff6741e953547b", @ANYRES16=r0, @ANYBLOB="62b0921afd9df922583419ebd02b36f7419c4a167f7fb8be4e1ad668f1ec3cd63eaa4f30fe", @ANYRESDEC=r1, @ANYPTR=&(0x7f00000004c0)=ANY=[@ANYPTR64, @ANYRESDEC=r0, @ANYBLOB="7de3c944959604df2bc67c893d04972577dc93773e61f3a5ac70ebe3642962ac08fe00e9dcb3d121406eaffb635991fcbd3b", @ANYBLOB="cd349f3aa06239839c911d5c8f701bea8d207d93609b7ee0257b061816ade4b78047d1d710e6e0beb56f8ed18f994d7a7eb138671b8c8c", @ANYPTR64, @ANYRESDEC=0x0, @ANYBLOB="08c3327261b914142af355841363b87dfec762bce17ac465217e662dfda7c26a6f37f10650941ab93bda4b5297eb020364e0021fe23ca28e97b0a897839964685a2335c7f83ed40dfc2288cb536784051f027d1a3c21bbfad11b3e0295501ea7ba3dff9e7d82a742206f39d62f62a7239ba280d3444084a9c388fd61b161e2680c6d773fa4715b2659c799a985b6779b673bd6cf0719a76c4623a9a7cf49abff886fb5290313e364d36499f502dd389f19fb6b6d65dceaf5e2892103ad92bcb3fe29a9cb557faee11ae8b340bd4aa4d7319860aab7fa407aace296408071497adbb1ba342e7a3d0b0d4fbfdbe186f52cd09e77b13f5b00", @ANYPTR, @ANYBLOB="f0112bfadc52b75dd0978046a030955fc48916262416243a480667257d0fe974e84c575ea9af7bc2f2922f268be9549170c00a1e044094c73907f02b4c123606a24cb9f33a878d743d8e49234dc028a062e0018323075eb38c5718475dbc1c347f7d1a23abf38e7dcd22753adbc3d00624dfb978387c4b484ec2ea7132be035a77881301225a0a94f0d4827684e3a25101082d49f8234458a05b646a40912d37"], @ANYRES64=r1, @ANYRES64=r1, @ANYRES32=r1, @ANYPTR64, @ANYRES64=r0], @ANYRES32=r1, @ANYRESOCT=r1, @ANYRESDEC, @ANYRESOCT=r0, @ANYPTR], 0x6) 15:57:22 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x1000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 324.849491] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 324.869227] binder: 16472:16480 ioctl 7 20000140 returned -22 15:57:22 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x2, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 324.899099] binder: release 16472:16480 transaction 866 out, still active [ 324.908653] binder_alloc: binder_alloc_mmap_handler: 16472 20001000-20004000 already mapped failed -16 [ 324.926317] binder: unexpected work type, 4, not freed [ 324.945742] binder: undelivered TRANSACTION_COMPLETE 15:57:22 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0xfffff000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:22 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, &(0x7f0000000240)="1051806314e8f2cec2d2f5172f176c6ab0640dc29053643c0cc4cf36e974d23e8c53779e811c8872f19e9cd1cfb563e86730b7accdf45cfe34a41c42f9debb25fd318d692b9273a3a4d713992245f3e63e93914fbc29792c25e97e502855917067dcaa57bc3dbac8e38d6f3976edb7b68421ae691516ba4654a46153896c490b735d12ce7943c1c99ee6ae968b77c024dd2a1720d96d69d119f73815bd9e153affc3ed51be8e671e33b27c585673f1de5bac1f6ae9753fd2703be6750df2bfa089b414e5390e74d301e561c148a22e83ec7800", 0xfffffffffffffdc7, 0x8001, &(0x7f0000000340)={0xa, 0x4e20, 0x0, @loopback, 0x1}, 0x1c) write$binfmt_misc(r0, &(0x7f0000000200)=ANY=[], 0xffdc) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x109000, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000380)={'gretap0\x00', 0x4000}) getsockopt$inet_sctp_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000000100), &(0x7f0000000200)=0x8) read(r0, &(0x7f0000000140)=""/165, 0xfee99c9c) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000000)=0x6, 0x4) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x800, 0x0) setsockopt$RDS_RECVERR(r2, 0x114, 0x5, &(0x7f0000000080), 0x4) [ 324.976072] binder: BINDER_SET_CONTEXT_MGR already set [ 324.989533] binder: 16472:16480 ioctl 40046207 0 returned -16 [ 324.999755] binder_alloc: 16472: binder_alloc_buf, no vma 15:57:22 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x1000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:22 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x8000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:22 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000000240)={'filter\x00', 0x7, 0x4, 0x47c, 0x0, 0x140, 0x258, 0x398, 0x398, 0x398, 0x4, &(0x7f00000000c0), {[{{@arp={@multicast1, @remote, 0x0, 0x0, @mac=@random="503e13c697a1", {[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}, @mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, {[0xff, 0xff, 0xff]}, 0x5, 0x5, 0x3, 0x20, 0xfffffffffffffff9, 0x50, 'veth0_to_bridge\x00', 'ip6tnl0\x00', {}, {0xff}, 0x0, 0x164}, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@broadcast, @mac=@dev={[], 0x14}, @rand_addr=0x400, @remote, 0x1}}}, {{@arp={@loopback, @dev={0xac, 0x14, 0x14, 0xb}, 0xff000000, 0xffffffff, @mac=@local, {[0x0, 0xff]}, @mac=@broadcast, {[0xff, 0xff, 0xff, 0xff, 0xff]}, 0x1, 0x7, 0x5, 0xffff, 0x8, 0x7, 'veth1_to_bond\x00', 'ip6gretap0\x00', {0xff}, {}, 0x0, 0x241}, 0xf0, 0x118}, @unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x9, 0x9, 0x1}}}, {{@uncond, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@mac, @empty, @multicast2, @rand_addr=0x4, 0x8, 0x1}}}], {{[], 0xc0, 0xe4}, {0x24}}}}, 0x4c8) sched_setscheduler(r1, 0x5, &(0x7f0000000000)=0x1341) setsockopt$EBT_SO_SET_COUNTERS(r0, 0x0, 0x81, &(0x7f00000001c0)={'nat\x00', 0x0, 0x0, 0x0, [], 0x2, &(0x7f0000000140)=[{}, {}, {}, {}, {}], 0x0, [{}, {}]}, 0xffffffab) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000040)={'\x00', 0x1ff}) [ 325.028426] binder: 16472:16494 transaction failed 29189/-3, size 24-8 line 2970 15:57:23 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x4000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 325.104352] binder: 16472:16480 ioctl 7 20000140 returned -22 [ 325.132358] binder: undelivered TRANSACTION_ERROR: 29189 [ 325.139099] binder: 16472:16494 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 325.152173] binder: send failed reply for transaction 866, target dead 15:57:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$void(r0, 0xc0045878) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:57:23 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x3000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:23 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x7, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:23 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x0, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') ioctl$KVM_GET_FPU(r2, 0x81a0ae8c, &(0x7f0000000300)) sendmsg$IPVS_CMD_SET_SERVICE(r2, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x180000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="b4000000", @ANYRES16=r3, @ANYBLOB="010026bd7000fcdbdf2502000000080006000100ffff1c0001000800020000000000080001000a00000008000800000200000800050006000000080006000000010008000400110f00002000020014000100000000000000000000000000000000fa07000b000a0004003c00020008000b000a00000014000100fe80000000000000000000000000001014000100000000000000000000000000000000000800050083a300000800040000010000"], 0xb4}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @local, 0x0, 0x6}, 0x10) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f00000002c0)=0x3, 0x4) 15:57:23 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:23 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x40000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:23 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x4000000000000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 325.313474] binder: 16527:16528 ioctl c0045878 0 returned -22 [ 325.340712] binder: release 16527:16528 transaction 871 out, still active [ 325.352283] binder: unexpected work type, 4, not freed [ 325.359193] binder_alloc: binder_alloc_mmap_handler: 16527 20001000-20004000 already mapped failed -16 [ 325.375940] binder: undelivered TRANSACTION_COMPLETE [ 325.400250] binder: 16527:16528 ioctl c0045878 0 returned -22 [ 325.439566] binder: BINDER_SET_CONTEXT_MGR already set [ 325.455875] binder: 16527:16542 ioctl 40046207 0 returned -16 [ 325.462127] binder_alloc: 16527: binder_alloc_buf, no vma [ 325.468075] binder: 16527:16528 transaction failed 29189/-3, size 24-8 line 2970 [ 325.476835] binder: 16527:16542 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 325.479649] binder: undelivered TRANSACTION_ERROR: 29189 [ 325.490761] binder: send failed reply for transaction 871, target dead 15:57:23 executing program 5: mkdir(&(0x7f0000000180)='./control\x00', 0x0) mmap(&(0x7f0000010000/0x2000)=nil, 0x2000, 0x1, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000040)={0xffffffffffffffff}) sendmmsg$alg(r0, &(0x7f0000000440)=[{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f00000000c0)="6b049c5f61725df50372eeed9d78ca44bd9c81b469d75d2ce1765bcc71fb198a4caad424e2b06a0a7eeafbb83a2f31de9980e847ec94c5f3d12098d9cedec9309c336bac2f5e31dadd5fc24d5bf8973803631a0d561770d540", 0x59}, {&(0x7f00000005c0)="82a3cf865335b968395f264e902fc697bfc902a962640200669a6f0f98aaf2fcd3695245fc8a1a65bef8e5ce73317e05bb3a875ce0d3116bab5ffb523e27512309705f20c8c698212e37dd82d2eb3673c436bd4a2fb0b79accbdf558c23e7c12e820cdab3738e59d7b521cabea97922c53eb751bb485a96c11f3058d3c2aac5ccb4d80c446216ec6f5f0be14dd7dd9d61d65bbf0f28d418c09e5ac5f8eed0dfec7b4c78a6974a6a5e8b4dc44fd6557453137", 0xb2}, {&(0x7f0000000300)="14ae033c0accc419f730fda59817050130373e753ddfb1ca260bd1cdede57487eb6e2b6c27747f565dacde69f257602bc616ad761d24ad0322a1fbeeb7d097f26e2882db47ca9c8b426c85ddae5dd445c73251", 0x53}], 0x3, 0x0, 0x0, 0x10}], 0x1, 0x10) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000480)) unshare(0x60000) statx(0xffffffffffffffff, &(0x7f00000003c0)='./control/file0\x00', 0x0, 0x0, &(0x7f00000004c0)) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000280), &(0x7f00000002c0)=0x18) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000080)='vmnet0cpuseteth0self]posix_acl_access\x00'}, 0x10) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f00000001c0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000000)='./control/file0\x00', 0x0) mount(&(0x7f0000000680)=ANY=[@ANYBLOB="f1d18b37eec30fb5c1e77365b32601dd068044f94456950dc9375c2865ddf5e9d39eb38803ebcb0c06c3cd837763018805bc8fbcd3b58cc3a504fb7ac6ad1ae9ac53085aa5119439570ce5ddd94c7891845419ed56293e64369c8fe162638e74d507c9ddd0c8c1aa4c2c58dfedce7de281cf911bc73cee9aad89dbe8e25446ea1f4b64b0f3382af94006280116d86b0018a222e300c33b5e6b59086731560ac8eadeb175f15878caf0878a41b57601564beefa34265a63e8de7a29015e0d4198ae1226860aae0ed0255d8b92a5bf91c9c60000000000"], &(0x7f0000000380)='./control/file0\x00', &(0x7f0000000140)='sysv\x00', 0x1000, &(0x7f0000000240)) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000200)='./control/file0\x00') close(r1) 15:57:23 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() ioctl$sock_inet_SIOCSIFBRDADDR(r0, 0x891a, &(0x7f0000000040)={'syz_tun\x00', {0x2, 0x4e21, @local}}) sched_setscheduler(r1, 0x5, &(0x7f0000000000)) 15:57:23 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x600, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:23 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0xf000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:23 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x400000000000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/rtc0\x00', 0x101000, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000480)={{{@in=@multicast1, @in6=@mcast2}}, {{@in=@broadcast}, 0x0, @in6}}, &(0x7f0000000280)=0xe8) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000008000000000000000018000000000000000800000000000000", @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYBLOB="1a000000417fec", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) r2 = dup2(r0, r0) syz_open_dev$sndseq(&(0x7f00000000c0)='/dev/snd/seq\x00', 0x0, 0x4000) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) write$sndseq(r2, &(0x7f0000000040)=[{0xf95, 0x9, 0x98a4, 0x1, @tick=0x5, {0x4044, 0x1ff}, {0x80, 0xef41}, @raw8={"21a4951d24926f8c36169a12"}}], 0x1c) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1d9389db7ea13e592066e38dacd530630b3ec7fc86d804533e99ee66b09e5d74889aa9ac4a282a62ffd9961b62b55e104b44ca9dac3806b6f988077db8bbbf4b35c3170e"], 0x0, 0x0, &(0x7f0000000500)}) 15:57:23 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0xb00, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:23 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0xffffff7f}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:23 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x3f00000000000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 325.939540] binder: 16547:16548 unknown command -611740899 [ 325.970002] binder: 16547:16548 ioctl c0306201 20000080 returned -22 [ 325.983459] binder: BINDER_SET_CONTEXT_MGR already set [ 326.007150] binder: 16547:16563 ioctl 40046207 0 returned -16 [ 326.022213] binder: 16547:16563 unknown command -611740899 [ 326.047022] binder: 16547:16563 ioctl c0306201 20000080 returned -22 15:57:24 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:24 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x300, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:24 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x7000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:24 executing program 5: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) io_setup(0x8, &(0x7f0000000140)=0x0) r2 = socket(0x1e, 0x1000000000005, 0x0) sendmsg(r2, &(0x7f0000db5fc8)={&(0x7f00004aeb5c)=@ipx={0x4, 0x7d2, 0xf6, "b43ba2f842fa", 0x1ff}, 0x80, &(0x7f0000000300), 0x0, &(0x7f0000000640)}, 0x0) io_submit(r1, 0x1400, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000140), 0x5ee}]) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000040)={'sit0\x00', 0x1000}) 15:57:24 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e23, @broadcast}}, 0x100000000}, &(0x7f0000000000)=0x88) socket$inet(0x2, 0x8000f, 0x1) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000080)={r1, 0x6, 0x7f}, &(0x7f00000000c0)=0x8) r2 = syz_open_dev$vcsa(&(0x7f00000002c0)='/dev/vcsa#\x00', 0x3ff, 0x400000) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000300)={0xffffffffffffffff}, 0x13f, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r2, &(0x7f0000000380)={0x9, 0x108, 0xfa00, {r3, 0x70, "bb1b6c", "710490d320812649846b622e1efaf22c7ac28e76a067d74296cd06e04151b17a4c7632aa3e77d1739e5de6829989a7766bcf629ba2cb6cbb299877f04c9a37371b6c0e4aad94311b3c8708bbe7ea0bbb373974cf9479041e055b4a709d648a6314aa52ac8b18260aee2c67e4a16c42e380208f7fe5b161ef996b2a19f1e23095a98c0a502830e657902008d3438f73bebf71e4ab35553dbc2345f9ce343e04837d6812fc28b642b9584fafeb33fcc058f978ad60134914c29b011f3e720e5121b617bbee73daf738beb30a645d007e1df612cb843fd78f7de6d1e114d0a185b4e6a483ec71426213129d2a035943132388dd43f1f31b79ed00f58b307e6ea736"}}, 0x110) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r4 = getpid() sched_setscheduler(r4, 0x5, &(0x7f0000000040)=0x1000000000000004) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000140)=ANY=[@ANYBLOB="e0000001ac1414aa0000000006000000f8ebd7aa643e8bcaea2fac8f1a92c15a3df1e8c620ffc29024afa0eac0d9d89dc16c87563afc3a4a2a29b0bc2780e6a6484f5f125020550f7b6331b614d5f11b87135fdb51bf0685cefa352369c69037da8d69a17d1f4daa4cb1f5cb1707be9cf238aa4e99ae933f8768feb7d9710822960e9604d6489e1d94b78242576eae23df15df338621d6b034fc53383fcb6e5575"], 0x10) 15:57:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = dup2(r1, r0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_SET_SERVICE(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[@ANYBLOB="18010000", @ANYRES16=r3, @ANYBLOB="200227bd7000ffdbdf25020000003000010008000b0073697000080005000400000008000b00736970000c0006006c626c6372000000080006000008000000000000ffffffff08000500090000006000020008000600f9ffffff080006000400000008000300020000000800080000000000080009008400000014000100ff01000000000000000000000000000108000700070000000800090005000000080002004e240000080004000600000024000100080009006700000008000b0073697000080004004e20000008000600776c630008000400070000000c0002000800030000000000140002000800060097000000080002004e2300001800030014000600ff020000000000000000000000000001"], 0x118}, 0x1, 0x0, 0x0, 0x4000}, 0x20000010) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:57:24 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x48, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:24 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x54000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:24 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x6}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:24 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x508}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:24 executing program 5: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x7000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:24 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x7, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 326.618010] binder_alloc: binder_alloc_mmap_handler: 16591 20001000-20004000 already mapped failed -16 15:57:24 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 326.666314] binder: BINDER_SET_CONTEXT_MGR already set [ 326.686314] binder: 16591:16595 ioctl 40046207 0 returned -16 15:57:24 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0xf601, 0x0, 0x4}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000002800012200001aaf6664a31213a72ca9"], 0x1}}, 0x0) [ 326.725640] binder_alloc: 16591: binder_alloc_buf, no vma 15:57:24 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)=ANY=[@ANYBLOB="e0000001ac1443e9e992c28b19d30000"], 0x10) 15:57:24 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0xffffffff00000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 326.773643] binder: 16591:16610 transaction failed 29189/-3, size 24-8 line 2970 15:57:24 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x600000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x240200, 0x0) r3 = getegid() ioctl$TUNSETGROUP(r2, 0x400454ce, r3) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$inet_udplite(0x2, 0x2, 0x88, &(0x7f0000000140)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r1, r0) ftruncate(r2, 0x6) ioctl$BLKGETSIZE64(r2, 0x80041272, &(0x7f00000000c0)) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="0400040000b13529"], 0x0, 0x0, &(0x7f0000000500)}) 15:57:24 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0xb, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 326.915489] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:24 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000040)) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) r2 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x24f6, 0x400200) unlinkat(r2, &(0x7f00000002c0)='./file0\x00', 0x200) ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000300)={'nr0\x00', {0x2, 0x4e23, @broadcast}}) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000140)=ANY=[@ANYBLOB="e0000001ac1414aa0000000006000000349f0f29dbbe792b48f15772374ddc0e7c029b5ecd09769c2c4a01b45db728bba18efddf72d5f887f365038798871fb4cf139a688d00857356a6eb280a2dfe4a1fabd8e8618a4e67fc79be0e8a30fd04fe0c3c4a61f630f955e988e23659e9d6c326def81fc0adb5979554cd08e8827ef35b50dac73c25a2ed2763924845834a8d"], 0x10) openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ppp\x00', 0x80, 0x0) ioctl$sock_inet_SIOCADDRT(r2, 0x890b, &(0x7f0000000240)={0xec8, {0x2, 0x4e23, @broadcast}, {0x2, 0x4e23, @rand_addr=0x80000001}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0xf}}, 0x2c0, 0x0, 0x5, 0xe00, 0x9, &(0x7f0000000200)='erspan0\x00', 0x7ff, 0x8, 0x6}) [ 326.974232] binder: BINDER_SET_CONTEXT_MGR already set 15:57:24 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x9, 0x40) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r1, 0x800442d2, &(0x7f0000000040)={0x8, &(0x7f0000000140)=[{0x0, 0x0, 0x0, @random}, {0x0, 0x0, 0x0, @random}, {0x0, 0x0, 0x0, @random}, {}, {0x0, 0x0, 0x0, @link_local}, {0x0, 0x0, 0x0, @remote}, {0x0, 0x0, 0x0, @remote}, {0x0, 0x0, 0x0, @dev}]}) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000080)=@nat={"6e617407fffffe00", 0x19, 0x2, 0x294, [0x20000340, 0x0, 0x0, 0x20000370, 0x200004dc], 0x0, &(0x7f0000000100), &(0x7f0000000340)=ANY=[@ANYBLOB="000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0100000011000000000000000000726f73653000000000000000000000006263736830000000000000000000000076657468315f746f5f6272696467650062707130000000000000000000000000aaaaaaaaaabb000000000000aaaaaaaaaabb0000000000000000e40000000c0100003c01000074696d6500000000000000000000000000000000000000000000000000000000180000000000000000000000000000000000000000000000007e00007374617469737469630000000000000000000000000000000000000000000000140000000000000000000000000000000000000000000000434c4153534946590000000000000000000000000000000000000000000000000400000000000000736e6174000000000000000000000000000000000000000000000000000000000c000000aaaaaaaaaaaa00000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000ffffffff01000000090000000000000000000300616d30000000000000000001000073797a6b616c6c65723100000000000073797a6b616c6c65723000000000000076657468315f746f5f626f6eff000000aaaaaaaaaabb000000000000aaaaaaaaaa0000000000000000007000000070000000980000004155444954000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000feffffff0000000000000000000000000000"]}, 0x2e4) openat$autofs(0xffffffffffffff9c, &(0x7f0000000280)='/dev/autofs\x00', 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000240)={r1, r1, 0xf, 0x3}, 0x10) [ 326.997879] binder: 16636:16637 ioctl 40046207 0 returned -16 [ 327.009374] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 327.027214] binder_alloc: 16591: binder_alloc_buf, no vma 15:57:24 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x4000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:25 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x4000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 327.057124] binder: 16636:16637 transaction failed 29189/-3, size 24-8 line 2970 [ 327.124574] binder: 16636:16637 unknown command 262148 15:57:25 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x6000000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:25 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f000007d000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) rt_sigprocmask(0x0, &(0x7f00001b6ff8)={0xfffffffffffffffe}, 0x0, 0x8) r3 = memfd_create(&(0x7f0000000000)='dev ', 0x0) ftruncate(r3, 0x40001) sendfile(r0, r3, &(0x7f000000a000), 0x2) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f0000000040)={0x2818, 0x66, 0x8, 0x7, 0x3, 0x7fffffff, 0x3602, 0x9, 0x0}, &(0x7f0000000080)=0x20) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r2, 0x84, 0x1b, &(0x7f00000000c0)={r4, 0xc0, "e6b5ffbb440d1c5e0e27d6908e7b25b0b8f8ab668c1918ed1131848191636d8f0720419f1a7416438e60da69fae1c5a76b1c8c113507275ef792c5004865ce8b679f00de14ecd4033e29f84afcb28ebd963866e5ab976e7b6a74566850bc51329a3760439cd0d8f656f12adce33d1e7e542d647fe088ac50e6a1f9c18e8690e7dcee2c76b3f6eaed53844e25ed54fb200876844637309f99955c181aa7688cdc56744cc1430b8682d378d9bb83f8bad379bcebc8109efa22d7d17ec1122d6da3"}, &(0x7f00000001c0)=0xc8) [ 327.146014] binder: 16636:16637 ioctl c0306201 20000080 returned -22 15:57:25 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x4800, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:25 executing program 5: clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r0 = getpid() bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000040)=0x8001, 0x4) sched_setscheduler(r0, 0x5, &(0x7f0000000000)) request_key(&(0x7f0000003e80)='trusted\x00', &(0x7f0000003ec0), 0xffffffffffffffff, 0xfffffffffffffff9) 15:57:25 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x8, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 327.188513] binder_alloc: binder_alloc_mmap_handler: 16636 20001000-20004000 already mapped failed -16 [ 327.206891] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 327.269356] binder: BINDER_SET_CONTEXT_MGR already set [ 327.304638] binder: 16636:16664 ioctl 40046207 0 returned -16 15:57:25 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0xf00000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 327.346187] binder_alloc: 16591: binder_alloc_buf, no vma [ 327.362095] binder: 16636:16640 transaction failed 29189/-3, size 24-8 line 2970 15:57:25 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x3000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:25 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x5c00, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$SNDRV_TIMER_IOCTL_STOP(r2, 0x54a1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:57:25 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) r1 = fcntl$getown(r0, 0x9) ptrace$cont(0x7, r1, 0xd11, 0x6) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f000000a540)='/dev/rfkill\x00', 0x2000, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r3, 0xc08c5334, &(0x7f000000a580)={0x421, 0x0, 0x9, 'queue1\x00', 0xffff}) r4 = socket$netlink(0x10, 0x3, 0x0) fanotify_init(0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000009c0)={'ip6tnl0\x00'}) sendmsg$nl_route(r4, &(0x7f000001bfc8)={&(0x7f0000016000), 0xc, &(0x7f000000b000)={&(0x7f0000000a00)=ANY=[@ANYBLOB="000000000000000008001b000000000008002b0004000200"], 0x1}}, 0x0) r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x414102, 0x0) ioctl$FICLONERANGE(r2, 0x4020940d, &(0x7f000000a500)={r5, 0x0, 0x3e21, 0x528, 0x9aa}) mmap$binder(&(0x7f000022b000/0x3000)=nil, 0x3000, 0x0, 0x10, r5, 0x40000001) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x0, &(0x7f00000000c0), 0x1, 0x2000000000002) recvmmsg(r0, &(0x7f000000a340)=[{{&(0x7f0000000040)=@pppoe={0x18, 0x0, {0x0, @dev}}, 0x80, &(0x7f0000000280)=[{&(0x7f0000001480)=""/4096, 0x1000}, {&(0x7f0000000100)=""/200, 0xc8}, {&(0x7f0000000200)=""/52, 0x34}, {&(0x7f0000000240)=""/49, 0x31}, {&(0x7f0000002480)=""/4096, 0x1000}], 0x5, &(0x7f0000003480)=""/4096, 0x1000, 0x3ff}, 0xffffffffbdb5b92d}, {{&(0x7f00000002c0)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000340)=""/4, 0x4}], 0x1, &(0x7f0000004480)=""/80, 0x50, 0xad3e}, 0x80}, {{&(0x7f0000004500)=@vsock={0x28, 0x0, 0x0, @reserved}, 0x80, &(0x7f0000006880)=[{&(0x7f0000004580)=""/235, 0xeb}, {&(0x7f0000004680)=""/89, 0x59}, {&(0x7f0000004700)=""/166, 0xa6}, {&(0x7f00000047c0)=""/4096, 0x1000}, {&(0x7f00000057c0)=""/4096, 0x1000}, {&(0x7f00000067c0)=""/173, 0xad}], 0x6, &(0x7f00000068c0)=""/35, 0x23, 0x1}, 0x2}, {{&(0x7f0000006900)=@xdp, 0x80, &(0x7f0000007cc0)=[{&(0x7f0000006980)=""/195, 0xc3}, {&(0x7f0000006a80)=""/233, 0xe9}, {&(0x7f0000006b80)=""/61, 0x3d}, {&(0x7f0000006bc0)=""/223, 0xdf}, {&(0x7f0000006cc0)=""/4096, 0x1000}], 0x5, &(0x7f0000007d00)=""/222, 0xde, 0xfffffffffffffff8}, 0x3ff}, {{0x0, 0x0, &(0x7f0000008040)=[{&(0x7f0000007e00)=""/211, 0xd3}, {&(0x7f0000007f00)=""/104, 0x68}, {&(0x7f0000007f80)=""/175, 0xaf}], 0x3, &(0x7f0000008080)=""/90, 0x5a, 0x9}, 0x5}, {{&(0x7f0000008100), 0x80, &(0x7f0000008300)=[{&(0x7f0000008180)=""/132, 0x84}, {&(0x7f0000008240)=""/158, 0x9e}], 0x2, &(0x7f0000008340)=""/135, 0x87, 0x7}, 0x666}, {{&(0x7f0000008400)=@generic, 0x80, &(0x7f00000084c0)=[{&(0x7f0000008480)=""/33, 0x21}], 0x1, &(0x7f0000008500)=""/38, 0x26, 0x2}, 0x7ff}, {{&(0x7f0000008540)=@l2, 0x80, &(0x7f0000009940)=[{&(0x7f00000085c0)=""/153, 0x99}, {&(0x7f0000008680)=""/71, 0x47}, {&(0x7f0000008700)=""/162, 0xa2}, {&(0x7f00000087c0)=""/18, 0x12}, {&(0x7f0000008800)=""/123, 0x7b}, {&(0x7f0000008880)=""/157, 0x9d}, {&(0x7f0000008940)=""/4096, 0x1000}], 0x7, &(0x7f0000009980)=""/104, 0x68, 0x2}, 0xc6f}, {{0x0, 0x0, &(0x7f0000009b80)=[{&(0x7f0000009a00)=""/116, 0x74}, {&(0x7f0000009a80)=""/51, 0x33}, {&(0x7f0000009ac0)=""/138, 0x8a}], 0x3, &(0x7f0000009bc0)=""/147, 0x93, 0x400}, 0x6}, {{&(0x7f0000009c80)=@l2, 0x80, &(0x7f000000a240)=[{&(0x7f0000009d00)=""/70, 0x46}, {&(0x7f0000009d80)=""/190, 0xbe}, {&(0x7f0000009e40)=""/153, 0x99}, {&(0x7f0000009f00)=""/179, 0xb3}, {&(0x7f0000009fc0)=""/64, 0x40}, {&(0x7f000000a000)=""/140, 0x8c}, {&(0x7f000000a0c0)=""/188, 0xbc}, {&(0x7f000000a180)=""/191, 0xbf}], 0x8, &(0x7f000000a280)=""/185, 0xb9, 0x40}, 0x7fffffff}], 0xa, 0x1, &(0x7f000000a480)={0x77359400}) sendmsg(r0, &(0x7f00000003c0)={&(0x7f0000000400)=@generic={0x3, "dfb643ef1bdf412da010d4c6963f2a772df25c6bb650a3c4421cc6a60f1403e4e25201ae6e7db85f113e67301c1c6591c1a4d0c8b70ca25500b26f28153080c8be2fd86e088390e0dae11248b427016c0d2dc3e0b6498eb11b213f5dfcae56d640a94000f4615e71f4e65f818bd6ab07f64c7a953ee0e707d919e3e7326b"}, 0x80, &(0x7f0000000300), 0x4, &(0x7f0000000340), 0x7c, 0x20000810}, 0x0) setsockopt$inet6_icmp_ICMP_FILTER(r5, 0x1, 0x1, &(0x7f000000a4c0)={0x5}, 0x4) getrandom(&(0x7f0000000480)=""/4096, 0x1000, 0x2) socket$key(0xf, 0x3, 0x2) fcntl$setown(r4, 0x8, r1) 15:57:25 executing program 5: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000200)) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000200)='/dev/sequencer2\x00', 0xec3cb9ac915778ed, 0x0) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f0000000740)={@ethernet={0x0, @dev={[], 0x16}}, {&(0x7f0000000680)=""/183, 0xb7}, &(0x7f0000000300), 0x3}, 0xa0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)="2e2f6367726f75d9b6b75fe363a04b60d98b", 0x1ff) ioctl$VHOST_SET_VRING_BUSYLOOP_TIMEOUT(r0, 0x4008af23, &(0x7f00000005c0)={0x3, 0x7f7}) io_setup(0x9, &(0x7f0000000380)=0x0) io_destroy(r1) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000340)='./cgroup.cpu/syz1\x00', 0x1ff) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000b40)='/dev/loop-control\x00', 0x100, 0x0) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, 0x0) ioctl$SG_GET_PACK_ID(0xffffffffffffffff, 0x227c, &(0x7f0000000140)) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000900)='IPVS\x00') sendmsg$IPVS_CMD_NEW_SERVICE(r0, &(0x7f0000000b00)={&(0x7f0000000440), 0xc, &(0x7f0000000ac0)={&(0x7f0000000940)={0x180, r3, 0xb10, 0x70bd2a, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2}, @IPVS_CMD_ATTR_DAEMON={0x60, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'vcan0\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @remote}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14}]}, @IPVS_CMD_ATTR_DEST={0x58, 0x2, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x1}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x7}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x8}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x2}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x8}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x6}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}]}, @IPVS_CMD_ATTR_DEST={0x24, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e23}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x80000001}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e24}]}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x38}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'ovf\x00'}]}, @IPVS_CMD_ATTR_SERVICE={0x30, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x10, 0x1}}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x4}, @IPVS_SVC_ATTR_PROTOCOL={0x8}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e22}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7}, @IPVS_CMD_ATTR_DAEMON={0x2c, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x10}}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x800}]}, 0x180}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) perf_event_open(&(0x7f0000000240)={0x3, 0x70, 0x9, 0x2, 0x11, 0xfffffffffffff722, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x64ca1839, 0x0, 0x0, 0x7, 0x7fff, 0x80, 0x7f, 0x7, 0x20, 0x4, 0x7f, 0x9, 0x8, 0x0, 0x100000000, 0x0, 0x0, 0xffffffffffffd5c2, 0x4, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, @perf_bp={&(0x7f0000000040), 0x8}, 0x8026, 0x5, 0x0, 0x1, 0x7, 0xfffffffffffffff8, 0x9}, 0x0, 0xc, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x800, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0x7, &(0x7f00000003c0), &(0x7f00000008c0)=0x4) ioctl$LOOP_GET_STATUS(0xffffffffffffffff, 0x4c03, &(0x7f0000000800)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000080)={0x0, r0, 0x2, 0x1}, 0x14) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000640)={&(0x7f0000000600)='\x00', r0}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000540)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000400)={0xffffffffffffffff}, 0x111, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r0, &(0x7f0000000580)={0x1, 0x10, 0xfa00, {&(0x7f00000000c0), r4}}, 0x18) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000040)=@req3={0x80000000}, 0x94) ioctl$LOOP_CTL_ADD(r2, 0x4c80, 0x0) utime(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000100)={0x0, 0x6}) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0x40a45323, &(0x7f0000000480)={{0x80000000000000, 0xffffffff}, "706f72743100000000000000000000000000000a972db50000000000000000000000000000000000000000000000000000000000ffffffffffffffff00", 0x20, 0x100000, 0x5, 0x5, 0x0, 0xf6b8, 0xffffffffffffffff}) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000000)) [ 327.503782] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 327.515556] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 327.559548] binder: BINDER_SET_CONTEXT_MGR already set 15:57:25 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x100000000000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:25 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x40000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 327.597182] binder: 16690:16691 ioctl 40046207 0 returned -16 [ 327.637470] binder_alloc: 16591: binder_alloc_buf, no vma 15:57:25 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x5400000000000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 327.683738] binder: 16690:16691 ioctl 54a1 0 returned -22 [ 327.707404] binder: 16690:16691 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 327.761828] binder: undelivered TRANSACTION_ERROR: 29189 [ 327.774279] binder: 16690:16695 transaction failed 29189/-3, size 24-8 line 2970 [ 327.784356] binder_alloc: binder_alloc_mmap_handler: 16690 20001000-20004000 already mapped failed -16 15:57:25 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0xb000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:25 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x500000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:25 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x600000000000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 327.833055] binder: undelivered TRANSACTION_ERROR: 29189 [ 327.848899] binder: BINDER_SET_CONTEXT_MGR already set 15:57:25 executing program 5: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) poll(&(0x7f0000000000)=[{r0}], 0x1, 0xffffffffffffffe1) close(r0) vmsplice(r1, &(0x7f0000002640)=[{&(0x7f00000025c0)="d5", 0x1}], 0x1, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000080)) close(r1) [ 327.886653] binder: 16690:16691 ioctl 40046207 0 returned -16 [ 327.890039] binder: undelivered TRANSACTION_ERROR: 29189 [ 327.906099] binder: undelivered TRANSACTION_ERROR: 29189 [ 327.911651] binder: send failed reply for transaction 877 to 16591:16595 [ 327.925334] binder: 16690:16710 transaction failed 29189/-22, size 24-8 line 2855 [ 327.959895] binder: 16690:16695 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 327.969235] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 327.985394] binder: undelivered TRANSACTION_ERROR: 29189 [ 327.991956] binder: 16690:16691 ioctl 54a1 0 returned -22 15:57:25 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x7000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 328.007132] binder: undelivered TRANSACTION_COMPLETE 15:57:25 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x6000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 328.031885] binder: undelivered TRANSACTION_ERROR: 29189 15:57:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000000040)=0x5, 0x38f) ioctl$BLKGETSIZE64(r1, 0x80041272, &(0x7f00000000c0)) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r1) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000240)=0x0) write$P9_RGETLOCK(r1, &(0x7f00000002c0)={0x2b, 0x37, 0x1, {0x2, 0x8, 0x0, r3, 0xd, '/dev/binder#\x00'}}, 0x2b) ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f0000000280)=r3) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000200)=0x0) write$cgroup_int(r1, &(0x7f0000000380)=0x81, 0x12) getpriority(0x2, r4) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0, &(0x7f0000000180)}) bind(r1, &(0x7f0000000300)=@vsock={0x28, 0x0, 0x2710, @my=0x1}, 0x80) r5 = dup2(r2, r0) ioctl$LOOP_CLR_FD(r5, 0x4c01) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="3c704207200c4d9aca09849d12597caf613374a55af44cc84dfe8e1762eb00b2a98c61476f571b16c5b89f005b6ba1bce7012beee0223a4b8a344c1d440847367fe3ed0e4fc5ba8967765c8d5ebc67cbe030e1bb96824c9da6d2b03a80e89c35a9127905d1370c1d"], 0x0, 0x0, &(0x7f0000000500)}) [ 328.252137] binder: 16731:16732 ioctl 80041272 200000c0 returned -22 [ 328.268297] binder: 16731:16732 ioctl 2405 4 returned -22 [ 328.276907] binder: 16731:16732 ioctl 5429 20000240 returned -22 [ 328.284038] binder: 16731:16732 ioctl 8901 20000280 returned -22 [ 328.290892] binder: 16731:16732 ioctl 8903 20000200 returned -22 [ 328.299948] binder: 16731:16732 ioctl 4c01 0 returned -22 [ 328.306887] binder: 16731:16732 unknown command 121794620 [ 328.312993] binder: 16731:16732 ioctl c0306201 20000080 returned -22 [ 328.321483] binder: 16731:16732 ioctl 80041272 200000c0 returned -22 [ 328.328858] binder: 16731:16734 ioctl 2405 7 returned -22 [ 328.330132] binder: 16731:16735 ioctl 5429 20000240 returned -22 [ 328.341499] binder: 16731:16736 ioctl 8901 20000280 returned -22 [ 328.349765] binder: BINDER_SET_CONTEXT_MGR already set [ 328.355684] binder: 16731:16737 ioctl 40046207 0 returned -16 [ 328.361883] binder: 16731:16732 ioctl 8903 20000200 returned -22 [ 328.370178] binder: 16731:16735 ioctl 4c01 0 returned -22 [ 328.376005] binder: 16731:16736 unknown command 121794620 [ 328.383117] binder: 16731:16736 ioctl c0306201 20000080 returned -22 15:57:27 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000001000)={{0x100000001}}) r1 = syz_open_dev$sndtimer(&(0x7f0000022ff1)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f000000efcc)={{0x100000001}}) utimes(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={{0x0, 0x7530}}) ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000000)={{0x0, 0x3, 0x2, 0x3}}) dup3(r1, r0, 0x0) 15:57:27 executing program 5: r0 = socket$inet(0x2, 0x3, 0x4) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000340)=[{0x6}]}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000100)=ANY=[@ANYBLOB="0180c2000000e2701bb6000000000004907800000000fff7ffff00009078e00000010000000000000000b94947682b1e2b04b60673e80559ae0a71624f786270fbd7dfea38e62d7cf914a3985a8be0a5234e11a862edc74b47b65c63c18ab40b8fcfd89bc48871e83a00f81faaece5758391ad3b596cef5b08a806cb8d43f68da5d4691487e4179c9eb171531b03beed58496e8160e79ffeed7836ebc7c2d20911f535e25732fcdca3872759492de8c0c2db58571f251435215e09a25c84354ba344e4836181309871abc36f8e93a76fa45b0f4556141d4d99ffa5d7888bb01910c40d30e9d3e211e3cf1dfa9bc956aeab717cfeb9c1e2f9d7f539a3be0e9a30d42a4ca504c9be06"], &(0x7f00000000c0)) r1 = syz_open_dev$amidi(&(0x7f0000000380)='/dev/amidi#\x00', 0x9, 0x101000) ioctl$DRM_IOCTL_ADD_CTX(r1, 0xc0086420, &(0x7f00000003c0)) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f00000002c0), &(0x7f0000000300)=0x4) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0xffffffffffffffe1) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000240)={'raw\x00'}, &(0x7f0000000080)=0x54) 15:57:27 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x4000000000000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:27 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x2000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:27 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x4000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x200000, 0x20) ioctl$TUNSETVNETHDRSZ(r2, 0x400454d8, &(0x7f00000000c0)) dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:57:27 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0xb00, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 329.292976] binder: release 16744:16745 transaction 887 out, still active [ 329.299959] binder: unexpected work type, 4, not freed [ 329.306223] binder: invalid inc weak node for 888 [ 329.311096] binder: 16744:16745 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 329.334281] binder: undelivered TRANSACTION_COMPLETE 15:57:27 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x805}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 329.347922] binder_alloc: binder_alloc_mmap_handler: 16744 20001000-20004000 already mapped failed -16 [ 329.369762] binder: BINDER_SET_CONTEXT_MGR already set [ 329.391451] binder: 16744:16745 ioctl 40046207 0 returned -16 15:57:27 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x800000000000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:27 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0xf0}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 329.416448] binder_alloc: 16744: binder_alloc_buf, no vma [ 329.452969] binder: send failed reply for transaction 887, target dead 15:57:27 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000440)='/proc/sys/net/ipv4/vs/sync_retries\x00', 0x2, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000008c0)={{{@in=@remote, @in6}}, {{@in6=@dev}, 0x0, @in6=@mcast2}}, &(0x7f00000009c0)=0xe8) sendmsg$nl_generic(r1, &(0x7f0000001ec0)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x4080000}, 0xc, &(0x7f0000001e80)={&(0x7f0000000600)=ANY=[@ANYBLOB="dadcfd938b94bc0175e1268a4ea64226013aaa67da0011e7c505ba0b85e218455e7a7bf1ffea2be81add000000000000000000000000003ddf4008e6ecdf2b4e67f7abe86a7fe43b90ab760ea47ec3155de57bcafa9eae2a024a42e0a22c5e66b0410630ba17b552362e9e229ad5236fc10160a5fa1b48e82155012ccf6d641724d2ca15ddee0ba292a939c2f30cc54c319b469c6c22dad63ddaa15dc9cfdeef998fcc89cf3d0810b1111639e011ded34083cb422bc94e1056fe20f28c4f9d20845a35c38a"], 0x1}, 0x1, 0x0, 0x0, 0x80}, 0x40) bind$inet(r0, &(0x7f0000b9bff0)={0x2, 0x2004e21}, 0x10) r2 = socket$nl_generic(0xa, 0x5, 0x84) ioctl$sock_SIOCETHTOOL(r2, 0x89f1, &(0x7f0000000180)={'ip6gre0\x00', &(0x7f0000000200)=ANY=[@ANYBLOB="0000000000000001000000bae5f81571ca"]}) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x0, &(0x7f0000000380)={@remote, 0x0}, &(0x7f00000003c0)=0x14) r4 = dup2(r0, r0) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r4, 0xc058534b, &(0x7f00000007c0)={0x0, 0xfff, 0x8, 0x7, 0x2, 0x5}) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000140), &(0x7f00000004c0)=0x4) setsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000400)={r3, @loopback, @rand_addr=0x1cb}, 0xc) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffff9c, 0x84, 0x13, &(0x7f0000000000)={0x0, 0xa8}, &(0x7f0000000040)=0x8) getsockopt$ARPT_SO_GET_INFO(r4, 0x0, 0x60, &(0x7f0000000700)={'filter\x00'}, &(0x7f00000001c0)=0x7) r6 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00') fcntl$notify(r6, 0x402, 0x13) openat$fuse(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/fuse\x00', 0x2, 0x0) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x21, &(0x7f00000000c0), &(0x7f0000000100)=0x4) exit(0x0) getdents64(r6, &(0x7f0000000340)=""/57, 0x39) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r6) r7 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sys/net/ipv4/vs/snat_reroute\x00', 0x2, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r7, 0x84, 0xf, &(0x7f0000000280)={r5, @in6={{0xa, 0x4e20, 0x1ff, @local, 0x1}}, 0x9, 0x7, 0x8, 0x5, 0x4}, &(0x7f0000000340)=0x98) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000080)={r5, 0x9, 0x20}, &(0x7f00000000c0)=0xc) sendto$inet(r0, &(0x7f0000fa0fff), 0xffffffffffffffbb, 0x20020003, &(0x7f0000385ff0)={0x2, 0x4e21, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r7, 0x84, 0xc, &(0x7f0000000840), &(0x7f0000000480)=0x1) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000080)='lp\x00', 0x3) write$binfmt_elf32(r0, &(0x7f0000000a00)=ANY=[@ANYBLOB="7f454c4603da090705000000000000000300000087000000fe00000038000000e4000000010000000700200001000000cb08010000000000000000000900000003000000050000000600000008000000050000000100000001000070990a0000c59e000005000000010000008100000000000000090000003a27da8c661cfa3de026f4b96557b012a90c8719baebfce353e249d60268bbb53c6164acfa37550dc6a5b8d45e75e45c39d979287d3432a85ffb23c2f46976cff9a9d6bf49021f7204fd58a323c201d34c95283e8b260c660b6639335c66f6a948d5488732e60224e2ef302b59b4934858241cdf96fd124bee7431d93354755ec9b374ab74141f8e19520e7b"], 0xf9) shutdown(r4, 0x1) [ 329.454155] binder: 16744:16754 transaction failed 29189/-3, size 24-8 line 2970 15:57:27 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0xfffffffe, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 329.515998] binder: undelivered TRANSACTION_ERROR: 29189 15:57:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x10000, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000180)={0x0, 0x0}, &(0x7f00000001c0)=0xc) lstat(&(0x7f0000000280)='./file0\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_ENTRY(r2, &(0x7f0000000480)={0x90, 0x0, 0x5, {0x4, 0x0, 0xfffffffffffffff9, 0x5, 0x7fff, 0x100000001, {0x5, 0x0, 0xbc1, 0x80000000, 0x7, 0xf50, 0x7, 0x6, 0x800, 0x3ff, 0x401, r3, r4, 0x1, 0xffff}}}, 0x90) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r5 = dup2(r1, r0) fcntl$setflags(r5, 0x2, 0x1) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f0000000040)={0x0, 0x80000, r5}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r5, 0xc00c642d, &(0x7f00000000c0)={r6, 0x80000, r5}) ioctl$FS_IOC_FSSETXATTR(r2, 0x401c5820, &(0x7f00000002c0)={0xfffffffffffffffd, 0x7248, 0x1000, 0x2, 0x2}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) getsockopt$inet_sctp6_SCTP_CONTEXT(r5, 0x84, 0x11, &(0x7f0000000400)={0x0, 0xe524}, &(0x7f0000000540)=0x8) getsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f0000000580)={r7, 0xfff}, &(0x7f00000005c0)=0x8) 15:57:27 executing program 5: socketpair$inet(0x1e, 0x1, 0x0, &(0x7f0000000280)={0x0, 0x0}) write$binfmt_script(r1, &(0x7f0000000080)=ANY=[@ANYRESHEX], 0x3ac) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040)={0xffffffffffffffff}, 0x111, 0xf}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r2, &(0x7f0000000380)={0x9, 0x108, 0xfa00, {r3, 0x16, "eef000", "c60951dff217f48fd9637d0dad07f69fb1a4fdb4b9572f3df2693728f5f27dbb6b4995f10040dc3ba5a3f4324ee2bb83194c05eab4669168705748cef2831be0bb8effac8470467f837a50e74924de060c43e11d894fd9c8ebf570020656876c4b788f2ad566c092b34b5afbdaa5555d93c26f9d8af13d15ccb7a0878e7bcff4e2b041fe0ef17e8ba3ecda390e874756a37f44bb538705c8b63525fe775d8e423143bf2de0b36ccf9f818592a061d190bc0528acd5e57bfed1ef85e2dd8c65ccaef82dba0bec97444b131b48443e34fa9576e348acbc6cbd2c447bd1ce23bbeb4dda1800b87ddcb523a1a4ab99be285bc1ec438de114a218333400ffedba5296"}}, 0x110) recvmmsg(r0, &(0x7f0000005b80)=[{{&(0x7f0000005440)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, 0x80, &(0x7f00000000c0)=[{&(0x7f00000001c0)=""/163, 0xa3}], 0x1, &(0x7f0000005640)=""/190, 0xbe}}, {{&(0x7f0000005700)=@ipx, 0x80, &(0x7f00000014c0)=[{&(0x7f00000002c0)=""/148, 0x94}], 0x1}}], 0x2, 0x0, &(0x7f0000005d00)={0x0, 0x989680}) 15:57:27 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x60}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:27 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x5c000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:27 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x7, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 329.637148] binder: release 16778:16779 transaction 892 out, still active [ 329.644841] binder: 16778:16779 ioctl c00c642e 20000040 returned -22 [ 329.654093] binder: unexpected work type, 4, not freed [ 329.666521] binder: undelivered TRANSACTION_COMPLETE [ 329.677298] binder: 16778:16779 ioctl c00c642d 200000c0 returned -22 [ 329.701647] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 329.715336] binder: invalid inc weak node for 893 15:57:27 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x700, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:27 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400300}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 329.751755] binder: 16778:16779 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 329.766362] binder_alloc: binder_alloc_mmap_handler: 16778 20001000-20004000 already mapped failed -16 [ 329.789974] binder: BINDER_SET_CONTEXT_MGR already set 15:57:27 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x2, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:27 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000f4eff8)='./file0\x00', 0x0) mount(&(0x7f000000a000), &(0x7f0000000000)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000001c000)) chdir(&(0x7f0000000240)='./file0\x00') symlink(&(0x7f00000001c0)='./file0\x00', &(0x7f00000000c0)='./file0\x00') r0 = syz_open_dev$usbmon(&(0x7f0000000100)='/dev/usbmon#\x00', 0x2, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r0, 0x84, 0x65, &(0x7f0000000280)=[@in={0x2, 0x4e22, @rand_addr=0xd80}, @in6={0xa, 0x4e22, 0x3, @local, 0x5}, @in6={0xa, 0x4e24, 0x9, @mcast1, 0x3}, @in={0x2, 0x4e24, @local}, @in={0x2, 0x4e24, @multicast2}, @in6={0xa, 0x4e22, 0x6, @ipv4={[], [], @loopback}, 0x8}, @in={0x2, 0x4e21}], 0x94) link(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file1\x00') [ 329.804540] binder: 16778:16779 ioctl 40046207 0 returned -16 [ 329.829533] binder_alloc: 16778: binder_alloc_buf, no vma [ 329.868913] binder: 16778:16794 transaction failed 29189/-3, size 24-8 line 2970 [ 329.874792] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 329.890227] binder: 16778:16797 ioctl c00c642e 20000040 returned -22 15:57:27 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x5c, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 329.914515] binder: undelivered TRANSACTION_ERROR: 29189 [ 329.917779] binder: 16778:16797 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 329.929578] binder: 16778:16779 ioctl c00c642d 200000c0 returned -22 [ 329.960324] binder: send failed reply for transaction 892, target dead 15:57:28 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/igmp6\x00') bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-ssse3\x00'}, 0x58) r2 = accept4$alg(r0, 0x0, 0x0, 0x0) fcntl$getownex(r2, 0x10, &(0x7f0000000080)={0x0, 0x0}) sched_getattr(r3, &(0x7f0000000100), 0x30, 0x0) sendfile(r2, r1, &(0x7f000025d000), 0x1000) ioctl$EVIOCSKEYCODE(r1, 0x40084504, &(0x7f0000000140)=[0x0, 0x100000000]) 15:57:28 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x3000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:28 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xf0ffffff00000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:28 executing program 5: prctl$setname(0xf, &(0x7f0000000040)='/dev/nullb0\x00') r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000240)='/dev/nullb0\x00', 0x0, 0x0) ioctl$BLKGETSIZE(r0, 0x1260, &(0x7f0000000000)) 15:57:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0xff80000000000000, 0x2000) setsockopt$inet6_tcp_int(r2, 0x6, 0x14, &(0x7f00000000c0)=0x9, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="0000000000000000cfb8bb43480b0af0a0fa5cc0d8bc0152179b85e279ce6e46c63d4bb199479406b0cd49121418535a97ad8844c5917669fe61f2304570151eeee421417a17c1634a919bab6ff0f13b07d69fcfcc10949fc07b1785aab30b2be7b5331d1a647e321851c4fad7af022e8fafe80fc62e30204a68251bc7207995c161d783e7006a5c169e8c895f4e9ce818e8a64fd7d1cd005771974f378c4f5a186cb8309043319ebdd075ce"], @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:57:28 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0xb00000000000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 330.395377] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:28 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0xfeffffff, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:28 executing program 5: r0 = socket(0x1e, 0x2, 0x0) bind(r0, &(0x7f0000afb000)=@generic={0x1e, "01030000000000b9000000004700000000a979f321b30c7bc8790405c7bad62e0a63a632ed4938d36d73fb8f8401a3ff59829a2b0afe7ce43a4b2470a0c5216669ca021f6f65dcf160e7e58f358c0002f0000158d19bcb3151d24acef1f1622ca5bdb9c8ea31000077aeb81c90001d6d7c980400000000f70dc136cb184a"}, 0xfffffd14) socket$pptp(0x18, 0x1, 0x2) sendto(r0, &(0x7f0000000000)="bf2a35cdc2152312ee19cc762ece71ab90ca436505693f1ce8b04592c28a35b4a2a0d445a670afd1ac7c6102e0974e48c686ed675dc9fb3175203e68ee4808f300f10fc01a5615cc842af4f0eff77caf68ffaac3981d2fe8cc2be716ae138f1cee0b9a243d2ea65b6c6df95d3ecb1adf73445421042b97b31c7429f8a10301a3c97ea4a2b761115a1b4ed59910", 0x8d, 0x20008000, &(0x7f00000000c0)=@pppoe={0x18, 0x0, {0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, 'nr0\x00'}}, 0x80) sendto$inet(r0, &(0x7f0000000140)="4ce4a34fc71effb339b97f99b340c5bbfe1994e6453632430464a79c363a3f772dc7d6bc6c91b7f7b3596f75adaa9833bdcf1383fe793a17f882a38b0b50516a37ba1edf6f46b41ae15611654ab63938", 0x50, 0x40000, &(0x7f00000001c0)={0x2, 0x4e24, @multicast1}, 0x10) 15:57:28 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x5c00000000000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 330.442862] binder: release 16824:16826 transaction 897 out, still active [ 330.449895] binder: unexpected work type, 4, not freed [ 330.455626] binder: invalid inc weak node for 898 [ 330.466724] binder: 16824:16826 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 330.476879] binder: undelivered TRANSACTION_COMPLETE 15:57:28 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 330.514914] binder_alloc: binder_alloc_mmap_handler: 16824 20001000-20004000 already mapped failed -16 15:57:28 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = dup2(r0, r0) getsockopt$sock_int(r1, 0x1, 0xb, &(0x7f0000000000), &(0x7f0000000080)=0x4) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x4602, 0x42) [ 330.559944] binder: BINDER_SET_CONTEXT_MGR already set [ 330.567802] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 330.581139] binder: 16824:16826 ioctl 40046207 0 returned -16 15:57:28 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x4000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:28 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0xfeffffff, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 330.609165] binder_alloc: 16824: binder_alloc_buf, no vma [ 330.626948] binder: 16824:16838 transaction failed 29189/-3, size 24-8 line 2970 [ 330.638061] binder: send failed reply for transaction 897, target dead 15:57:28 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000001840)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) pivot_root(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0\x00') write$uinput_user_dev(r0, &(0x7f0000000240)={'syz1\x00', {0x7fffffff, 0x401, 0x1f, 0xfd56}, 0x2c, [0x4, 0x30, 0x5, 0x5, 0xd12, 0x8, 0x0, 0xfff, 0x0, 0x1, 0x1, 0x7fff, 0xff, 0xf2d, 0xfffffffffffff3ec, 0x401, 0x75289cf4, 0x9, 0x8c7, 0x869, 0x8, 0x100000001, 0x20, 0x9, 0x9, 0x1ff, 0x80000000, 0x4, 0x8000, 0x4, 0x80, 0x6, 0x1, 0x4, 0x46ae, 0x1, 0x1, 0x2, 0x20, 0x0, 0x6, 0x2, 0x7, 0xffffffff, 0x3, 0x9, 0x0, 0x100000001, 0x80000001, 0xaa98, 0x79fe, 0x0, 0x1ff, 0xffffffffffffff2e, 0x8, 0x100, 0x3ff, 0x80000001, 0x43f0, 0x101, 0x23a6908, 0x200, 0x4, 0x8], [0x40, 0x9, 0x9, 0x7, 0x7, 0x5, 0x7, 0x9, 0x5, 0x3, 0x80000000, 0x1e63, 0xffffffffffffffff, 0x80000001, 0x71, 0xa7, 0x9, 0x9, 0x7, 0x10001, 0x4, 0x4, 0x6, 0x4, 0x6, 0x1ff, 0x3f, 0x10001, 0x2, 0x1, 0x0, 0x27, 0x6b96, 0x5, 0x9, 0x0, 0x8, 0x6, 0x0, 0x0, 0xc35, 0x6, 0x5, 0x80000000, 0x40, 0x3, 0x8, 0xffff, 0x5, 0x401, 0x200, 0xffffffff7fffffff, 0x6, 0x400000, 0x4, 0x200, 0x4, 0x5, 0x5, 0x3f0, 0x3, 0x9, 0x0, 0x48ab], [0x2, 0x7, 0x9, 0x80, 0x5, 0xffffffff, 0x40, 0x3, 0x6, 0x2, 0x1, 0x7, 0x9, 0x4, 0x1, 0x8a, 0x7, 0x0, 0x3, 0xd66e, 0x31, 0x6, 0x3, 0x7fffffff, 0xfffffffffffffffd, 0x0, 0x5, 0x4c, 0x81, 0x7fff, 0x2, 0x42a87d8b, 0x1000, 0x2d96, 0x8000, 0x8000, 0x91fa, 0x7, 0x7, 0x40, 0x26, 0x7, 0x3, 0x8, 0x9, 0x15, 0x0, 0x4, 0x1, 0xfffffffffffffeff, 0x4, 0x7, 0x5, 0x3, 0x800, 0x5, 0x1ff, 0x3, 0x5, 0x3, 0x2, 0x0, 0x2, 0x7], [0x7, 0x3, 0x3d6f1f54, 0x5, 0x4, 0xb91, 0x6, 0x0, 0x0, 0x4, 0x7, 0x2, 0x0, 0x3, 0x1ff, 0x80000000, 0x6, 0xffffffffffffffff, 0xfffffffffffffb3a, 0x40, 0x2, 0x100000000, 0x9, 0x0, 0xec, 0x1, 0xffffffff, 0x33d406cf, 0x2, 0x7, 0x1, 0xfffffffffffffe00, 0x4312, 0x6, 0x0, 0x4, 0xffffffff, 0x758, 0x101, 0xffff, 0x1, 0x6, 0x12000000000, 0x1, 0x1, 0xfffffffffffffffa, 0x3, 0x4, 0xfff, 0x4, 0x40, 0x5, 0xb9, 0x9, 0xfff, 0xd81, 0x9, 0xfffffffffffffffb, 0x1, 0x0, 0x6, 0x1f, 0x6, 0x8]}, 0x45c) getrandom(&(0x7f0000000140)=""/151, 0x97, 0x3) r2 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x88a, 0x2) ioctl$TUNSETSNDBUF(r2, 0x400454d4, &(0x7f0000000200)=0x1ff) 15:57:28 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8100}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 330.668505] binder: undelivered TRANSACTION_ERROR: 29189 15:57:28 executing program 5: r0 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x800000003, 0x80011, r0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x3, &(0x7f00000003c0)) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = add_key(&(0x7f0000000040)='encrypted\x00', &(0x7f0000000080)={0x73, 0x79, 0x7a, 0x1}, &(0x7f00000000c0)="4f5a4def369fab7345ac62481f1ecc02a9296c4d7d3aadf2282c8b7704ec", 0x1e, 0xfffffffffffffffe) r4 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000300)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$search(0xa, r3, &(0x7f0000000100)='user\x00', &(0x7f0000000200)={0x73, 0x79, 0x7a, 0x3}, r4) r5 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)='pids.events\x00', 0x0, 0x0) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4018aebd, &(0x7f0000000340)={0x4, r5}) r6 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000380)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil}) ioctl$KVM_NMI(r6, 0xae9a) ioctl$KVM_RUN(r6, 0xae80, 0x0) 15:57:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:57:28 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0xb000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 330.754171] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:28 executing program 4: r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000000200)="21008dd2fad9eb7dbf918f9a5488fd948ef0905dfd022716faab0c8375c4871b9577eb844b614e213af7293e13041f9538d0106c073d459dc6c16e26d1e075862af8d089e491754e914cbf9edbede76b8da48796356e1c9338fe32a53d78d612f36c3a630a77dfbe3cd057c8ddd61c03b983c1e141513b15239799eaa06fae6cb3f470bff2f022ee9ba24f51531efe62b1603015d874af8152291bef48d70f") 15:57:28 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x8, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:28 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 330.844545] encrypted_key: insufficient parameters specified [ 330.852335] binder: 16870:16871 got transaction to context manager from process owning it [ 330.915072] binder: 16870:16871 transaction failed 29201/-22, size 24-8 line 2846 [ 330.953591] encrypted_key: insufficient parameters specified 15:57:28 executing program 4: sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x40000000000009) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x29, 0x5, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280)={0x0}, &(0x7f00000003c0)=0x19f) ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f00000002c0)=r1) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={&(0x7f00000000c0)={0x10, 0x17060000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="2800000010005fba000000000000000000000000", @ANYRES32=0x0, @ANYBLOB="0002005a5aed79774f59f0f30d9b4c8a44b5113b4241abc127e8d393b327746da3b1f2e43b4c10a0b0da70062ae8c485e0c788fd35a88ad27c33f909c4ae5aa8a5b4a27793948807dc50cd0a515fb44564b0776047a918d3756121cb2450eb1e1abfc8a5cb600c7330ac57c1e357bf23214777d730f5a7683c215c9471c275c873d007957714f0c542240a555e9b5bb50fe44f6b9fc606578b1d6c6a82d0944108c3998018e37baf6f4a6aaec68a155698d5d72290bfdf"], 0x28}}, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000180), &(0x7f0000000200)=0xc) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r2, 0x10e, 0x5, &(0x7f0000000100)=0x10000, 0x4) 15:57:28 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x2000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 330.954502] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 330.959816] binder: undelivered TRANSACTION_ERROR: 29201 [ 330.968048] binder: 16870:16878 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 331.005857] binder_alloc: binder_alloc_mmap_handler: 16870 20001000-20004000 already mapped failed -16 [ 331.057644] binder: 16870:16893 got transaction to context manager from process owning it [ 331.080630] binder: 16870:16893 transaction failed 29201/-22, size 24-8 line 2846 [ 331.097329] binder: 16870:16878 IncRefs 0 refcount change on invalid ref 1 ret -22 15:57:29 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0xffffffffffffffff, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:29 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x500000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:29 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x200000000000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 331.110187] netlink: 8 bytes leftover after parsing attributes in process `syz-executor4'. 15:57:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB="0000b21183728965"]], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r1, r0) signalfd4(r0, &(0x7f0000000040)={0x8}, 0x8, 0x800) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f00000000c0)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) 15:57:29 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = open(&(0x7f0000000000)='./file0\x00', 0x40, 0x4) fcntl$getownex(r0, 0x10, &(0x7f0000000040)={0x0, 0x0}) mq_notify(r1, &(0x7f0000000080)={0x0, 0x13, 0x0, @tid=r2}) sendmsg$nl_generic(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34000}, 0xfffffffffffffcb0, &(0x7f0000000100)={&(0x7f00000001c0)={0x36, 0x2f, 0x829, 0x0, 0x0, {0x3}, [@nested={0x18, 0x0, [@typed={0x14, 0xa, @ipv6=@loopback}]}]}, 0x2c}}, 0x10) [ 331.164118] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:29 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:29 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x700000000000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:29 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket(0x2, 0x803, 0x3f) setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000000080), 0x0) ioctl$FIGETBSZ(r1, 0x2, &(0x7f0000000040)) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000180)=0x101, 0x4) r2 = dup3(r0, r1, 0x80000) ioctl$LOOP_SET_STATUS(r2, 0x4c02, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x9, 0x4, 0x3, 0x8, "bf29ca77358d31f4b721d47fafe48012ad3347ecf65d5ee0b98adaf4acf4306e38ec5e4fc5085c2908cde50305a0aab63fc9ff88296de1a774f1a26993880f9b", "726cda24f5325a476b41f7acbbac3ca0eaf29a856e75647e8d4a89050d13164f", [0x7fff, 0x6]}) connect$inet(r1, &(0x7f0000390000)={0x2, 0x0, @local}, 0x10) r3 = open(&(0x7f0000000000)='./file0\x00', 0x141046, 0x0) ftruncate(r3, 0x10004) openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x200000, 0x4) sendfile(r1, r3, 0x0, 0x72439a6b) [ 331.304405] binder: 16907:16909 got transaction with invalid offset (7316504976903241728, min 0 max 24) or object. 15:57:29 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0xfeffffff00000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 331.368556] binder: 16907:16909 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 331.386845] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 331.443054] binder: BINDER_SET_CONTEXT_MGR already set [ 331.469268] binder: 16907:16913 ioctl 40046207 0 returned -16 15:57:29 executing program 4: gettid() timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000000)=@dstopts, 0x8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @mcast1, 0x4}, 0x1c) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) getsockopt$IP_VS_SO_GET_TIMEOUT(0xffffffffffffffff, 0x0, 0x486, &(0x7f0000000040), &(0x7f0000000100)=0xc) sendmmsg(r0, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0xffffffffffffffff) 15:57:29 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0xffffffff00000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:29 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x60000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 331.522847] binder_alloc: binder_alloc_mmap_handler: 16907 20001000-20004000 already mapped failed -16 15:57:29 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x600000000000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:29 executing program 4: pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000280)={0xffffffffffffffff, 0x28, &(0x7f0000000240)}, 0x10) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000733000), 0x2c) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$SG_GET_LOW_DMA(0xffffffffffffffff, 0x227a, &(0x7f00000001c0)) ioctl$BLKREPORTZONE(0xffffffffffffffff, 0xc0101282, &(0x7f00000003c0)=ANY=[]) getpeername$inet(r1, &(0x7f0000000340)={0x2, 0x0, @local}, &(0x7f0000000380)=0x10) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x20000000000000, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet6(r3, &(0x7f00000002c0)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) r5 = socket$l2tp(0x18, 0x1, 0x1) mount(&(0x7f0000000540)=ANY=[@ANYBLOB="2f6465762f6d6430a0"], &(0x7f0000000580)='./file0\x00', &(0x7f00000005c0)='nfs4\x00', 0xc040, &(0x7f0000000600)='system%vboxnet1\x00') connect$l2tp(r5, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r3, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r5, &(0x7f0000005fc0), 0x80000000000006a, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000040)={@ipv4={[], [], @dev}}, &(0x7f0000000100)=0x2c9) ioctl$sock_SIOCDELDLCI(0xffffffffffffffff, 0x8981, &(0x7f0000000140)={'bond0\x00', 0x5}) getsockopt$packet_buf(r1, 0x107, 0xf, &(0x7f00000003c0)=""/113, &(0x7f0000000440)=0x71) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r4, 0x84, 0x6d, &(0x7f0000000480)=ANY=[@ANYBLOB="20002886"], &(0x7f00000004c0)=0x1) setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000500)={0x0, 0x3}, 0x8) getsockname$inet(r0, &(0x7f0000000200)={0x2, 0x0, @local}, &(0x7f0000000300)=0x10) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r2, 0x28, &(0x7f00000000c0)}, 0xffffffffffffffe7) 15:57:29 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000280)='/dev/snd/seq\x00', 0x0, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x0, 0x0) ioctl$int_in(r0, 0x5421, &(0x7f0000000040)=0x100000001) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0x404c534a, &(0x7f0000000080)={0x8, 0x0, 0xffffffffffffffc1}) [ 331.588653] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 331.609201] binder_alloc: 16907: binder_alloc_buf, no vma [ 331.620723] binder: BINDER_SET_CONTEXT_MGR already set [ 331.626550] binder: 16907:16933 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 331.702662] binder: 16907:16909 ioctl 40046207 0 returned -16 15:57:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$NBD_SET_SOCK(r2, 0xab00, r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:57:29 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0xfeffffff00000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:29 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x500}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:29 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x6000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:29 executing program 5: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x600000000000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 331.913596] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:29 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x48000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:29 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffd) mount(&(0x7f00000012c0), &(0x7f0000001300)='./file0\x00', &(0x7f0000000100)='tmpfs\x00', 0xc8d, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) mount(&(0x7f0000000080)=@sr0='/dev/sr0\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='qnx6\x00', 0x800000, &(0x7f0000000180)='tmpfs\x00') r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x60, &(0x7f0000001340)={'filter\x00', 0x7, 0x4, 0x494, 0x270, 0x130, 0x0, 0x3b0, 0x3b0, 0x3b0, 0x4, &(0x7f00000001c0), {[{{@uncond, 0xf0, 0x130}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "24d8c14e999cfcb3ea55a97377f7e338a63e2ba9ef4733d8f48f09f62829"}}, {{@arp={@loopback, @multicast2, 0xff, 0x0, @empty, {[0x0, 0x0, 0xff, 0xff, 0x0, 0xff]}, @empty, {[0xff, 0xff, 0xff, 0x0, 0xff]}, 0x300000, 0x80000000, 0x100, 0x80000001, 0x7, 0x5, 'lo\x00', 'eql\x00', {0xff}, {0xff}, 0x0, 0x5}, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @mac=@local, @remote, @dev={0xac, 0x14, 0x14, 0x15}, 0xf}}}, {{@uncond, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@mac, @mac=@dev={[], 0x16}, @multicast2, @rand_addr=0x6, 0xf, 0xffffffff}}}], {{[], 0xc0, 0xe4}, {0x24}}}}, 0x4e0) fstatfs(r0, &(0x7f00000002c0)=""/4096) 15:57:29 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0xb00000000000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 331.982899] binder: release 16958:16959 transaction 910 out, still active [ 331.989911] binder: unexpected work type, 4, not freed [ 331.996132] binder: 16958:16959 ioctl ab00 3 returned -22 [ 332.041491] binder: invalid inc weak node for 911 [ 332.051296] binder: undelivered TRANSACTION_COMPLETE 15:57:30 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x81000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 332.093534] binder: 16958:16959 IncRefs 0 refcount change on invalid ref 1 ret -22 15:57:30 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0xfffffffe, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 332.151501] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 332.161326] binder_alloc: binder_alloc_mmap_handler: 16958 20001000-20004000 already mapped failed -16 15:57:30 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x7000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:30 executing program 4: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000180)='/dev/null\x00', 0x480, 0x0) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(0xffffffffffffffff, 0x84, 0x20, &(0x7f00000002c0), &(0x7f0000000300)=0x4) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000080)="baa100b000eef36cba2100ec66b9800000c00f326635001000000f30bad104ecc80080d267d9f8f30f1bb429000f20c06635200000000f22c067f3af", 0x3c}], 0x1, 0x0, &(0x7f0000000600), 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x40000000000009) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_TSS_ADDR(r2, 0xae47, 0xd000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44b}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_ro(r0, &(0x7f00000001c0)='rdma.current\x00', 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x7}, 0x1c) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x1f000}) ioctl$KVM_RUN(r3, 0xae80, 0x3f00000000000000) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) r4 = openat$full(0xffffffffffffff9c, &(0x7f0000000140)='/dev/full\x00', 0x0, 0x0) io_setup(0x7, &(0x7f0000000000)=0x0) io_submit(r5, 0x1, &(0x7f0000000940)=[&(0x7f0000000080)={0x0, 0x0, 0x10, 0x0, 0x0, r4, &(0x7f0000000040)}]) mmap(&(0x7f0000e13000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x0) [ 332.207532] tmpfs: No value for mount option '/dev/sr0' [ 332.227432] binder: BINDER_SET_CONTEXT_MGR already set [ 332.292122] binder: 16958:16959 ioctl 40046207 0 returned -16 [ 332.303260] binder_alloc: 16958: binder_alloc_buf, no vma [ 332.328679] binder_transaction: 2 callbacks suppressed [ 332.328698] binder: 16958:16986 transaction failed 29189/-3, size 24-8 line 2970 [ 332.366739] binder: 16958:16974 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 332.368286] binder: 16958:16959 ioctl ab00 5 returned -22 15:57:30 executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c678c6f75705f69643d", @ANYRESDEC=0x0, @ANYBLOB="9600042133e627c26ceb3995b69f5da373d0ed094ab680737daadc1c5e"]) write$FUSE_NOTIFY_STORE(0xffffffffffffffff, &(0x7f0000000080)={0x29, 0x4, 0x0, {0x1, 0x0, 0x1, 0x0, [0x0]}}, 0x29) read$FUSE(0xffffffffffffffff, &(0x7f0000002000), 0x1000) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f0000000180)={0x30, 0x5, 0x0, {0x0, 0x1, 0x0, 0xbfb}}, 0x0) prctl$intptr(0x8, 0xb094) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) 15:57:30 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x7000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r1, r0) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000040)) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:57:30 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0xb, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:30 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x700, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 332.412012] binder: send failed reply for transaction 910, target dead [ 332.479367] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:30 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x6, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:30 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8050000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:30 executing program 5: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/mixer\x00', 0x200, 0x0) write$FUSE_LSEEK(r0, &(0x7f0000000280)={0x18, 0xffffffffffffffff, 0x2, {0x6}}, 0x18) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000240)={&(0x7f0000000000), 0xc, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="31ec00001c00070f000000000000000007000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0x1c}}, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x0, 0x0) accept4$inet(r2, &(0x7f0000000080)={0x2, 0x0, @multicast1}, &(0x7f00000000c0)=0x10, 0x80000) readlinkat(r2, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)=""/17, 0x11) r3 = getpgrp(0xffffffffffffffff) fcntl$setown(r1, 0x8, r3) [ 332.538703] binder: release 17004:17006 transaction 915 out, still active [ 332.547635] binder_alloc: binder_alloc_mmap_handler: 17004 20001000-20004000 already mapped failed -16 [ 332.560326] binder: unexpected work type, 4, not freed 15:57:30 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 332.595098] binder: undelivered TRANSACTION_COMPLETE [ 332.613079] binder: BINDER_SET_CONTEXT_MGR already set [ 332.677086] binder: 17004:17006 ioctl 40046207 0 returned -16 [ 332.677800] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 332.692042] binder_alloc: 17004: binder_alloc_buf, no vma 15:57:30 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x300000000000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 332.734498] binder: 17004:17008 transaction failed 29189/-3, size 24-8 line 2970 15:57:30 executing program 4: r0 = pkey_alloc(0x0, 0x2) pkey_free(r0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000002380)='/dev/hwrng\x00', 0x200, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f00000023c0)={0x0, 0x5, "9d155b184e"}, &(0x7f0000002400)=0xd) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000002440)={r2, @in={{0x2, 0x4e23, @local}}, 0x0, 0x7ff}, 0x88) 15:57:30 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x4800000000000000, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:30 executing program 5: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0x40, 0x0) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffff9c, 0xc0086420, &(0x7f0000000100)={0x0}) ioctl$DRM_IOCTL_UNLOCK(r0, 0x4008642b, &(0x7f0000000140)={r1, 0x2}) socketpair(0x8000000000001e, 0x1, 0x0, &(0x7f000000dff8)={0xffffffffffffffff, 0xffffffffffffffff}) write$sndseq(r2, &(0x7f000082cf40), 0x203a0) ppoll(&(0x7f0000000000)=[{r2}], 0x1, &(0x7f0000000040), &(0x7f0000000080), 0x8) [ 332.783877] binder: send failed reply for transaction 915, target dead [ 332.799167] binder_release_work: 4 callbacks suppressed [ 332.799174] binder: undelivered TRANSACTION_ERROR: 29189 15:57:30 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xf0}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x37, 0x400000) ioctl$TUNGETIFF(r2, 0x800454d2, &(0x7f0000000140)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=[@clear_death={0x400c630f, 0x2, 0x4}], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) 15:57:30 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x3000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:30 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x400000000000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:30 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil}) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x40101, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000180)={0x0, 0x2, 0xfff, 0x6, 0x9, 0xff}, &(0x7f00000001c0)=0x14) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r3, 0x84, 0x7c, &(0x7f0000000200)={r4, 0xff, 0x43b}, 0x8) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001380)=ANY=[@ANYBLOB="36d43d55"], 0x4) ioctl$KVM_NMI(r3, 0xae9a) r5 = syz_open_dev$adsp(&(0x7f00000000c0)='/dev/adsp#\x00', 0x8001, 0x40000) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001380)=ANY=[@ANYBLOB="f10f6f"], 0x3) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 332.948881] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:30 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000000000000000, 0x0, 0x1d, 0x0, 0x4000000, 0x0, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x1000000, 0x0, 0x3}, 0x0, 0xc, 0xffffffffffffffff, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vsock\x00', 0x100, 0x0) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r0) setgroups(0x0, &(0x7f00000004c0)) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vcs\x00', 0x80000, 0x0) ioctl$EVIOCGID(r2, 0x80084502, &(0x7f0000000040)=""/149) getsockopt$XDP_STATISTICS(r1, 0x11b, 0x7, &(0x7f0000000140), &(0x7f0000000200)=0x18) 15:57:31 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x6}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:31 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x3f00000000000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:31 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x1000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 333.102723] binder: 17049:17053 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 333.140719] Unknown ioctl 19462 [ 333.148602] binder: 17049:17053 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 333.167574] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 333.184312] Unknown ioctl 19462 15:57:31 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x48, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:31 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000000c0), 0xffffff9b) tee(r2, r1, 0x1, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r4, 0x1000000000013) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000300)={0x0, @local, @remote}, &(0x7f0000000340)=0xc) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f0000000380)={r5, 0x1, 0x6}, 0x10) read(r0, &(0x7f0000000200)=""/250, 0x50c7e3e3) 15:57:31 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x8000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 333.214983] binder: BINDER_SET_CONTEXT_MGR already set [ 333.215017] binder: 17049:17067 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 333.247738] binder: 17049:17053 ioctl 40046207 0 returned -16 15:57:31 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x700000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = dup2(r1, r0) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000001700)={0x7, 0x0, [{0x10001, 0x56, &(0x7f0000000140)=""/86}, {0x5000, 0x3a, &(0x7f0000000040)=""/58}, {0x1d000, 0xc7, &(0x7f0000000480)=""/199}, {0x101004, 0x23, &(0x7f00000000c0)=""/35}, {0x0, 0x8e, &(0x7f0000000380)=""/142}, {0x0, 0x1000, &(0x7f0000000700)=""/4096}, {0x7000, 0xe9, &(0x7f0000000580)=""/233}]}) fcntl$F_SET_FILE_RW_HINT(r2, 0x40e, &(0x7f00000001c0)) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:57:31 executing program 4: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x20000000000002, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000100)={0x0, @in={{0x2, 0x4e22, @local}}, 0x7fffffff, 0xfffffffffffffff8}, &(0x7f00000001c0)=0x88) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000200)={r2, @in={{0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x1a}}}}, &(0x7f0000000300)=0x84) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000440)='vegas\x00', 0x6) sendto$inet6(r0, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000000)) syz_open_dev$audion(&(0x7f00000002c0)='/dev/audio#\x00', 0x0, 0x0) r3 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x7fff) setpriority(0x3, 0x0, 0xfffffffffffffffa) sendfile(r1, r3, &(0x7f0000d83ff8)=0x1800000000000000, 0x8000fffffffe) [ 333.371021] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 333.410896] binder: release 17084:17085 transaction 921 out, still active 15:57:31 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0xfffffffe, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:31 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x1000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 333.419169] binder: unexpected work type, 4, not freed [ 333.425642] binder: 17084:17085 ioctl 4008af03 20001700 returned -22 [ 333.452061] binder: undelivered TRANSACTION_COMPLETE [ 333.458111] binder: invalid inc weak node for 922 15:57:31 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x3f000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 333.470950] binder: 17084:17085 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 333.520540] binder_alloc: binder_alloc_mmap_handler: 17084 20001000-20004000 already mapped failed -16 15:57:31 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0xffffffff00000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 333.562056] binder: BINDER_SET_CONTEXT_MGR already set [ 333.583264] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 333.592118] binder: 17084:17085 ioctl 40046207 0 returned -16 [ 333.616135] binder_alloc: 17084: binder_alloc_buf, no vma [ 333.621314] binder: 17084:17100 ioctl 4008af03 20001700 returned -22 15:57:31 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x40000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 333.652488] binder: send failed reply for transaction 921, target dead [ 333.660093] binder: 17084:17093 transaction failed 29189/-3, size 24-8 line 2970 15:57:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x37, 0x400000) ioctl$TUNGETIFF(r2, 0x800454d2, &(0x7f0000000140)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=[@clear_death={0x400c630f, 0x2, 0x4}], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) 15:57:31 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0xb000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 333.704325] binder: undelivered TRANSACTION_ERROR: 29189 15:57:31 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xffffff7f}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r1, r0) socket$inet_dccp(0x2, 0x6, 0x0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:57:31 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x54000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 333.845659] binder: 17108:17110 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 15:57:31 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0xfeffffff, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 333.910249] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 333.931650] binder: 17108:17110 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 333.933641] binder: BINDER_SET_CONTEXT_MGR already set [ 334.009972] binder: 17115:17119 ioctl 40046207 0 returned -16 [ 334.010361] binder_alloc: 17108: binder_alloc_buf failed to map pages in userspace, no vma [ 334.063063] binder: 17115:17123 transaction failed 29189/-3, size 24-8 line 2970 [ 334.097158] binder: undelivered TRANSACTION_ERROR: 29189 [ 334.116470] binder: 17115:17119 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 334.127195] binder_alloc: binder_alloc_mmap_handler: 17115 20001000-20004000 already mapped failed -16 [ 334.156266] binder_alloc: 17115: binder_alloc_buf, no vma [ 334.166302] binder: 17115:17123 transaction failed 29189/-3, size 24-8 line 2970 [ 334.175722] binder: undelivered TRANSACTION_ERROR: 29189 15:57:32 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:32 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x4000000000000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:32 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/4\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(0xffffffffffffffff, 0x84, 0x1c, &(0x7f0000000280), &(0x7f00000002c0)=0x4) r1 = socket(0x1e, 0x1, 0x0) syz_emit_ethernet(0x0, &(0x7f0000000500)=ANY=[], &(0x7f0000000080)={0x1, 0x4, [0x4e7, 0x0, 0x525, 0x8de]}) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x20002000, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00005befdc)) r3 = syz_open_pts(r2, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r5, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqsrc(r6, 0x0, 0x27, &(0x7f000001b000)={@multicast2, @loopback, @multicast1}, 0xc) r7 = syz_open_procfs(0x0, &(0x7f0000000200)='gid_map\x00') r8 = syz_open_procfs(0x0, &(0x7f00000000c0)='projid_map\x00') ioctl$FS_IOC_FSSETXATTR(r8, 0x401c5820, &(0x7f0000000080)={0x6, 0xffff, 0x4, 0xffff, 0xfff}) ftruncate(r8, 0x7) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r8, 0x6, 0x23, &(0x7f00000002c0)={&(0x7f0000ffc000/0x3000)=nil, 0x3000}, &(0x7f0000000300)=0xc) sendfile(r8, r7, &(0x7f0000000040), 0x10001) read(r8, &(0x7f0000000100)=""/252, 0xfc) dup2(r7, r4) connect$inet(r6, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) get_thread_area(&(0x7f0000000000)={0x4, 0x20001000, 0x2400, 0x80000001, 0x9, 0x8, 0x0, 0x8, 0x1, 0x80000000}) setsockopt$inet_mreqsrc(r6, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @loopback, @dev}, 0xc) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000280)=0xe) ioctl$TCFLSH(r3, 0x540b, 0x0) sendmsg(r0, &(0x7f00003bbfc8)={&(0x7f0000fdbf80)=@generic={0x10000000001e, "02ff0100000001000000000000000ae77f5bf86c48020002000000f1ffffff009a480075e6a50000de010300000000e4ff064b3f013a000000080000008f00000000ac50d5fe32c4000000007fffffff6a008356edb9a6341c1fd45624281e00070ecddd0206c39750c40000fd00000900000000000b0000db000004da36"}, 0x80, &(0x7f0000d1b000), 0x0, &(0x7f000012e000)}, 0x0) recvmsg$kcm(r1, &(0x7f0000000d40)={&(0x7f0000000800)=@l2, 0x80, &(0x7f00000004c0)=[{&(0x7f0000001600)=""/4096, 0x1000}, {&(0x7f0000000040)=""/37, 0x25}, {&(0x7f0000000880)=""/236, 0xec}, {&(0x7f0000002600)=""/4096, 0x1000}, {&(0x7f0000000bc0)=""/5, 0x5}], 0x5, &(0x7f0000000cc0)=""/71, 0x47}, 0x40000100) 15:57:32 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0xb00000000000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:32 executing program 4: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x20000000000002, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000100)={0x0, @in={{0x2, 0x4e22, @local}}, 0x7fffffff, 0xfffffffffffffff8}, &(0x7f00000001c0)=0x88) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000200)={r2, @in={{0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x1a}}}}, &(0x7f0000000300)=0x84) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000440)='vegas\x00', 0x6) sendto$inet6(r0, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000000)) syz_open_dev$audion(&(0x7f00000002c0)='/dev/audio#\x00', 0x0, 0x0) r3 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x7fff) setpriority(0x3, 0x0, 0xfffffffffffffffa) sendfile(r1, r3, &(0x7f0000d83ff8)=0x1800000000000000, 0x8000fffffffe) 15:57:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="852a0000000096292d9e00136c7c1ef22790a57c646b1bd622ddb03cc135a924ff790170c2384d0bcbc06392181333adec021dd2148757645a3c1d8895b11f50193aa1cbcaa84846caad638dc1d7e98ac0a2550748478f7a1c0b1ce9c12c2e813d3dcb2dfb9e54759f3ad9072377e135c5867cccd226a7437bd6ad6cf3afe31f6b9f647a5de1b8c953338973b3f7", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:57:32 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x2000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 334.755361] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 334.781690] binder: 17133:17142 transaction failed 29189/-22, size 24-8 line 2855 15:57:32 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x800000000000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 334.816075] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 334.842044] binder_alloc: binder_alloc_mmap_handler: 17133 20001000-20004000 already mapped failed -16 [ 334.855397] binder: undelivered TRANSACTION_ERROR: 29189 15:57:32 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x7}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 334.909920] binder: 17133:17142 transaction failed 29189/-22, size 24-8 line 2855 [ 334.935409] binder: BINDER_SET_CONTEXT_MGR already set 15:57:32 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x5c000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 334.964863] binder: undelivered TRANSACTION_ERROR: 29189 [ 334.976465] binder: 17133:17152 ioctl 40046207 0 returned -16 15:57:32 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x3, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 335.030728] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x4, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r1, r0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) sigaltstack(&(0x7f0000001000/0x4000)=nil, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 15:57:33 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x7000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:33 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/4\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(0xffffffffffffffff, 0x84, 0x1c, &(0x7f0000000280), &(0x7f00000002c0)=0x4) r1 = socket(0x1e, 0x1, 0x0) syz_emit_ethernet(0x0, &(0x7f0000000500)=ANY=[], &(0x7f0000000080)={0x1, 0x4, [0x4e7, 0x0, 0x525, 0x8de]}) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x20002000, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00005befdc)) r3 = syz_open_pts(r2, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r5, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqsrc(r6, 0x0, 0x27, &(0x7f000001b000)={@multicast2, @loopback, @multicast1}, 0xc) r7 = syz_open_procfs(0x0, &(0x7f0000000200)='gid_map\x00') r8 = syz_open_procfs(0x0, &(0x7f00000000c0)='projid_map\x00') ioctl$FS_IOC_FSSETXATTR(r8, 0x401c5820, &(0x7f0000000080)={0x6, 0xffff, 0x4, 0xffff, 0xfff}) ftruncate(r8, 0x7) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r8, 0x6, 0x23, &(0x7f00000002c0)={&(0x7f0000ffc000/0x3000)=nil, 0x3000}, &(0x7f0000000300)=0xc) sendfile(r8, r7, &(0x7f0000000040), 0x10001) read(r8, &(0x7f0000000100)=""/252, 0xfc) dup2(r7, r4) connect$inet(r6, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) get_thread_area(&(0x7f0000000000)={0x4, 0x20001000, 0x2400, 0x80000001, 0x9, 0x8, 0x0, 0x8, 0x1, 0x80000000}) setsockopt$inet_mreqsrc(r6, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @loopback, @dev}, 0xc) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000280)=0xe) ioctl$TCFLSH(r3, 0x540b, 0x0) sendmsg(r0, &(0x7f00003bbfc8)={&(0x7f0000fdbf80)=@generic={0x10000000001e, "02ff0100000001000000000000000ae77f5bf86c48020002000000f1ffffff009a480075e6a50000de010300000000e4ff064b3f013a000000080000008f00000000ac50d5fe32c4000000007fffffff6a008356edb9a6341c1fd45624281e00070ecddd0206c39750c40000fd00000900000000000b0000db000004da36"}, 0x80, &(0x7f0000d1b000), 0x0, &(0x7f000012e000)}, 0x0) recvmsg$kcm(r1, &(0x7f0000000d40)={&(0x7f0000000800)=@l2, 0x80, &(0x7f00000004c0)=[{&(0x7f0000001600)=""/4096, 0x1000}, {&(0x7f0000000040)=""/37, 0x25}, {&(0x7f0000000880)=""/236, 0xec}, {&(0x7f0000002600)=""/4096, 0x1000}, {&(0x7f0000000bc0)=""/5, 0x5}], 0x5, &(0x7f0000000cc0)=""/71, 0x47}, 0x40000100) 15:57:33 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xfffffffffffff000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:33 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x3f00, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 335.313244] binder: release 17169:17170 transaction 933 out, still active [ 335.324928] binder_alloc: binder_alloc_mmap_handler: 17169 20001000-20004000 already mapped failed -16 [ 335.381527] binder: unexpected work type, 4, not freed [ 335.413847] binder_alloc: 17169: binder_alloc_buf, no vma [ 335.417855] binder: BINDER_SET_CONTEXT_MGR already set [ 335.425034] binder: 17169:17179 ioctl 40046207 0 returned -16 15:57:33 executing program 4: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x20000000000002, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000100)={0x0, @in={{0x2, 0x4e22, @local}}, 0x7fffffff, 0xfffffffffffffff8}, &(0x7f00000001c0)=0x88) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000200)={r2, @in={{0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x1a}}}}, &(0x7f0000000300)=0x84) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000440)='vegas\x00', 0x6) sendto$inet6(r0, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000000)) syz_open_dev$audion(&(0x7f00000002c0)='/dev/audio#\x00', 0x0, 0x0) r3 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x7fff) setpriority(0x3, 0x0, 0xfffffffffffffffa) sendfile(r1, r3, &(0x7f0000d83ff8)=0x1800000000000000, 0x8000fffffffe) 15:57:33 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x300, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 335.431329] binder: 17169:17170 transaction failed 29189/-3, size 24-8 line 2970 [ 335.433985] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 335.453674] binder: undelivered TRANSACTION_COMPLETE 15:57:33 executing program 1: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(&(0x7f000000a000), &(0x7f000000aff8)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, &(0x7f0000000000)) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200)='/dev/rtc0\x00', 0x20800, 0x0) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x802, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode'}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x1800}}, {@default_permissions='default_permissions'}, {@default_permissions='default_permissions'}, {@blksize={'blksize'}}, {@allow_other='allow_other'}, {@allow_other='allow_other'}, {@allow_other='allow_other'}]}}) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) chdir(&(0x7f00000000c0)='./file0\x00') symlink(&(0x7f0000001000)='./file0\x00', &(0x7f0000000080)='./file0\x00') umount2(&(0x7f0000000040)='./file0\x00', 0x0) [ 335.514898] binder: undelivered TRANSACTION_ERROR: 29189 [ 335.520500] binder: send failed reply for transaction 933, target dead 15:57:33 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x8, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:33 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x5c, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:33 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:33 executing program 1: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(&(0x7f000000a000), &(0x7f000000aff8)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, &(0x7f0000000000)) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200)='/dev/rtc0\x00', 0x20800, 0x0) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x802, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode'}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x1800}}, {@default_permissions='default_permissions'}, {@default_permissions='default_permissions'}, {@blksize={'blksize'}}, {@allow_other='allow_other'}, {@allow_other='allow_other'}, {@allow_other='allow_other'}]}}) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) chdir(&(0x7f00000000c0)='./file0\x00') symlink(&(0x7f0000001000)='./file0\x00', &(0x7f0000000080)='./file0\x00') umount2(&(0x7f0000000040)='./file0\x00', 0x0) 15:57:33 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x7, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:33 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x200000000000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 335.797033] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:33 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/4\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(0xffffffffffffffff, 0x84, 0x1c, &(0x7f0000000280), &(0x7f00000002c0)=0x4) r1 = socket(0x1e, 0x1, 0x0) syz_emit_ethernet(0x0, &(0x7f0000000500)=ANY=[], &(0x7f0000000080)={0x1, 0x4, [0x4e7, 0x0, 0x525, 0x8de]}) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x20002000, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00005befdc)) r3 = syz_open_pts(r2, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r5, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqsrc(r6, 0x0, 0x27, &(0x7f000001b000)={@multicast2, @loopback, @multicast1}, 0xc) r7 = syz_open_procfs(0x0, &(0x7f0000000200)='gid_map\x00') r8 = syz_open_procfs(0x0, &(0x7f00000000c0)='projid_map\x00') ioctl$FS_IOC_FSSETXATTR(r8, 0x401c5820, &(0x7f0000000080)={0x6, 0xffff, 0x4, 0xffff, 0xfff}) ftruncate(r8, 0x7) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r8, 0x6, 0x23, &(0x7f00000002c0)={&(0x7f0000ffc000/0x3000)=nil, 0x3000}, &(0x7f0000000300)=0xc) sendfile(r8, r7, &(0x7f0000000040), 0x10001) read(r8, &(0x7f0000000100)=""/252, 0xfc) dup2(r7, r4) connect$inet(r6, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) get_thread_area(&(0x7f0000000000)={0x4, 0x20001000, 0x2400, 0x80000001, 0x9, 0x8, 0x0, 0x8, 0x1, 0x80000000}) setsockopt$inet_mreqsrc(r6, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @loopback, @dev}, 0xc) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000280)=0xe) ioctl$TCFLSH(r3, 0x540b, 0x0) sendmsg(r0, &(0x7f00003bbfc8)={&(0x7f0000fdbf80)=@generic={0x10000000001e, "02ff0100000001000000000000000ae77f5bf86c48020002000000f1ffffff009a480075e6a50000de010300000000e4ff064b3f013a000000080000008f00000000ac50d5fe32c4000000007fffffff6a008356edb9a6341c1fd45624281e00070ecddd0206c39750c40000fd00000900000000000b0000db000004da36"}, 0x80, &(0x7f0000d1b000), 0x0, &(0x7f000012e000)}, 0x0) recvmsg$kcm(r1, &(0x7f0000000d40)={&(0x7f0000000800)=@l2, 0x80, &(0x7f00000004c0)=[{&(0x7f0000001600)=""/4096, 0x1000}, {&(0x7f0000000040)=""/37, 0x25}, {&(0x7f0000000880)=""/236, 0xec}, {&(0x7f0000002600)=""/4096, 0x1000}, {&(0x7f0000000bc0)=""/5, 0x5}], 0x5, &(0x7f0000000cc0)=""/71, 0x47}, 0x40000100) 15:57:33 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x3000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 335.969432] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:33 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x5400, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:34 executing program 4: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x20000000000002, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000100)={0x0, @in={{0x2, 0x4e22, @local}}, 0x7fffffff, 0xfffffffffffffff8}, &(0x7f00000001c0)=0x88) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000200)={r2, @in={{0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x1a}}}}, &(0x7f0000000300)=0x84) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000440)='vegas\x00', 0x6) sendto$inet6(r0, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000000)) syz_open_dev$audion(&(0x7f00000002c0)='/dev/audio#\x00', 0x0, 0x0) r3 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x7fff) setpriority(0x3, 0x0, 0xfffffffffffffffa) sendfile(r1, r3, &(0x7f0000d83ff8)=0x1800000000000000, 0x8000fffffffe) 15:57:34 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xf}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:34 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x4000000000000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:34 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000680)='/dev/kvm\x00', 0x0, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x200, 0x0) setsockopt$inet_sctp_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f00000000c0)=0x19b8, 0x4) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000000000), &(0x7f0000000040)=0x4) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000140)={0x2, 0x0, @ioapic={0x0, 0x0, 0x0, 0x5ae8, 0x0, [{}, {}, {}, {}, {}, {0x0, 0x0, 0x0, [], 0x3ff}]}}) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000100)=0x0) process_vm_readv(r3, &(0x7f0000000440)=[{&(0x7f0000000240)=""/68, 0x44}, {&(0x7f00000002c0)=""/240, 0xf0}, {&(0x7f00000003c0)=""/113, 0x71}, {&(0x7f00000006c0)=""/4096, 0x1000}], 0x4, &(0x7f0000000640)=[{&(0x7f0000000480)=""/245, 0xf5}, {&(0x7f0000000580)=""/97, 0x61}, {&(0x7f0000000600)=""/53, 0x35}, {&(0x7f00000016c0)=""/107, 0x6b}], 0x4, 0x0) 15:57:34 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x300, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:34 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/4\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(0xffffffffffffffff, 0x84, 0x1c, &(0x7f0000000280), &(0x7f00000002c0)=0x4) r1 = socket(0x1e, 0x1, 0x0) syz_emit_ethernet(0x0, &(0x7f0000000500)=ANY=[], &(0x7f0000000080)={0x1, 0x4, [0x4e7, 0x0, 0x525, 0x8de]}) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x20002000, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00005befdc)) r3 = syz_open_pts(r2, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r5, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqsrc(r6, 0x0, 0x27, &(0x7f000001b000)={@multicast2, @loopback, @multicast1}, 0xc) r7 = syz_open_procfs(0x0, &(0x7f0000000200)='gid_map\x00') r8 = syz_open_procfs(0x0, &(0x7f00000000c0)='projid_map\x00') ioctl$FS_IOC_FSSETXATTR(r8, 0x401c5820, &(0x7f0000000080)={0x6, 0xffff, 0x4, 0xffff, 0xfff}) ftruncate(r8, 0x7) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r8, 0x6, 0x23, &(0x7f00000002c0)={&(0x7f0000ffc000/0x3000)=nil, 0x3000}, &(0x7f0000000300)=0xc) sendfile(r8, r7, &(0x7f0000000040), 0x10001) read(r8, &(0x7f0000000100)=""/252, 0xfc) dup2(r7, r4) connect$inet(r6, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) get_thread_area(&(0x7f0000000000)={0x4, 0x20001000, 0x2400, 0x80000001, 0x9, 0x8, 0x0, 0x8, 0x1, 0x80000000}) setsockopt$inet_mreqsrc(r6, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @loopback, @dev}, 0xc) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000280)=0xe) ioctl$TCFLSH(r3, 0x540b, 0x0) sendmsg(r0, &(0x7f00003bbfc8)={&(0x7f0000fdbf80)=@generic={0x10000000001e, "02ff0100000001000000000000000ae77f5bf86c48020002000000f1ffffff009a480075e6a50000de010300000000e4ff064b3f013a000000080000008f00000000ac50d5fe32c4000000007fffffff6a008356edb9a6341c1fd45624281e00070ecddd0206c39750c40000fd00000900000000000b0000db000004da36"}, 0x80, &(0x7f0000d1b000), 0x0, &(0x7f000012e000)}, 0x0) recvmsg$kcm(r1, &(0x7f0000000d40)={&(0x7f0000000800)=@l2, 0x80, &(0x7f00000004c0)=[{&(0x7f0000001600)=""/4096, 0x1000}, {&(0x7f0000000040)=""/37, 0x25}, {&(0x7f0000000880)=""/236, 0xec}, {&(0x7f0000002600)=""/4096, 0x1000}, {&(0x7f0000000bc0)=""/5, 0x5}], 0x5, &(0x7f0000000cc0)=""/71, 0x47}, 0x40000100) [ 336.444548] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:34 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x4, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:34 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x8000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:34 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xffffff7f00000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:34 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) connect$l2tp(r0, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r1, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x3a) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000140)='/dev/mixer\x00', 0x2, 0x0) getsockopt$packet_buf(r2, 0x111, 0x1, &(0x7f0000000000)=""/162, &(0x7f0000000100)=0xa2) 15:57:34 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp\x00', 0x400000, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r1, 0x0, 0x488, &(0x7f0000000140)={{0x2e, @dev={0xac, 0x14, 0x14, 0x16}, 0x4e20, 0x1, 'sh\x00', 0xc, 0x3f, 0x44}, {@local, 0x4e21, 0x12007, 0x8000, 0x1}}, 0x44) clone(0x4000000, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) r2 = memfd_create(&(0x7f0000000040)='lo\x00', 0x2) connect$netlink(r2, &(0x7f00000001c0)=@kern={0x10, 0x0, 0x0, 0x100}, 0xc) getpid() ioctl$LOOP_SET_FD(r0, 0x4c00, r0) ioctl$LOOP_CHANGE_FD(r0, 0x1275, 0xffffffffffffffff) 15:57:34 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0xb00, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 336.708825] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 336.800055] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:35 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x3, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:35 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x54, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:35 executing program 1: rt_sigpending(&(0x7f0000000000), 0x8) r0 = creat(&(0x7f0000000040)='./file0\x00', 0x0) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000080)={'nat\x00', 0x1000, "8bc0743eca8715ae3820801d9ce2ecd84e9985a167af7fdf12bc940e50edd55d2e9c210b0790c99258a64c106e4558cf039b3fdcaf1a3e9aca8238e6a6f5b78e5576b52871cccbe8d39322b3cf405a975c034b04a65f5569be0bf750c9f7842aeb7eead78c7d2c4b6702997102633263bba6a8bcd5be49fc5b9cd64a68a7a38824cf92bbaa65bf26f68df7085489eeaee5fa33037542b33e4567ad9771e11d4fa9fa43e1ca9656c7e91d6aba3ab71914a26faad20c2547c1fec07a883d8abc8bfac924c123720f67c0f60b21def4458d19a8a9d90e76e422c673a043304eb89d4a872b82f5c24747558c6f251c981a850fd6f6d91c2555d46468a2ae35825a252a2a5b450f59f1141b3fe58507af01b918cf3b4bec367bc492588c2081163fcd9117edb82bdb6376952315eb15d46f529b28749e3a1a20d87a29eaca5c6db78cf325e0c1b10a1dcb71a7775981a05d46940cf111aeb57b412b63388dbf5922b7870081a7da6b49d08f6c273978b52b9f4060c1201d855fa788e3a2fed9e0e345f037c9e70bdb8ae078338652ec2f12904184d44a1c529630357c6b54cb88252fc97dd987edb3a04af96335e3e7f3848f7fa2e298791dd9adaf3720f9e32b62d72ef350449013e323ac6b656f6e2f855e386b601d042c7675f678ceca5da749dbc661e8f552a7eb5bef6bd63a46c02c3cf13b09d60d3a008808bb11aadac61fb40d0333df5fa87bf14f72a4bca8882f197e2aea3a3d64e73a33390007b60d714508b6c029995ddd9e4b9ce70f0e76187f2e66a9223d9b46652618eba6be5454cb2d6928b032e250083eea933e29e3436b47ff5b328f4f4327eb70325a881411e906084bbc98c364b362ac80d570ab3170510ca2e957594b5c8d237a78264e12593b616bc9b0e717b84ed5f3104432b0e6e0301379024a755563b0192c47a3be6707f7ad4617e73a6ac357303a95261f823215827fe6431c5f56f0b3ffdb6b1d700d69796f16a66940af48a9235d168e1d7dd7b02602d9103ec083b5cd1712b7aa2eca260b82c4536c02ed8023544b552fd5f9655d3706e531c39c03481b630fd637341cd46c6402eaa673764b61f4dac224b7d53f05a7697ab2cafbe24764142ae2a2eb0ead4dcba8303e5bdffcfb9a8bedb190cfa07e80a411ece0175ec71462075ae99ee485e29cf2953d073fd8da63a2234245d688b7b570e098c8c084096d95a2446b8c81635e66d1f5390a8ace2ab8415337f21488f60ceecc02ebaf79c3883fc4cdc4bad0e080a30e904d95a1ae82afffa6e4d1bf92e2399f4f7efbbea40bc1f1c5831f16e7fcdb0a9bcda5e95273f8085bfb922865cdfce5ef93b7dda683b4bc5deb3014accc7e2a2cb5070a5ed0cf8a97f5764ef12352478304405c7f5547bebb028cba887146d5a1fd29a2f92e0315425d19f588e86e424cab797a1fadae805210d851df94f880ea3ba0f28f781acd95f24511b121c76d5a77c3cb09b674fb6553e8ca16e5173a6911cdc34c9543c0f03a23c2c220ff09b88746d661ecd5a7e3768cd96f10e82726d88b04059e1030f6d9e50eea57034018cd5e8de866d502a2ed52790728159d4150f09d879880dd82cf74bc979867d9ac467bcfd6e0786bed95d0b2d492f3fddb79042fa829316202680b20f6f86b4acde5a161ce17ab60328935d9fd7c7577c933c16606a367f48115c64701572f3692b0de8eef5abfb4a11f60468a124ed1559bc5282fb3259d14b6368ca1cf46f6517ac86145bf3c993b7e0d2f9cc616628bb5b5273caf69c0c10577e21e388b731d44bc91aaf0db492d299784b8df18a8d872cafbad34302e67962d38a7d048f85c56591000f9f289e43c5b86c1facbebca7005e148e1669bfe3f63268a999ae5517bc977f117bc4e43b58e8fc5afa1225d04dd75ac5a5133dfe95cbd9c0b1330438ae8613b3abae59d5adccfb45ece4fa10ca821b19f3b15074a57cc2cd223f8e5a5651b8029848e8acf9b1cedd6f346d5a7e107bd8870470b6b1575c3c0730b5ba38d67360212d047874ba7138c367289a6bf0404f15af137ba41ea4ade153d384e3c2efca9e8d380037925add34c68401c7e084731aef6a7b5a8565279de51bd041488b16f78f262cf87160c44ded743e71b76e3f5bfe27d0d3ea011d56666e187745933fea02e43e11b5fdef9422640c22e0e05a2f93745bf52fd52b4c5083c9050717e61f18d1997aad90425fa75ae6360b7e1d0848a7f5b8a4da913414eef0bcc85368f9f219d8bfaec98d16f3be37b1ec2a6f42cfeac5caa167834f2edcdd67ffc235bdba444b73b3b52958cfe6ce37d77da550750d7e36c8df17ccb28c665d7b2d7259ba168f0156eb1440d8d0ab268b1b1c3ea75c9ae925d3decdfacce1b7e42f3932f53be98458485ace799e3e7a79305473308aa2c9636ff17cc4e40e833a76bd9f4fddf89344812607c578e29ecc3c67d876aa2f4bf10be14acf8aebbec55e8bf9c9b8b78687ce94676bacac133bcb2e2d17a5b6def7d0f778eabbce549ea8e8f55f26cb2e73c1c864d309aa2ee7afc9bf222440a281db60e30d5d71f511d69c4579b57a506dd0fa0851aa302b87f24a4fe05444f234ba94b1c4cf077c4a6771d69bf088d8a2714c076cd03a4330934a04f6127156d192424458c809f0cc8b3823e5a2844e163f691dcca6098d22c315389423a71f0e20b9b8ee854c6f47d70ccdfec8c32692d87bc679599cc4720933dc099e1cb179f074c295e09d32a5ac86d122d2a583d580dde0e3cb0ab912a9c45c60f3d1b56e19098dd2a23cb48e3cdc02cd06386fb4a94ce666e5be909e447a6eefb473655601b365862fcf3456ced4a0c12393e11ace7b15b81a08fc2a9dd5907a807a0ed2b3c5c51d25d58296abfc4b31802a715020946ea18517ce94ddbe9808cacad9c321b32c4867ed6d0ea24e56e7325bd30d5f1037670f25627984f17baff51fffc5856eef1431eb88b69ee9c9761d4cb663090872260330ceda89c3700e6cd472d9cfd7b26575477fe6607d5cf934243744c13674b864faeae116badba83197a423317bb99195ab009518e23e1a3d9e44bf40806103d4bb57ed54df5565f4717801341c90a57a166517eaf335f5e25dbb7b07177880dda2796d14ef56cbf8ad56fb68cffccdc132fa8b48577e90ac77856a8771c964a0da0432239d51003b3cf13edc75ff62dd3329be00ae34856ec5ca407a428c3631564a5f630d8bfd5c0cc9b4e98c65e299c1ed2b63d0dacc6404c2573d823f635ba05eb2eb1f2cd5d4498dd1519d6942b0084245427cfe65f16e1f6af93978953af6a9a9768ab4f1168e4cdeeea9dfc252cdeab1058ecb34677b97be69ecda9bc0552753d4cc017f3cec44876a81f33de457cf67c38f1296c99b5834a234aabc0fa42f2fb02faf7139d6a612a5a433d22a5a0cc18d6c3481129205852d39dd53d1b13302df68d2825f2fd30f440245201b4105bf5f2b7b55fecd13e94d3b8960efcd46f851eff94867392f5dcd4b60408ade6f04a548d4f94036b38654769ca2c74e55cd9080eb9247cb75b62430605ea10011eb4ef19c19d361dfd9ba92ff590f91b522f1dcb7c292203fcac54ce87cc363fbe6d644305ea2efe24a82da7030ed42d486efc041ceae1962eb60bb54d1a0102e9b9eeddc330e340e372e38044ef1509696bfb15cb2e966b4211e5ecf98646f4d788e274bd894f7991b5a0451f9cb5ef88896a5f94bae765e5b743f0a007142ebc3401ffd8199ae4c752bc9237855b2fc9d165b87ed51a35e79f7de7d02a97cb2d17e0706d1dd0cd3f522dd1b32f78cd391b2f90c299112578af40c5e1f4f6a77d1ec98deefdf0592dc17c6284860da2b8f72cf39d82a71a6d3b0ffa0feb86fb3b775bed93d6cae7df08431f3d53b75cf85cf80e10690f459e5021e18224dc7d37eafce9b29309c8ac63695443509f8ed76ca9467808b4b6303e64b48797f64b9902627d29a205dab36d23dcdc61f4cd110d62d0028fbf9db4b0a8f984163e7de2cee6e60fe362383fa6d3a2ff5bbb4525228effe07700f72eabd2daad1822b1ea734e446cb78b3a73e739a94f0eebeceb0760a24a7d55eac7297cfe6fbbba87a5c6971726d5060dd8bddb39265a0d005d6e27cf5d1db278f9e12850be38097f84f1a04c1894b710e57a36073a8095326296c22f81d5029ebc2aef29f6df0e24de9108e2d739538c0b177dea81e6476be4c9dfe080bcc239cfd5e0b041c903031ef1e9556037382a649186bbbb092e79f63d72530031412b12394b8041e2f48374ce1f40203a89679872eef71e9e370cab2d77250ea49039bcec87bb55f761fb84c9235ea565daf34b03f6fbc2836b66d0b702f6039d35fab6882427e58948e518669bb26405fbf803fb197226f8fc9a56ebdda00a8b9bbd9b83acd88d105dd9f9153b4f9c1794fd93d7dac76aa63375e0073ecb6d8fbb88e7c7b6c076864eaa594f4a668c787b7a93f4d17f0c44e903f6a1cab301086c35c3e4732853275df6b94c4bea00415e96eadc616d40d34173ea7f066c7bae00fa21cb66308d81746cbb450a7fb9d04f93535c700fc6abce96ad48f19c9dbe9f38444e081df2961404a0e6c9b7fa1ba1898b8b6818359cf9cdd584a9682b7a6c1fcae27856e553d55c90d6aedf70d0ff807d400afeb0bab02d9fa35fe1da315f0217d937cfec1545b42b74bb6523fffebdfb394f0c4262991af3b1bdc1e14c7f482e5bfe06e7497ea7de2ca495cdce851403faa7617b9ce640411074ac1b734b994924dc9c970276348453d48f331453472104d8ef292d9e3445a35bb45851cdc43cf88c625e61f1cc784284686d73696ff60aa492216a5360b7bc1f4df64c15302a3cee55964ac1ccd1dc87d9976440abdb968672840e6c8319474b2c6200388c41bdb70f8563842be639c4732307e974e15a74b63f786d5f741ce754fd0ebb17bdcf5adfcb8032745d445f1772a4cb77f51f872e78ff967172c7b527d5ac939a6ab4dc26503e1b7dbe75d1c2fde38a529a00e9b3d77a8537f2520630b5736ebbab6d6901debede8ebfa786361b2ebe6b1994c3b9b534802a7e0b553b22e538ce93dbe991d64566b70bdc071df81977e4d9b416b91016c275e5507fa5c60ef9974e4e7be84470205a0f615195e6a4dbe30c371cfb3ace0f2162fb79e334c44d1034a9c02de68a2823fe69010119324418c833f34fe5cac7c2837a398805a36e20f71a32891c6a506cc6526e8353f145182b44af144e93e518b7af7d92653321db2f876e1482e1e866985596e843f6fecc641c8421b6b8d9653325043203df8fd03b981bea3c8e22c7afbf8274cc79894f0b8e4e6723b484281627f8601fdfd98f5c6948db56d5f64fbebeb2b66833437e77cc211dfa92b206fdc5e14c71feddab1d013177354be7407dfcd2bf010406c1171b7c30acad558cd6b04424f5ba6602b922b1b54fca38201048c24f57c36ec45afbf41e2dcf133b3cb5453397653941c7520bfc0ce572524b9330f075c58f77d7594d2ba3f59ec0fe6f422cc745a7f2bc430609107f833b961d609ce33282494a83b502907fa41cd4bb2be34e997b7373c63adb986471a6ef281007578ab7711a9e7cae2502aa927c3bff8af79f8b8e3d08e04617c4c8696b8c3eb1a6b97a42df0776984121152e09f309ee3911bb3ac4f07ee383a78551a8b88d72a56c4e85dbdf2b3d5590eeda84ce0c79c0e2a9b38cfae3e5b2e48156059d0090c4608ab425e3dbcceac3580f9709eb14b6a1bf843b2edba7817fbe983fc139"}, &(0x7f00000010c0)=0x1024) ioctl$RTC_RD_TIME(r0, 0x80247009, &(0x7f0000001100)) r1 = socket$inet6(0xa, 0x0, 0x3) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000001140)={0x0, 0x401}, &(0x7f0000001180)=0x8) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000011c0)={r2, 0x100000000}, &(0x7f0000001200)=0x8) socket$kcm(0x29, 0x7, 0x0) unlinkat(r0, &(0x7f0000001240)='./file0\x00', 0x0) ioctl$TCSETAW(r0, 0x5407, &(0x7f0000001280)={0x180000, 0x5, 0xfffffffffffffffa, 0xff, 0x1f, 0x257, 0x9, 0xfffffffffffffffa, 0xfff}) setsockopt(r0, 0x0, 0x2, &(0x7f00000012c0)="cdd1e52ed28397c55a031b1527e62a64e4707275f4c9aeeb9f355c226a4413980bf523217e2a846db74064ae4b6a08cbe1419316148c45a00e6948a7a5fcb52df252606a06fbd5f83b0e317997fc3905823066c3e63bba3b94f75eaed329f1642df22f0bb46d24a1c050915f5ae4f2be44f33ce4e32bae58227df4ff136b5a1bdfd81d49570c2751dfd91efc350837d9c997e796a1508fc56b1da7ffaa35fa6a9a7cd8cb3f69d5a59b541cd80f504a96935ae841f4cdd5d574273b2e5ed29a617712c5eb69a69856617107d93f0e5a0eaca99b18c0886ae338364c8676b1ba4a093ab046f0e05b101952425c5b3374653e0f6f", 0xf3) ioctl$IOC_PR_PREEMPT_ABORT(r0, 0x401870cc, &(0x7f00000013c0)={0x6, 0x5, 0xff}) pread64(r1, &(0x7f0000001400)=""/213, 0xd5, 0x0) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r0, 0x84, 0x21, &(0x7f0000001500), &(0x7f0000001540)=0x4) ioctl$sock_inet_SIOCSIFBRDADDR(r1, 0x891a, &(0x7f0000001580)={'ifb0\x00', {0x2, 0x4e24, @broadcast}}) r4 = openat$full(0xffffffffffffff9c, &(0x7f00000015c0)='/dev/full\x00', 0x0, 0x0) getpeername$packet(r0, &(0x7f0000001600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001640)=0x14) bind$packet(r4, &(0x7f0000001680)={0x11, 0x18, r5, 0x1, 0x3, 0x6, @dev={[], 0x13}}, 0x14) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001700)='IPVS\x00') sendmsg$IPVS_CMD_GET_DAEMON(r4, &(0x7f0000001880)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x40000082}, 0xc, &(0x7f0000001840)={&(0x7f0000001740)={0xf8, r6, 0x210, 0x70bd2c, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x81}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}]}, @IPVS_CMD_ATTR_DAEMON={0x58, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'rose0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x7}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x3}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x3}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @local}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}]}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_to_team\x00'}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ip6gre0\x00'}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1000}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @remote}]}]}, 0xf8}, 0x1, 0x0, 0x0, 0x4000}, 0x804) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r4, 0x84, 0x10, &(0x7f00000018c0)=@assoc_value={r3, 0x81}, &(0x7f0000001900)=0x8) getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r0, 0x12, 0x2, &(0x7f0000001940)=""/170, &(0x7f0000001a00)=0xaa) ioctl$KVM_GET_VCPU_MMAP_SIZE(r4, 0xae04) r7 = add_key$keyring(&(0x7f0000001a40)='keyring\x00', &(0x7f0000001a80)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, 0x0) r8 = add_key(&(0x7f0000001ac0)='logon\x00', &(0x7f0000001b00)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$link(0x8, r7, r8) socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$TIOCSSOFTCAR(r4, 0x541a, &(0x7f0000001b40)=0x163f) readlinkat(r0, &(0x7f0000001b80)='./file0\x00', &(0x7f0000001bc0)=""/4096, 0x1000) ioctl$sock_inet6_SIOCSIFDSTADDR(r4, 0x8918, &(0x7f0000002bc0)={@loopback, 0x2e, r5}) 15:57:35 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x3f00000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:35 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x100, 0x0) ioctl$BLKSECDISCARD(r0, 0x127d, &(0x7f0000000280)=0x80000001) r1 = socket$inet6(0xa, 0x400000000001, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x0, &(0x7f0000000000)=0x5, 0xfffffffffffffdba) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, &(0x7f0000000080)) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f00000001c0), &(0x7f0000000200)=0x8) sendto$inet6(0xffffffffffffffff, &(0x7f0000e77fff), 0x2bd, 0x0, &(0x7f00008d4fe4)={0xa, 0x0, 0x0, @loopback}, 0x1c) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe2(&(0x7f00007f2000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r4, 0x10e, 0x3, &(0x7f0000000180)=0x7d7d, 0x4) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r4, 0xc0405405, &(0x7f0000000380)={{0xffffffffffffffff, 0x0, 0x80000000, 0x3, 0x1ff}, 0x5f, 0xffff, 0x8000}) ioctl$EVIOCGSW(r3, 0x8040451b, &(0x7f00000002c0)=""/151) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x117, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r3, &(0x7f0000000140)={0x1, 0x78, 0xfa00, {&(0x7f0000000240), r5}}, 0xffffffffffffff54) ioctl$sock_inet6_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f00000003c0)) vmsplice(r4, &(0x7f0000e79000)=[{&(0x7f00003fb000)="f7", 0x1}], 0x1, 0x0) mbind(&(0x7f00003b5000/0x800000)=nil, 0x800000, 0x0, &(0x7f0000000080), 0x1, 0x1000003) 15:57:35 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x3a) socketpair$inet6_icmp_raw(0xa, 0x3, 0x3a, &(0x7f00000002c0)) r1 = socket$inet_dccp(0x2, 0x6, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, 0x9, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod(&(0x7f0000000100)='./file0\x00', 0x1040, 0x0) open$dir(&(0x7f0000000080)='./file0\x00', 0x207f, 0x0) socketpair(0x5, 0x2, 0x1, &(0x7f0000000a40)={0xffffffffffffffff}) ioctl$VHOST_GET_FEATURES(r2, 0x8008af00, &(0x7f0000000500)) getsockopt$ARPT_SO_GET_ENTRIES(r1, 0x0, 0x61, &(0x7f00000012c0)=ANY=[@ANYBLOB="66696c7465720000000000000000000000000000000000000000fa414e5c5e6f47b130f916bce8cd4c12635dd60e81d483e584f640d3eb652d46adef1924f3932ef2665e24c621596dff01fdbb72f328f8184560cb598e14af3cd42f83d92c4231e399b409b1535e2c7a69f46313bf8dff4e43d17999e513142e705ca01582e75f77b786b88f48da14efd3b97f62d6508e9ee43aa2a88820cd2774237ecfc45f47b29d291d4eec4bc2fb84bef1b3b6370300000023d1b7ee44a776651a28c155d2e75667f5ee72caec628031abc19aeff3f2953f2b355df2ffea1b571afde7c768cd212f6efecfea83fb4345922e99ced7b134709e5d837e778e05173492927063839f7ff1a97433f2b5136f592a7c3ad36dd918b3f90cc1327efed4dac5fc6b5c86b8c20c0c8050bd35e6370f9aa5fa0846523d4277b16c27b8cbbf095bee62023a17d69acd31a4cfb4aa53caa47ca9b7a2330925023707d600000000c226430a6a40e2f18cc5dcb3163fb3f3b7563228d63acd4d005d892dce9ec8df2127ccffd3213a1ec308e95e608938f582bd16fd4fb68916ce9e0397da78dbebd978b1e38e556e8038b73d6c390012e60400000000000000fda6604f2bd4f5ff302f56035e107306622e538cc88544d1b37cd93ad4e7e8214527ac3a75ec0a0049662f81ebaaf0949318b25aa4b1c9564268caffb115270b06ccf75fbabf1f92b91f56e69039c94b01000100afedc1782219619e4ed34fa555ebcadc919e55001470345f6071826c2bb0714ff8f51596e6ae2513090da4f7dc618ce8a3441858d9970300000041fe9cf268ac8eacc4f0d96f4ac9c8cdf1f6ac554d2392ac070014010a09a612719ad0c61f71b90f487dccad69f4822d07d18419f2a2aa038fe0fd10fef385a51901b74f5dc1f438c6977f19f853211e44e7cb53118b8757f86caf1486666c6d2e74fd66855b70f38c087be437cf1272c92bda4de818cdb2d5177d41c479414335b57ae6c69e58ef7d00107965c948492e0775d539f820eb5172765b89c716c91a1937142c105471f3fc27be0a3e82dd4f92a29484370f26054f90393f5ac00949d4d01013d32e3245fe8acd7c9ed8aa6903ded1f8f9e96eae876feb267c8d52105ac9b80bc5041904a9c0074c72cf2716679bb41c82c9d3b041e5dfcbe3feb5f547def3d7aa54d5c240d49988ee7e9b1b5ba37d87400170f62897a7b31271369b7e76d6df49eefce7413f27fa6c59ef65149d06681a87a7574bf17b762c901f08e8f6ab8e85929a5dc60da3150261d13820148c0d94bae317c5ad6c257c167cd4532597c5c4cc4bf0ca796f1690cb3a0bf9dbf45103fe0c1c24e4018c3080081efe7bdc837ce8a86818ba76971db0e05c6e6ed12fe708c0001b99d5b0beef6e5ac662693c9cb2c3ffcc21f4ef488e94776848d7a2f645c8df75b69943ae7810b358051c7102c7cb4088b3b2ad9012be13bb94a7c11effc395a130c7587b3e54bb7e4bf0f432d155894d9227ec7b964b6ec051134068bbd67dfa7edcf2d2cac95dcf5e30ce3e52e779eddf224f955cbb0c9744c7d86a448bc800db5375dc6f4ec4de6b2c0f0e13cbf501e2445391a39716049bcc26a558478ad412b7683767d346a58f67b922c9a7170000"], &(0x7f0000001100)=0x1) shutdown(r1, 0xffffffffffffffff) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt$inet_mreqn(r3, 0x0, 0x0, &(0x7f0000000080)={@dev, @rand_addr, 0x0}, &(0x7f00000000c0)=0xe0b9e19e9977e3c1) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000a80)={@empty, @ipv4={[], [], @loopback}, @remote, 0x200, 0x81, 0x400, 0x503, 0x4, 0x4000001260302, r4}) r5 = openat$full(0xffffffffffffff9c, &(0x7f0000000900)='/dev/full\x00', 0x10000, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000400)={{{@in=@rand_addr, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@multicast1}}, &(0x7f0000000540)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000580)={{{@in=@rand_addr, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@multicast2}}, &(0x7f0000000780)=0x163) setreuid(r6, r7) ioctl$ION_IOC_HEAP_QUERY(r5, 0xc0184908, &(0x7f0000000340)={0xfffffffffffffffe, 0x18}) setsockopt$inet6_MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000380)={{0xa, 0x4e23, 0x5, @dev={0xfe, 0x80, [], 0x10}, 0x8}, {0xa, 0x4e24, 0xfff, @mcast1, 0x2}, 0x6, [0x4, 0x3, 0x9, 0x9, 0x0, 0x3f4b06b4, 0x1, 0x7]}, 0x5c) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000008c0)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000b00)=ANY=[@ANYBLOB="00050000280000002970002000000000002f25a85ffe404128be5cd3d1074c8c4758aee9072c1603415f43f705c496a9d3fbeee5cd636f44124a23769749ac96101dd4f5dfc97c4a91bd60cb3c76f7956280a545407cfc7f6144ab4f15b1e06b80d5eb8c"], 0x1}, 0x1, 0x0, 0x0, 0x4000}, 0x4004040) setsockopt$inet6_MRT6_ADD_MFC(r8, 0x29, 0xcc, &(0x7f0000000200)={{0xa, 0x4e22, 0x7, @local, 0xff}, {0xa, 0x4e21, 0x1ff, @loopback, 0xd73}, 0x3, [0x7, 0xd11, 0x7, 0x7ff, 0x0, 0x3, 0x3, 0x22]}, 0x5c) setsockopt$inet6_tcp_TCP_CONGESTION(r8, 0x6, 0xd, &(0x7f0000000680)="696c6c076dbbbbe273e5e184a825e4501b4bf0dea0987ed65d98c01dd4557ab7c3d7cd247e2607e1b9bc4521d2564c58b69e0a7085ab9a6c0b7e1edfa6e34b78889170a5da8d9fd80cffab140bc4072fbb38ba1fff9b3f9412ebb11b819462889734d2a054156fd6e47b433a92e6dc7a80c0b0e7f4e940782c83318e49c647b53309df1c18a9e7554269c6836b3e8272ab4b82bd4a69325a547d885988088e149e6619293d3e5fbfa44805c1821aab1f0eea35fb2da9f694d2db0cf60efa74d51643943e2c3e8bc503f6c717e9a65fb3afa617a75477acaa7f178d74d31795c6515bef32207d3f9ac03876aa2c6e8d874618c9a373168ac41b4f552adc9e3d", 0xffffffffffffffa3) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r5, 0x84, 0xf, &(0x7f0000000940)={0x0, @in6={{0xa, 0x4e21, 0xfff, @empty, 0x3}}, 0xa1c3, 0x7a3, 0x7fff, 0x4, 0x7fff}, &(0x7f0000000300)=0x98) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r5, 0x84, 0x18, &(0x7f0000000a00)={r9, 0x1}, 0x8) r10 = getgid() setgid(r10) connect(r8, &(0x7f0000000840)=@rc={0x1f, {0x7ff, 0x1, 0x5, 0x930, 0x2, 0xfffffffffffffeff}, 0x7ff}, 0xf2) setsockopt$inet6_int(r0, 0x29, 0x40000000000000c8, &(0x7f0000000280), 0x4) setsockopt$inet6_MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x4e1d, 0xfe, @ipv4={[], [], @multicast1}, 0x9}, {0xa, 0x4e23, 0x10000000000007a, @mcast1, 0x4}, 0x5, [0x4, 0xb, 0x6, 0x6, 0x7, 0x6, 0x0, 0x2]}, 0x5c) setsockopt$inet6_MRT6_ADD_MFC(r0, 0x29, 0xc9, &(0x7f0000000180)={{0xa, 0x0, 0x0, @ipv4={[], [], @multicast1}}, {0xa, 0x4e20, 0x0, @remote}, 0x0, [0x0, 0x0, 0x69c, 0x0, 0x4]}, 0x5c) 15:57:35 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x600000000000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 337.363914] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:35 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x100000000000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:35 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x5000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:35 executing program 5: fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000080)={0x0, 0x0}) r1 = syz_open_procfs(r0, &(0x7f00000000c0)="2f65786500000000000409004bddd9de91be10eeaf000ee9a90f798058439ed554fa07424ada75af1f02ac06edbcd7a071fb35331ce39c5a00000000") ioctl$FS_IOC_GETVERSION(r1, 0x80047601, &(0x7f0000000040)) ioctl$UI_SET_SWBIT(0xffffffffffffffff, 0x4004556d, 0x0) geteuid() 15:57:35 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x48000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:35 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x3f000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 337.578306] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:35 executing program 1: r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) r2 = fcntl$dupfd(r0, 0x406, r0) ioctl$KVM_DEASSIGN_DEV_IRQ(r2, 0x4040ae75, &(0x7f0000000040)={0x5, 0xfffffffffffffffa, 0x1, 0x200}) bind$can_raw(r0, &(0x7f0000000080)={0x1d, r1}, 0x10) close(r0) 15:57:35 executing program 4: add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080), 0x0, 0x0, 0xfffffffffffffff8) keyctl$assume_authority(0x10, 0x0) mkdir(&(0x7f000002b000)='./file0\x00', 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket(0x1, 0x3, 0x9) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r1, 0x84, 0x6e, &(0x7f0000000000)=[@in6={0xa, 0x4e22, 0x81, @loopback, 0x200}, @in6={0xa, 0x4e24, 0x6, @mcast2, 0x10001}], 0x38) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(0xffffffffffffffff, 0x40042409, 0x0) ioctl$sock_inet_SIOCGIFBRDADDR(0xffffffffffffffff, 0x8919, &(0x7f00000000c0)={'dummy0\x00', {0x2, 0x4e22, @local}}) r2 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) pwrite64(r0, &(0x7f0000000100)="39db128992f4bf069e0820b679271e30aa9601e44a1dccba85eea541711c9087ec3ae5246c0679f798d99758c84f40f262d7fd84a080f3f96a2b8b89df1cd146da8802ff25fd941765f24b95823d413237ec33aece6ba35307670e29614109744ffce37dffa7d3b9daf5e9e77748fc79966d02dc602e6358c97888bd1c92ffe13e37fd412a0b789c643b35776ba9567bf858308c8ac6f63f82bdb54bbe56bd0b13398c6aa623decda7cb4ffa42c7ee9757150d1fdaf852b8b55b828dd96277e77cb8bf98d178ed028e08796bf3cfc771227c2a99df19b31137a5dbb54016bed6c632e1472c5e9ff90cdf5648cf9ad61712", 0xf1, 0x0) mmap(&(0x7f0000a05000/0x400000)=nil, 0x400000, 0x3, 0x8012, r2, 0x0) 15:57:35 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) fstat(0xffffffffffffffff, &(0x7f0000002340)) lstat(&(0x7f00000023c0)='./file0\x00', &(0x7f0000002400)) ioperm(0x0, 0x0, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='projid_map\x00') ioctl$NBD_SET_SIZE_BLOCKS(r0, 0xab07, 0x3) readahead(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000280)={0x0, 0x7a, 0xfa00, {0x4, &(0x7f0000000040)}}, 0x20) socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(r2, 0x84, 0x4, &(0x7f0000000200), &(0x7f0000000240)=0x4) lsetxattr$system_posix_acl(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='system.posix_acl_default\x00', &(0x7f00000001c0)={{}, {}, [], {}, [{}]}, 0x2c, 0x3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = memfd_create(&(0x7f0000000300)='\x00', 0x3f) fcntl$setlease(r3, 0x400, 0x0) ioctl$sock_SIOCGIFCONF(r1, 0x8910, &(0x7f0000000080)) execveat(r3, &(0x7f0000000000)='\x00', &(0x7f00000001c0), &(0x7f0000000240), 0x1000) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r2, 0x84, 0x1b, &(0x7f0000000480)=ANY=[@ANYRES32=0x0, @ANYBLOB="5b000000733e6d1a0eff5c896d3b584f3ecd8ace3b89fc25c37736913520ca8b14a992e44d11e9b17695cc374e34c371e63d53ea571c5f5ace7481f2a44f7b7d18a829de4830ee5aa065ff42ccf165d588ae5673e807fe2a296e3792985bc53a872a30de1a4df78f77dbfe89b98aba6684983f396c5287c9ad1dfd585f5be0630389c83c64e4b191400553f89773be6b20145d22fa7f4bea6dd7a4d8f79fed8c4c1760476b2ea160467df2ed59a145ada9317056b88b355a98a8d246c31df6af737157c33050f1bc997d63f5f56f11265157b603ba865f39ea0ff99322e28b"], &(0x7f00000003c0)=0x63) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, &(0x7f0000000400)={0x9, 0x1, 0x9, 0x100, r4}, &(0x7f0000000440)=0x10) ioctl$RTC_RD_TIME(0xffffffffffffffff, 0x80247009, &(0x7f00000002c0)) 15:57:35 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x805}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:35 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x700000000000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:35 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000000)) 15:57:35 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x600, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 337.809409] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:35 executing program 5: r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000000c0), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045532, &(0x7f0000000000)=0x9) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000240)=[{0x7, 0x3}], 0x1) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) ioctl$KVM_GET_XCRS(r0, 0x8188aea6, &(0x7f00000003c0)=ANY=[@ANYBLOB="040000000800000000cdde8dfc00000105000000000000003f000000000000000001000000000000154300000000000006000000000000000600000000000000f7ffffffffffffff658a835ed8008f1f88512cf5e621cc4500f5"]) mount(&(0x7f00000000c0), &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) open(&(0x7f0000000380)='./file0\x00', 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000480)='/dev/ptmx\x00', 0x1, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, &(0x7f0000000000)) r3 = eventfd(0x401) ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af20, &(0x7f00000002c0)={0x0, r3}) write$binfmt_elf32(r3, &(0x7f0000000280)=ANY=[@ANYBLOB="f1ffffffffffffff"], 0x8) epoll_create1(0x0) readv(r3, &(0x7f0000000100)=[{&(0x7f0000000180)=""/199, 0xc7}], 0x1) syz_open_pts(r1, 0x0) write(r1, &(0x7f0000c34fff), 0xffffff0b) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2000005, 0x5c831, 0xffffffffffffffff, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='tasks\x00', 0x2, 0x0) openat$userio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/userio\x00', 0x942c1, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000100), 0x12) 15:57:35 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0xb, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:35 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x4000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:35 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x3f00}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:35 executing program 1: io_setup(0x3, &(0x7f0000000240)=0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x40, 0x0) r2 = syz_open_pts(0xffffffffffffffff, 0x200) io_submit(r0, 0x0, &(0x7f0000000040)=[&(0x7f00000002c0)={0x0, 0x0, 0x0, 0x7, 0x0, r2, 0x0, 0x39d, 0x0, 0x0, 0x2, r1}]) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000080)=0x0) fcntl$getownex(r1, 0x10, &(0x7f00000000c0)={0x0, 0x0}) setpgid(r3, r4) 15:57:35 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340), &(0x7f0000000380)="e96cc673f26b40aff960", 0xa, 0xfffffffffffffffa) r3 = add_key(&(0x7f0000000440)='encrypted\x00', &(0x7f0000000480), &(0x7f00000004c0)="d7f7fc995e29e1fb43ce00c419dea5033db1609c84b32838657832b089ef009d2edf200a7ba65002638a2ad6dbde0c2363127e7a022582567c721f8ee7c281ac2878f44f8c6bc98b18ab16a8e2f7c143714a30709e1c41f13dd88a0c5df7cedd7f6d89173b9abd13c1b8cc0592e1f1008e468cf04e0899dcf48011d9492dace9e00f03bf38fe5c379322a497161651db8091b7a6a154519e71c8f37f3aa35123d4d4248629f3ada5a86ff21d4d74664cc3f9a8cec263d0e2cc6c99dc1d9064d989882cdef5e4bf6a25f3d504d676", 0xce, 0x0) keyctl$search(0xa, r2, &(0x7f00000003c0)='trusted\x00', &(0x7f0000000400), r3) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$VHOST_VSOCK_SET_RUNNING(r4, 0x4004af61, &(0x7f0000000200)) mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1000005, 0x10, r0, 0x0) ioctl$int_in(r1, 0x5421, &(0x7f0000000040)=0xe8b2) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r1, &(0x7f0000000000), 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) pipe2(&(0x7f0000000640)={0xffffffffffffffff}, 0x80000) getsockname$inet6(0xffffffffffffffff, &(0x7f0000000680)={0xa, 0x0, 0x0, @dev}, &(0x7f00000006c0)=0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000015c0)='ip6_vti0\x00', 0x10) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$UI_DEV_DESTROY(r5, 0x5502) r6 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x105082) prctl$setfpexc(0xc, 0x0) r7 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r7, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a8", 0x1}], 0x1, 0x81003) sched_getaffinity(0x0, 0x8, &(0x7f0000000700)) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) ioctl$LOOP_CHANGE_FD(r6, 0x4c00, r7) sendfile(r1, r6, &(0x7f00000ddff8), 0x102000002) ioctl$DRM_IOCTL_AGP_RELEASE(0xffffffffffffffff, 0x6431) 15:57:35 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0xfffffffe, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:36 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x800000000000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:36 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x7, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 338.103760] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:36 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x5}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:36 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0xfeffffff00000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:36 executing program 1: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r0 = socket(0x0, 0x0, 0x0) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f0000000100)) wait4(r1, &(0x7f0000000080), 0x80000002, &(0x7f00000001c0)) setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) [ 338.247255] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:36 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x3}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:36 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x5400000000000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:36 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x4800000000000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:36 executing program 1: r0 = socket$bt_rfcomm(0x1f, 0x3, 0x3) getsockopt$sock_buf(r0, 0x1, 0x1a, &(0x7f0000000100)=""/206, &(0x7f0000000000)=0xce) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x200400, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000080)={0x2, [0x0, 0x0]}, &(0x7f0000000200)=0xc) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r1, 0x84, 0x6c, &(0x7f0000000400)=ANY=[@ANYRES32=r2, @ANYBLOB="a1fd00009b33dd5c27d1861659aff995485fc587b93433a5dd55575d7f25687dd6c4dc605c6c9e9d4337a37faadcc72e8d1621c780d618c5840a284c86dc0d35b38d98b5b0fb75f09056b806d3183a5efe6971d083432750b4dc717224e4fc07a60484051b68234c844dd045ba5033c03035c14a1dcca141f137bce9ce686dff93118b0977cf337e6ea435c8201721e8dd106bf6005906c187b6d1a80ddc9c26fe7ffac8f83251f1ade4e157d238ef809e55d8ed33bdaa9400db4b163373d509bb402ba9b02e5b774565ad7671b13241111fea6b6d865d78ed8eaa43d0b04ae305f5947917182b8242b09899d4ca5bc05474c806ab5bbe66da40585ad1f904ad6b4567e5487bfe87abd44e4339eb8bb6b38e6da74a4a82599452864844827606091e54cc32cb33021a085c46f073547b22925b45eb29068ae75c5d308677341cda872c11ca4b47fb811b1b9572db768d0ce723c788f7f92eb78334abda046f2eb6689b18f2a99e10d304d8ec6958cf42fe9f8e1e77dadc2964f08a601255ed31c0ada1"], &(0x7f0000000380)=0x106) r3 = socket(0x10, 0x3, 0x0) write(r3, &(0x7f00000000c0)="3e0000004e001f00ff03f4e8002304000a04f5110800080002de4a860ba362969c8f849c206d20a880d42f15a4a16748fb53000000000000000000000000", 0x3e) 15:57:36 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000000040)={"6c6f000086003f8b000000001a00", {0x2, 0xfffffffffffffffe, @rand_addr=0x3c8}}) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f00000000c0)={'lo\x00', {0x2, 0x4e21, @remote}}) 15:57:36 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r1 = open(&(0x7f0000000380)='./file0//ile0\x00', 0x8000000000, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$bt_hci(r1, 0x0, 0x1, &(0x7f0000000540)=""/66, &(0x7f00000006c0)=0x42) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r1, 0x800442d2, &(0x7f0000000680)={0x4, &(0x7f0000000100)=[{0x0, 0x0, 0x0, @remote}, {0x0, 0x0, 0x0, @dev}, {}, {0x0, 0x0, 0x0, @random}]}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000000)={"766574000000000000004c00bd6800", 0x43732e5398416f1a}) r4 = syz_open_dev$vcsn(&(0x7f0000000240)='/dev/vcs#\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x40042406, &(0x7f0000000280)="2d245b8800") r5 = socket$nl_route(0x10, 0x3, 0x0) dup2(r5, r0) write$FUSE_NOTIFY_STORE(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="290000000000000000000000000100000000000000010000000000000001000000000000000000"], 0x27) ioctl$KVM_GET_SUPPORTED_CPUID(r4, 0xc008ae05, &(0x7f00000005c0)=""/118) getsockopt$inet_mtu(r4, 0x0, 0xa, &(0x7f0000000500), &(0x7f0000000640)=0x4) 15:57:36 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x5c00000000000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 338.874148] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:36 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000300)="637075616363742e73746174008ec52208000000f2022d9f7a9c120bf327364de681044608c60e1a952eaa0a675adcfccb8519163a24afefd3af0f62a603c44a06cae7e0f16f8e6c866d6ad966b23d370a630aee6257fd207ba2cd195f9c4237c19c3c81b3978dc2ccb2b6be7b601b56929eb6843deb0eb0486a39b7523d9d73222ad234266c2e683c62387f4855cf56ef93a8d4a891f778c8862d5b6d72b7e0800d6d7ba00ee646fef02450d9789abadb584d51e948803427943d655b03df87a132231bfb515fc9778e82cf96543f1aedcb6d7f1cf65d794cb3ec9a327d24e7adff8cf91868800e93474f", 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f000011c000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000005c0)={0x0, 0x0, 0x0, 'queue1\x00'}) write$sndseq(r0, &(0x7f00000001c0)=[{0x1e, 0x0, 0x0, 0x0, @time, {}, {}, @connect}], 0x30) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000080)={0x0, 0xa7e, 0x60}) 15:57:36 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000280)='io.max\x00', 0x2, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x4000, 0x0) ioctl$TUNSETVNETLE(r2, 0x400454dc, &(0x7f0000000040)=0x1) r3 = openat$cgroup_ro(r0, &(0x7f0000000300)='io.stat\x00', 0x0, 0x0) ioctl$TUNGETIFF(r2, 0x800454d2, &(0x7f0000000080)) sendfile(r1, r3, 0x0, 0x6) 15:57:36 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x700000000000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:36 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:36 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x4800, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:37 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x54000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 339.067608] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:37 executing program 1: sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x4, @ipv4={[], [], @multicast2}, 0x2000000008}, 0x1c) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000001c0)=0x181, 0x4) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4e1f, 0x0, @ipv4={[], [], @loopback}}, 0x1c) socket$inet6(0xa, 0x4, 0x40) sendmmsg(r0, &(0x7f00000002c0), 0x400000000000027, 0x26000000) 15:57:37 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:37 executing program 5: r0 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x0, 0x18000) r1 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x2223, 0x200100) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f00000000c0)={r1}) r2 = socket(0x10, 0x800, 0xfffffffffffffffd) sendmsg$nl_route(r2, &(0x7f0000000280)={&(0x7f0000000000), 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB="40001000a600000000000000000000000000", @ANYRES32=0x0, @ANYBLOB="000000000000000014000300626f6e643000000000000000000000000c0004000000000000000000"], 0x3}}, 0x4000010) 15:57:37 executing program 4: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000140)='/dev/mixer\x00', 0x4000, 0x0) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000180)=0x1) openat$mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/mixer\x00', 0x4000, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xd) r1 = socket$xdp(0x2c, 0x3, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x44801, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000240)={0x0, 0x79, "fd98df566467a78601ee5a90a3d8cdc4a31bab3a0bf575f36501a04c133d7e48d3a72c792bcdcecd640954b678d70ab2512c79511ea990e5f5a507265e995da45185ec34afbd63ef46816659f5a1daa190f24830bec7efb4d67b8ad40f263ae670d733b5a54682948da7e52e49651ac3a011791c7678d226d0"}, &(0x7f0000000300)=0x81) setsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000340)=@int=0x7, 0x4) getsockopt$XDP_MMAP_OFFSETS(r1, 0x11b, 0x1, &(0x7f0000000000), &(0x7f0000000080)=0x60) 15:57:37 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x6, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:37 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x700, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 339.288841] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:37 executing program 4: r0 = socket$inet_sctp(0x2, 0x5, 0x84) sendto$inet(r0, &(0x7f0000a34fff)='H', 0x1, 0x0, &(0x7f0000000180)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f0000033ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) shutdown(r0, 0x1) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00001afff8)={0x0, 0x2000000001}, 0x3d7) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000c60000)={0x3}, 0x10) write(r0, &(0x7f00005f1fe3)="c6", 0x1) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000100)={0x0, 0x0, 0x5}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0x0, 0x1}, 0x8) 15:57:37 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer2\x00', 0x80482, 0x0) write$UHID_INPUT2(r1, &(0x7f00000002c0)={0xc, 0xb0, "66bc616cae6c5b86b3dccd84c488e7a03226c71768248aac0ea2bbc7917ab0574f952855836ee927016d1ecfde192a5b38676585073e90cabddea0d0cb652b29f5ba6255b491cce456e31955c7b010c5635ea005b89df4dbf87b2c8c91ffe1c1d8418e4e297e80c5e87d7435f28568bb44245930f79b97e5e649ec07273ab0659ec737be062a52f50196e6729002b80303a231e1b0609300514dbc1bf652fcc28d90ef5f20f1fe46b7829df9972f569d"}, 0xb6) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000200)='/dev/null\x00', 0x200802, 0x0) ioctl$RTC_VL_READ(r2, 0x80047013, &(0x7f0000000240)) r3 = openat$cgroup_int(r0, &(0x7f0000000080)="6370757365742e6d656d6f72795f7370726561645f70616765009144d60683b365196de5669148998d5502913485763742d640401220948a656350f1eb9d5bc8615873e2d59d200cad70a7099b1a7df887", 0x2, 0x0) write$cgroup_int(r3, &(0x7f0000000040), 0x12) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000180)=0x0) r5 = openat$autofs(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/autofs\x00', 0x100, 0x0) perf_event_open(&(0x7f0000000100)={0x0, 0x70, 0x5, 0xc0, 0x4, 0x2, 0x0, 0x735a, 0x2, 0x2, 0x1ff, 0x80000001, 0x18, 0x1, 0x7, 0xfffffffffffffff7, 0x100, 0x2, 0xfffffffffffffffd, 0x7, 0x100, 0x7ff, 0x1, 0x8, 0xe31, 0x40, 0x3, 0x40, 0x3, 0x101, 0x9, 0xffffffff, 0x9, 0xffffffffffffffee, 0x9, 0x1, 0xa77, 0x0, 0x0, 0xfffffffffffffeff, 0x0, @perf_config_ext={0x8001, 0x7fffffff}, 0x80, 0x2, 0x3, 0x2, 0x9, 0x9, 0xffff}, r4, 0x10, r5, 0xb) 15:57:37 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x8, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:37 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xf000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:37 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x200000000000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:37 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000733000)={0x5, 0x5, 0x7, 0x9}, 0x2c) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xd, 0x10, 0x4, 0x13, 0x0, r1}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r1, 0x28, &(0x7f00000000c0)}, 0xffffffffffffffe7) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000240)={r2, &(0x7f00000001c0), &(0x7f0000000080)}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000001c0)={r2, &(0x7f0000000040)}, 0x10) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180)='/dev/zero\x00', 0x40000, 0x0) ioctl$DRM_IOCTL_AGP_INFO(r3, 0x80206433, &(0x7f0000000200)=""/42) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x4000, 0x0) ioctl$TIOCGPTPEER(r4, 0x5441, 0x3) sendmsg$nl_generic(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x28, 0xb01, 0x0, 0x0, {0x6}}, 0x14}}, 0x0) 15:57:37 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x300000000000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:37 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x4000000000000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:37 executing program 5: openat$pfkey(0xffffffffffffff9c, &(0x7f0000000300)='/proc/self/net/pfkey\x00', 0x80, 0x0) r0 = accept4$inet(0xffffffffffffff9c, &(0x7f0000000340)={0x2, 0x0, @multicast2}, &(0x7f0000000440)=0xffed, 0x800) r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0x0) r2 = socket$netlink(0x10, 0x3, 0xc) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r2, 0x10e, 0x8, &(0x7f0000000180), 0x4) r3 = perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFSMAP(r3, 0xc0c0583b, &(0x7f0000000200)={0x0, 0x0, 0x1, 0x0, [], [{0x1ff, 0x7f, 0x6, 0x6, 0x81, 0x8}, {0x6, 0x1000, 0x2, 0x6, 0x6, 0x9179}], [[]]}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r5 = memfd_create(&(0x7f0000000640)="2f65786500000000000409004bddd9de91be10eebf000ee9a90f798058439ed554fa07424adee901d2da75af300200f5abfb9845f9e19859c9693206f2c60b0000000719e1d65b970123d893d974e5b9c3285677b2139823e5500c92ab5b94da3a7de19f063bb765b02bd5b660fb7fa898c6f5c6369c3f363068d10af833f64753be8b7967255b177607ba100f6c4654718232dbda64aa1f69cf9ab5b3ea3ed63452b7ebd37c9dae664e322e08ad8f6029fe8fd0b34c7117480471aeca0a6fb78edd28509ca8a83e4f8b85131808bc5cfb4cc24e1901769c084c082712b470666b6dddf74ced693973ba1ded8b", 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETA(0xffffffffffffffff, 0x5406, &(0x7f0000000040)={0x3ff, 0xbf8d, 0x8, 0xfffffffffffffff7, 0x3, 0x9, 0x2ba, 0x7, 0xc3a}) r6 = getpid() ioctl$TCSETSW(0xffffffffffffffff, 0x5403, &(0x7f00000000c0)={0x0, 0x866, 0x0, 0x0, 0x0, 0x8, 0xffffffffffff0000, 0x3, 0x0, 0x7ff, 0x10000, 0xf69}) r7 = syz_open_procfs(r6, &(0x7f00000001c0)='net/ip6_flowlabel\x00') mount$fuse(0x0, &(0x7f0000000380)='\x00', &(0x7f0000001180)='fuse\x00', 0x0, &(0x7f0000000dc0)=ANY=[]) recvmsg$kcm(r5, &(0x7f0000000bc0)={&(0x7f0000000540)=@hci, 0x80, &(0x7f0000000ac0)=[{&(0x7f00000005c0)=""/20, 0x14}, {&(0x7f0000000600)=""/6, 0x6}, {&(0x7f0000000900)=""/40, 0x28}, {&(0x7f0000000a00)=""/179, 0xb3}], 0x4, &(0x7f0000000b00)=""/187, 0xbb}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000001140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x204000}, 0xc, &(0x7f0000001100)={&(0x7f0000000c00)=ANY=[]}}, 0x48001) socket$inet_udplite(0x2, 0x2, 0x88) ioctl$EVIOCGMTSLOTS(r5, 0x8040450a, &(0x7f0000000140)=""/122) r8 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r8, 0xae60) ioctl$KVM_CREATE_PIT2(r8, 0x4040ae77, &(0x7f0000000100)={0x600}) openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x43, 0x0) r9 = getpid() ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r9, 0x0, &(0x7f00000003c0)=""/100) dup2(r4, r8) writev(r8, &(0x7f000037d000)=[{&(0x7f0000199fe1)}], 0x1) [ 339.577782] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:37 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f0000000000)={{0x4000000080}, 'port0\x00', 0x3f, 0xffffffffffffffff}) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x105040, 0x0) ioctl$TUNSETVNETLE(0xffffffffffffffff, 0x400454dc, &(0x7f0000000140)) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r0, 0x4058534c, &(0x7f0000000340)={0x100000000080, 0x0, 0x1}) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000000200)=0x8, 0x27d) 15:57:37 executing program 4: getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) ptrace(0x420f, r0) add_key(&(0x7f0000000140)='asymmetric\x00', &(0x7f0000000180), &(0x7f00000001c0), 0xfffff, 0xfffffffffffffffc) move_pages(r0, 0x2, &(0x7f0000000080)=[&(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil], &(0x7f00000000c0)=[0x3f], &(0x7f0000000100), 0x6) 15:57:37 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x40000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:37 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:37 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x300000000000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:37 executing program 1: timer_create(0x5, &(0x7f0000000100)={0x0, 0x31}, &(0x7f0000000180)=0x0) r1 = syz_open_dev$sndpcmc(&(0x7f0000000200)='/dev/snd/pcmC#D#c\x00', 0x5, 0x2) write$UHID_CREATE2(r1, &(0x7f00000011c0)={0xb, 'syz1\x00', 'syz0\x00', 'syz0\x00', 0x1000, 0x6ca9, 0x80000001, 0x20, 0x480000000, 0xffff, "900256f264a96d4a2c09200fba0468aeda0249495e8c3a7e21edef1ae2da935d75ae6ff1d808c8d9d17f20ad01d27f288986e4af9315b5d537fccb388f77a9af4a17297aae16d7149997e67971c5e344ef09e940e91a3efd59a3d2cce71212d5c04d0c379cc75d2706050894c1b5982e1a81f685046ec38f8d3ac29988d1dfc88c84ff5e23507d4b6bebfd065aa5140629384c09bffdaed14a00f3baf742196e1345e5e18c84f35658d44424fc1649c7cd42db34f0387ccc89166a8cd0dc6286c70d9e495c8dd08047983166c5c65aa7215409f04dd4203b942dfde22ae42e82ae8a476054fada20af68b5b4d3713d7feed07120ac2c3220c8be49373366dc41bbb73ad44ac9fa730eed67c8c672bbbf2daaf0215fe4c663a7a555d4fb5536e6d2c1b0c8d557a4a2fe308036692dad54f2eb47908b8d9296da99726f550681bbe5112311cd6a4c3bb6ab5df103eee9332b60526ff76de1cedebb202a337efc605e604acf840a1294adcb3f5ea3cb7a4b719cbe5a772f221db9eee35ce326f02c659c76909ec69acc328f7c53c233d5ef2bf71781078cdfadd70760f764847ee3cbadb640991ac1513e3d82985c2958461db93333d6f3da088b3d869717276c80b7895e69060f374a07b6356205e62baf7bc12b0d0d8c0e7ac501e8e71874f272788845ec3f82dcea6cb2e8bd48026bb19add600cd84a3758d235ae46c0af30cf11b887f2493b18d5682abcf2734dff81a4a2da495d75413cb5e10a5a7adc9d97ff97ca68d428c213e07d53bf626e1d7b2e42f159ca7d6c527d5ab6a18ba09b499f7e5a0e67a877c93edfd0937466a649ea4c38d210f019702cf0ef00166ddb7a368252b71964b70dd7ffcadb2e9b2dd762a7a9a85cbf8834819ce621383629f0f9e18d97624008f39cda9ce52e624f7ab24a4b09a5549bd2c8fdc70cca6be320065572c597dfa07944be81d2bd48c86eecb4ed9f5bd8181af5110a69ab6ffe189329f1d0fb331ae10d93d2474db0558702ad0e62d8ca9ec585ca4fbe33e4afb7337b204e5d8ad77a66c308438d2d7b1caac59204e9ee5426eb606cdf0061707ff77fbeec91cba18f2d1759ab5c0976fe11eded782bc507a1ecd2b68cced6d4c78e43eb36d62ef689d4e747cf21d483bfeb0887183cf5645641dd607ea391f0cc0676a24554a49e1cbb330e8913c81f8919109e063b9ac93f87881603f951a861002521839b0a64275d93b9b673d22c092526a4b19ce0c85fb32dd3c63165820099126f7f000162876502d3504fe68b1bdb41721924f5d6e28d0f49f2ecb01e358cd65b1974f190527e25efcafab49f0f8059c56a3379ad7f3565e8b451b9a827ce368472aa6e6cc5e5346fad3526bb70b4518369ff1e50d4cff1efb56e3ddcba23783dad297297d154021d12f108d3dbaf4bfc27db3c37ae82c6ba6dc70b1146c961052c1faa4092646df9c90858a78d392bb394df6cd42cccb3ae70d2c98a2d877056f48763100f572134bb73fa855089ba50f8c3e5a9bb8abdcf60441446fb4831f5c79b18e0d108299ba8800f438baa66837b908bfd70526a79cf3844983141a103e842536f316a437a8a51f9d24c04db6e7ef8dd471a0868ed339310692ba0f08e79da5ef3a8dd07ec36344fe0b1428a6c39fd6d53dfe11ba45ff0ea2f2a99364fd9c19cbe15c15da3be5992f90881c5a86b098d62bc436e260638d62fd591d311decfeb87857e004116507e910bce78dee03233a3ee62cc56a7e45e17b55242e8e6a90711edae6bd71e18bdb78f046f82e301c5455fcf1c0fe87dd529da30221194067bb67c6c039978b6907afefbb701610438c535a46ed7a43907703ab62afbafc8fa4de2c09ffbfc2127508cda96d32ebf262896d9a7df67a022b1b9cba909ad839a600f7e93005c8ebf30f1c1db36deb6ef3ecb3175099b09f18f3a0b68521446311b2a87ac15d6d9af42a91e2f192fae4af45c0421d0496125c0608ff01245adee661c0150370e0816d055342808cb6e3eb534853d8690c7251be627e5cfc1de9b890f12f0a5b7281073493b383d8a748adb469ed8609d0f01f4fa2ea24844766eb5bf50fd2499d964e054fc3685aebe974b3bb251c6727bd37f2a1e3df7dee194ba08f1361ca58e7079f2f6c45b0ddc80ea9efcf85ec3ce36f244655f88f6d59217c385bfe7099c1de4aa34f58c440eb4faece254b8ea325eb74935802aabcf71fdab69131c0ccbf578248c3a93facd19ce1cd3b0556939fde174051843fca156f87d98f7b9d17074fe6104c8d0e4eabb49e2d63901c8679f06fa52c7075589f682a3392a3f12f3b17ec865bffd32801b5ee7de361ce89f63dcc9197423a192be594b7e38dd4343e675491bdfe8d52b56aaf1d9d0b17c234e12188629f0a3e44e0fbe5e21e507a00ab1c54caa60604cdb0cdb798cbfdefcc042b5ea3f207fdee3bc46891963b196e24ef8d69c214022be88be273d31b7a9429081448baf5f0db23f28429f87fbc15b84c1b48a77f44c35749b2496950d8fbe9b1328469e1ca99b96abfca0b6b756c83f74090ecb9284374e5b32abc51fe0ccf2767d45d45b30953979ec236b0969c36986c113605cde73606077c0bb006ae2aacb6775213d01df067d88abce6d27f18ce6e387fb45c1e6b5c79aa7df36a69a4e2e83155dd75fa138b6e66fb1b759e29d01b153280c8d4f2b261110cf781964ec35f2606fc52dcdfd1e87d9323e0ff0f0b760eca3e2c7bb5433f35da07d66f5a041f2248d6c708b662885da2c3f3b533fd3f3bc08a693231a403367bceff82f45bd2e9fbea791670693878f63988d3f6961e4046ecec9d240c0675963c4d75643dde8e8e1ce2f88da8a0f5f4c39ce7a97c5a94d561e9dc2e7c565c82f4f20dd42aba7844b568fd544878cca4ebd1e0308d64b66d112a785e134845c3dc6b84ac26d165153420039f79e5857449e84c020efac03f493f27bd0eccbb296e6dce8ed88c3b8f242f1997c529693654971e4d5a18fc282fdbdeb7e0375e76e9ca41a35f2466c7ed0d8d9aa3b8681b17c548a448224105a6b8c5a8d1a0b9e59e316112bd282dcfff87e8bfa95392d1c9b6d92887870865b3cdffbead0cedc436c3bf164f5cfa4e94439bf38ed2bac2f11f26457a50ac3087727b96e3c6286a294df414d929afb11929c15c6536b7279b0a077f7ab7c2bd23fc2f04fe4caa47703fc6a0983d608a5008d231ebef9449da7ab4d9f5ebdd1be0d25d97ab35ac0db7087e0921dee99f13b6dad8045e74ad0cf5ad1a28e5608e498319bb1be144ba84a7d60b9f3156be5aff664cb6a4ee70ed3a9064299093892750089f81fdc890eeee11441657a5c62014532a3138b53ad584260aaa2123bad3e786634a0e82ca0f5080cf7fee72edf2b9854977aa42c9ec464e38e3e0112ff02072634dce64ca192494701c2c8f96b8a01c6d3793e76a8c3a78097ece6e238de6bdfeb7155f52e877e185defed92c35c1ce579737c9d4a6a5ec8d8477dcbeaab2bee87d2950be3d5ab4093dbba689b68185f6f55ac143dfb767d43ffe5c3089fe1c83bd7633aeb93148cadea0cebf1ff0cbf0fd7befde287f3ec21697079eb6cbbe156111c99c2049d4b8f92824a3d2e988c02ff8d87ff17c3c7b486daf740845e88eeb4ada33ac8ff9f8ed12e15b07600382f394d77e43589e7c19ef7833aaf82362433c4b1ace529ede42b82eb06c1feda13077e29c2dd6879d9ebb2d17b00c32df809dcbba2ce36840c51265e913c14bcedc06b36eabef910e24364b84187b17a881cd7e1f3570f2751a5905554003cffc58c332beb25536936adc5bc8c5e06d2b29e2bd55d84ab94085ba5d9252a77e8318205bb3f9f6b53b9edb2709081489ae9ee5aea39ee8493bb1eb4fb9bc284d52a0e5446873760f0c3b8eb15d327c2a57a7af306f7540da24fc5dbe5bb862bdb5d750580d559269d051d716728d0fbf690deb3016a1e7857e2f10d59bd242cf4cf81be4babb469f4f09a558bc265e807c86586301cdf5911594e82ec89dc9924db59262754da40f64b0bfc00547366501cfadec57be0a0926b97a69c84c7d2a0f51d7861585732c94ba2fd40f82c9b798e6ec75a994abefb97c885a30ce9ad4472df54ac8bfda0d813625a0bf6c3d8c67b020c1380681fb203f8ae4a6837eb7de4d704e5b49d5e52c15add22cb558a341ea215421acd3a94cfb10a28bdd291aae63ef2d92e9fe455361a9652189d90ab8919afa5b047ab6352a11c919c28d5e0158d1bf8af9ed212d2bd30b4fda3e9b8b2115af5d9d17e61b38bb257a0d5ed961fb8f19bc99ed4a48e36a814c32766164db36a33085471838df3b035c444b6746a0c7bfd6bc8e7519f60bcf705e913b4c6648ca12157f5fdcfab02f0f3dbc4575c7579c32c935c9d113f128a8b6ba4d4fc3f9412ba6867ede157f7ee0060327527daf7c14c6ecdc1fcdb1192083fa929b211b73b66f5a3c25cceed3b6e91b89e781cf6c7725d11728271bfc5276b719cf81f838e758a9d2faa42770a82f7fb08ffc879f0490a4fe150fa7be9f9ea6e0fb0a988b0cade8a427d4346e3e4ca309d3b9dccd81f834614808182862981ff89b3c2fa94a76423f1a65d79288f2d5a7e6cf4509964a9578ea6b75a5d184da35efcec6f0e4fbfc623b7621285b439a2af45e53c461b2c3bb50f78483fb5a6a7a0354a8e4e207433dc003310cd3e3a0f9799526ea9d374a72b713f6340b60ddfa063c4f7b5ecf05ba26f545b58ba89be3dc21bab14d98147b9b6bbc1d518b5813ed2507b71173935ac63ec24cd11b647024a01c06a6ce1066c0b52be1fbffb57c353dadc62dfc4c6afb30935cfb7353478ab705c63efcfea935cb259afa056988103fe4d12a6cb6f6ac1045d48a2c1904cf51f47d868b581e83aa642cb7de8471803de8df5d0e99dba79f79600b0cc8b632d280be108fda8d6e47b833f108043bf0c03f76622de7edddd05258f6fd7c57269076f8591473d3753016970ec67f3d5807907d101845c5a865501c29503ca873501d123abad11877e9585ddda3e6ec0515b27571355c10a661aa1061246508ede2724bced04c96af79685296bcee698b149f81ff07fd7facc8dd0ff698cedf42e7ebca754be032e5fa00859fba342704f1d1084e658e3fa45681261ab054ca0f7c4ec4510ecdec4e20b01e7f577cd94b5b435c8bede659360bb8782647670c1d0cfd8472ac616660f70013ab8cae9fbdd38127dbae5ccba3f5ea34c8b65aef4f67dc279a6026880a9d38fe9b446968c8b8a310141d0a3633f3195432cb05e6ef3fa9fd9649dab99968a899f3f59f53d75e56371d7abc004a4d2b6f2d0c91ebcdc02ca6ac33350014e9ccb4dfbe073be92ed95e4102f76e779cb0beb67e870f39efa6950db5165ac55023efbad03137a31beb19c0136f08fcbc47969a80bdca95d1e3347da596a418ce9a0ca8712d00350d8bccb2011f570c770bf1556c54c538c01e25dc8480d7db126ebe94d0cebeae09d8d0c661ae1bb907225bc929d5288568c632bb0210df3738da8c70753a581eb85120cb943c8def7f3d93f22040f67e6235e083c6609d6d2c3fb3e8f4317d386c784c438866985ba6bc8bbc47708ab16884debff019e83750034bb020ca4814572eedab3dbafcc6dcda1a1a0fb49e08e4cf49de3473daeb5fe51553e8474b248cf5d7f9e2a4d5ea3cb5a41d574d2a1add1485341c13f1cb6fe815649694a22ba29157135339e1205ace56d0e8b2d69ddd9c5fe9a9217b18ebc9789d4ae0073d12bef3a39780cdea4ec"}, 0x1118) timer_gettime(r0, &(0x7f00000001c0)) r2 = openat$uhid(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uhid\x00', 0x2, 0x0) write$UHID_CREATE(r2, &(0x7f0000001080)={0x0, 'syz1\x00', 'syz1\x00', 'syz0\x00', &(0x7f0000000000)=""/11, 0xb}, 0x11c) write$UHID_DESTROY(r2, &(0x7f0000000140), 0x4) write$UHID_CREATE(r2, &(0x7f0000000380)={0x0, 'syz0\x00', 'syz1\x00', 'syz0\x00', &(0x7f00000002c0)=""/150, 0x96}, 0x11c) write$UHID_INPUT2(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="0c10000000002a5637efbb1c8ed11fffce3b2c1ef779154e4cf5fa1e6ec33081a944ba4fb6b2af2c18d166f1e34f3407c9311dbbc065d78682182fd5c577f63c7eb28546910bdbbe9192ca"], 0x6) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000240)) symlink(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='.\x00') write$P9_RREADLINK(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[], 0x0) socketpair(0xa, 0x1, 0x0, &(0x7f0000000000)) llistxattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000280)=""/4096, 0x1000) fstat(0xffffffffffffffff, &(0x7f00000000c0)) write$UHID_INPUT2(r2, &(0x7f0000000500)=ANY=[@ANYBLOB="0c6ba2270800"], 0x6) 15:57:37 executing program 4: ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)) sched_setaffinity(0x0, 0x744, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000d65000)={&(0x7f0000de2ff4), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="1400f20002030182ddffff0000000000000000000000"], 0x14}, 0x2}, 0x0) 15:57:37 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x2, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 339.881778] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 339.903601] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 339.910300] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 15:57:37 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x400000000000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 339.992097] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 340.021228] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 15:57:37 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x508}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:37 executing program 4: clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) modify_ldt$write2(0x11, &(0x7f00000000c0)={0xfffffffffffffffb, 0x20001800, 0x400, 0x5, 0x6836, 0x1f, 0x200, 0x6, 0x0, 0x3}, 0x10) r0 = getpid() r1 = syz_open_dev$sndctrl(&(0x7f0000000000)='/dev/snd/controlC#\x00', 0x4, 0x800) fcntl$lock(r1, 0x5, &(0x7f0000000080)={0x0, 0x3}) sched_setscheduler(r0, 0x5, &(0x7f0000000040)) ptrace$cont(0x1f, r0, 0x0, 0x0) socket$inet(0x2, 0x80f, 0x50) [ 340.045923] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 340.069891] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 340.105571] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 340.118288] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 340.138368] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 340.152091] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 340.153105] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 340.168276] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 340.178339] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 340.197302] hid-generic 0000:0000:0000.0003: hidraw0: HID v0.00 Device [syz1] on syz1 [ 340.226428] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.238792] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.260651] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.273181] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.293602] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.299321] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.304740] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.314495] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.318765] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.325841] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.335579] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.338977] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.342271] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.342292] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.342313] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.349235] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.356233] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.363230] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.369517] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.377339] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.383673] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.390790] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.397425] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.404294] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.410593] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.417689] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.424137] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.430892] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.437549] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.445516] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.450970] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.458078] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.464464] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.471198] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.477852] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.485739] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.491242] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.498307] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.504752] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.511478] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.518149] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.526039] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.531536] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.538623] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.545007] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.551693] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.558367] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.566379] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.571741] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.579034] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.585499] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.592020] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.598931] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.606787] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.612093] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.619190] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.625552] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.632273] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.638962] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.646837] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.652353] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.659456] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.665781] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.672525] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.679225] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.687037] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.692606] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.699597] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.705974] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.713746] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.720058] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.727124] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.733489] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.740233] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.746927] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.754895] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.760326] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.767383] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.773744] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.780481] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.787144] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.795032] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.800552] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.807766] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.814038] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.820769] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.827460] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.835488] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.840814] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.847983] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.854251] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.860970] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.867777] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.875533] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.881121] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.888173] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.894532] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.901254] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.907927] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.915806] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.921312] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.928410] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.934750] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.941464] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.948137] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.956003] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.961527] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.968620] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.974980] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.981686] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 340.988358] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 340.996294] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.001734] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.008829] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.015170] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.021892] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.028573] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.036459] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.041983] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.049059] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.055418] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.062180] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.068885] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.076939] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.082261] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.089419] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.095689] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.102413] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.109083] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.117064] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.122480] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.129559] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.135912] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.142590] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.149308] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.157323] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.162740] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.169485] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.176144] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.184010] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.189544] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.196659] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.202990] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.209724] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.216411] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.224301] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.229776] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.236863] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.243200] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.249924] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.256592] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.264467] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.269995] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.277106] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.283458] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.290155] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.296828] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.304756] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.310265] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.317459] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.323696] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.330418] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.337086] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.345069] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.350494] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.357677] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.363926] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.370657] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.377334] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.385209] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.390716] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.397793] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.404133] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.410922] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.417595] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.425500] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.430985] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.438066] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.444407] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.451129] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.457829] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.465767] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.471250] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.478311] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.484687] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.491371] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.498041] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.505915] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.511421] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.518510] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.524841] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.531566] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.538286] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.546187] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.551680] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.558775] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.565133] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.571839] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.578520] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.586693] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.591939] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.599144] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.605400] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.612591] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.619294] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.627280] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.632678] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.639379] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.646054] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.653934] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.659474] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.666557] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.672883] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.679605] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.686286] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.694147] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.699658] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.706739] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.713092] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.719798] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.726495] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.734353] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.740393] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.747504] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.753814] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.760550] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.767227] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.775086] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.780603] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.787699] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.794055] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.800771] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.807450] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.815345] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.820822] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.828044] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.834251] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.840968] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.847642] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.855675] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.861576] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.868753] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.874915] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.881750] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.888416] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.896286] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.901805] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.908898] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.915251] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.921966] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.928663] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.936525] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.942017] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.949127] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.955465] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.962176] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.968865] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.976766] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.982267] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 341.989359] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 341.995696] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 342.002452] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 342.009116] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 342.016986] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 342.022498] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 342.030184] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 342.035942] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 342.043078] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 342.049361] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 342.056488] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 342.062833] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 342.069608] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 342.076248] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 342.084315] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 342.089941] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 342.097043] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 342.103399] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 342.110104] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 342.116785] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 342.124978] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 342.130181] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 342.137271] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 342.143594] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 342.150329] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 342.156998] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 342.164876] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 342.170379] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 342.177464] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 342.183814] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 342.190532] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 342.197203] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 342.205092] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 15:57:40 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000000180)={0xa, 0x84e23, 0x40, @loopback}, 0x1c) listen(r0, 0x4) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000040)={0x8, 0x8, 0x4, 0x776b, 0x7fff, 0x7fffffff, 0x21f, 0xfd1, 0x800, 0x5, 0x5}, 0x39d) sendto$inet6(r1, &(0x7f0000e33fe0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r2 = socket$inet6(0xa, 0x400000000001, 0x0) syz_open_dev$evdev(&(0x7f0000000080)='/dev/input/event#\x00', 0x800, 0x800) r3 = dup(r2) setsockopt$inet6_tcp_int(r2, 0x6, 0xa, &(0x7f0000000000)=0x81, 0x4) bind$inet6(r2, &(0x7f0000000100)={0xa, 0x4e20}, 0x1c) sendto$inet6(r2, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$inet6_int(r3, 0x29, 0xb, &(0x7f0000000280)=0x2, 0x4) syz_open_dev$rtc(&(0x7f00000099c0)='/dev/rtc#\x00', 0xfffffffffffffffb, 0x8000020120) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x7fff) clock_gettime(0x0, &(0x7f0000009880)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000009780)=[{{&(0x7f0000002540)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000002a00)=[{&(0x7f00000025c0)=""/75, 0x4b}, {&(0x7f0000002640)=""/22, 0x16}, {&(0x7f0000002680)=""/4, 0x4}, {&(0x7f0000002740)=""/120, 0x78}, {&(0x7f00000028c0)=""/172, 0xac}], 0x5, &(0x7f0000002a80)=""/203, 0xcb}}, {{&(0x7f0000002b80)=@ipx, 0x80, &(0x7f0000003e80)=[{&(0x7f0000002c00)=""/168, 0xa8}, {&(0x7f0000002cc0)=""/4096, 0x1000}, {&(0x7f0000003cc0)=""/241, 0xf1}, {&(0x7f0000003dc0)=""/128, 0x80}, {&(0x7f0000003e40)=""/60, 0x3c}], 0x5, 0x0, 0x0, 0xfffffffffffffffb}, 0x1}, {{&(0x7f0000003ec0)=@alg, 0x80, &(0x7f0000004080)=[{&(0x7f0000003f40)=""/162, 0xa2}, {&(0x7f0000004000)=""/108, 0x6c}], 0x2, &(0x7f00000040c0)=""/235, 0xeb, 0x20}, 0x6}, {{&(0x7f00000041c0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000006340)=[{&(0x7f0000004240)=""/84, 0x54}, {&(0x7f00000042c0)=""/11, 0xb}, {&(0x7f0000004300)=""/22, 0x16}, {&(0x7f0000004340)=""/4096, 0x1000}, {&(0x7f0000005340)=""/4096, 0x1000}], 0x5, &(0x7f0000006380)=""/111, 0x6f, 0xf}, 0x7}, {{&(0x7f0000006400)=@ipx, 0x80, &(0x7f0000007640)=[{&(0x7f0000006480)=""/242, 0xf2}, {&(0x7f0000006580)=""/167, 0xa7}, {&(0x7f0000006640)=""/4096, 0x1000}], 0x3, &(0x7f0000007680)=""/5, 0x5, 0x4}, 0xf3}, {{&(0x7f00000076c0)=@hci={0x1f, 0x0}, 0x80, &(0x7f0000008740)=[{&(0x7f0000007740)=""/4096, 0x1000}], 0x1, &(0x7f0000008780)=""/4096, 0x1000, 0x800}, 0x9}], 0x6, 0x40000000, &(0x7f00000098c0)={r5, r6+30000000}) setsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000009900)={r7, @remote, @local}, 0xc) sendfile(r3, r4, &(0x7f0000d83ff8), 0x8000fffffffe) 15:57:40 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x3000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:40 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x200000000000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:40 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCGETS(r0, 0x5401, &(0x7f0000000200)) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f00000000c0)={0xffffffffffffff9c}) getsockopt$inet_sctp_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000000100), &(0x7f0000000180)=0x8) ioctl$GIO_FONT(r0, 0x4b60, &(0x7f0000000000)=""/137) 15:57:40 executing program 4: ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)=0x0) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x10000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = dup3(r1, r1, 0x80000) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000300)=@assoc_id=0x0, &(0x7f0000000340)=0x4) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r2, 0x84, 0xf, &(0x7f0000001400)={r3, @in={{0x2, 0x4e23, @rand_addr=0x6}}, 0x20, 0x1b82f226, 0x4, 0x1, 0xfffffffffffffff9}, &(0x7f0000000380)=0x98) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) execve(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)=[&(0x7f0000000140)='\x00', &(0x7f0000000180)='\x00'], &(0x7f0000000280)=[&(0x7f0000000200)='!\x00', &(0x7f0000000240)='vboxnet1posix_acl_accessuser\x00']) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x600) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/hwrng\x00', 0x80, 0x0) r6 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffff9c, 0x4c82) ioctl$LOOP_CTL_REMOVE(r5, 0x4c81, r6) 15:57:40 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8100000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 342.210596] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 342.217670] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 342.224024] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 342.230787] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 342.237468] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 342.245320] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 342.250826] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 342.257902] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 342.323600] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 342.324016] hid-generic 0000:0000:0000.0004: hidraw0: HID v0.00 Device [syz0] on syz1 [ 342.361240] hid-generic 0000:0000:0000.0005: hidraw1: HID v0.00 Device [syz0] on syz1 15:57:40 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x4, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:40 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x100000000000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:40 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x101000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0x4000, 0x0) write$P9_RVERSION(r3, &(0x7f0000000140)=ANY=[@ANYBLOB="15cf3230eb8861dfc14eb596186e0180ff7f14be6fafd9c04f02390e7c7f7b5a4b0dbcf75e419f7da3bb749eb347e6959599b4a517b9f30fdb07cf3df557e323ffc33a321cf36e700553d7e512a3692e8b4249bd75dc2607ad77665aaeb1a7c041d45208a7a6eb77c0488a765a86e312ff74"], 0x15) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0xffffffff, 0x2) 15:57:40 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xf00}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:40 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x5400, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:40 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x600, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 342.572990] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:40 executing program 5: ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000000)={0x0, 0x80000, 0xffffffffffffffff}) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x408000, 0x0) sendfile(r0, r1, &(0x7f0000000080)=0x5f, 0x5) r2 = socket$inet6(0xa, 0x3, 0x3a) getsockopt$inet6_int(r2, 0x29, 0x4e, &(0x7f0000000100), &(0x7f0000000140)=0x4) 15:57:40 executing program 4: ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)=0x0) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x10000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = dup3(r1, r1, 0x80000) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000300)=@assoc_id=0x0, &(0x7f0000000340)=0x4) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r2, 0x84, 0xf, &(0x7f0000001400)={r3, @in={{0x2, 0x4e23, @rand_addr=0x6}}, 0x20, 0x1b82f226, 0x4, 0x1, 0xfffffffffffffff9}, &(0x7f0000000380)=0x98) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) execve(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)=[&(0x7f0000000140)='\x00', &(0x7f0000000180)='\x00'], &(0x7f0000000280)=[&(0x7f0000000200)='!\x00', &(0x7f0000000240)='vboxnet1posix_acl_accessuser\x00']) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x600) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/hwrng\x00', 0x80, 0x0) r6 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffff9c, 0x4c82) ioctl$LOOP_CTL_REMOVE(r5, 0x4c81, r6) 15:57:40 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x9effffff00000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:40 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x5c00, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:40 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x300, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:40 executing program 1: r0 = socket$can_raw(0x1d, 0x3, 0x1) sendmsg$IPVS_CMD_DEL_DAEMON(r0, &(0x7f0000001280)={&(0x7f00000010c0), 0xc, &(0x7f0000001240)={&(0x7f0000001140)={0x14}, 0x14}}, 0x0) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000004, 0x8010, r0, 0x0) [ 343.090829] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:41 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:41 executing program 5: r0 = creat(&(0x7f0000000240)='./file0\x00', 0x61) ppoll(&(0x7f0000000280)=[{r0, 0x1000}, {r0, 0x8}, {r0, 0x8000}], 0x3, &(0x7f00000002c0)={0x0, 0x989680}, &(0x7f0000000380)={0x7}, 0x8) write$binfmt_elf32(r0, &(0x7f0000000300)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x3e, 0x0, 0x0, 0x38}, [{}]}, 0x58) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000000)={0x3, 0xfffffffffffffffc, 0x7, 0x5, [], [], [], 0xf7b, 0x1000, 0x26c, 0x6, "244664036072dadc52dc653311af0f90"}) uselib(&(0x7f00000001c0)='./file0\x00') accept4(r0, &(0x7f0000000140)=@can, &(0x7f0000000200)=0x80, 0x800) 15:57:41 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) rt_sigreturn() clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000040)) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r0, 0x84, 0x22, &(0x7f0000000000)=[@in6={0xa, 0x4e22, 0x3, @local, 0x200}, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}], 0x2c) ptrace$peek(0xffffffffffffffff, r1, &(0x7f0000000100)) 15:57:41 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x2000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:41 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x700, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 343.258912] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:41 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x3, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:41 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000380)={0x0, @in={{0x2, 0x0, @multicast2}}, 0x0, 0x0, 0x0, 0x7f, 0x8}, &(0x7f00000001c0)=0x98) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000240)={0xffffffffffffffff, 0x28, &(0x7f0000000200)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000280)={r0, 0x1c88, 0x18}, 0xc) r1 = memfd_create(&(0x7f0000000840)="656d30e6d0657270722ac8a9f5b38e25e2dd6f632500630e0489c98b1d06285cc037e956cdf575b04dbf8f009383c6fbcb84fb772a2624599e6f02ba896ccbb0030005d05c2943d24c16ddc9c196e49095f7c1eb5e0e70909c61e6ff8464cddd603a55ee471fe6e186e1b4ba9629c6b8bbd80de2a9e90934e58f1f881b1dc8f91ada3acd2dda93e27718e107b0c2228c1cfac540b9773aee7983eb21090124e61a1b7c10d6ae3b7e41450c306bcb6ae6538d1f5ea3ae4e8020e659e8a8fd22b9cb459d08ead0e9721c580a098839a7434190d7bc26ae008915c41efb175ddaefee25bb94a93624ce19b548731ac08f1351f5f09c13acd2b8afb09651", 0x0) connect$can_bcm(0xffffffffffffffff, &(0x7f0000000180), 0x10) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000), 0x10, &(0x7f0000000040)={&(0x7f00000000c0)={0x5, 0x0, 0x0, {0x0, 0x2710}, {0x77359400}, {}, 0x8, @can={{}, 0x0, 0x0, 0x0, 0x0, "c4d981ae211e6951"}}, 0x20000108}}, 0x0) ioctl$VT_RESIZE(r1, 0x5609, &(0x7f0000000080)={0x6, 0xad4}) creat(&(0x7f0000000100)='./file0\x00', 0x21) r2 = syz_open_procfs(0x0, &(0x7f0000000500)="2f65786500000000000409004bddd9de91be10eebf000ee9a90f798058439ed554fa07424adee901d2da75af1f02acc7edbcd7a071fb35331ce39c5a0bcb98a3e1f46fd51b139d755efce9768b84ea75c2ff4b3c85caef374d126a56fa4743af7ef55c846bfe7dd16072d260ffddcc8a6d22e02f44d6a360524b86b51a4b58afca35f12201adb024bfb20fbd364e78a232fbef31595029f755740ab15e173dc73ba964a4189007c7c40db8fb4b64dd8ec4d366") fcntl$setstatus(r2, 0x4, 0x4000) sendfile(r1, r2, &(0x7f0000000040)=0xe00000000000600, 0x1080000004) bind(r1, &(0x7f00000002c0)=@ipx={0x4, 0x1, 0x9, "d891f27faf15", 0x4}, 0x80) mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1) 15:57:41 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000200)) ioctl$TUNGETSNDBUF(0xffffffffffffffff, 0x800454d3, &(0x7f0000000280)) openat$tun(0xffffffffffffff9c, &(0x7f0000000640)='/dev/net/tun\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$cgroup_ro(r0, &(0x7f00000005c0)='cpu.stat\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000340)={'vcan0\x00', 0x0}) r5 = socket$xdp(0x2c, 0x3, 0x0) bind$inet6(r2, &(0x7f00000001c0)={0xa, 0x4e23, 0xffffffffffffffff, @loopback}, 0x1c) setsockopt$XDP_RX_RING(r5, 0x11b, 0x2, &(0x7f0000000040)=0x800, 0x4) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/17, 0x10000, 0x1000}, 0x18) r6 = openat$full(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/full\x00', 0x103000, 0x0) ioctl$KVM_GET_DEBUGREGS(r6, 0x8080aea1, &(0x7f0000000540)) bind$xdp(0xffffffffffffffff, &(0x7f0000000300)={0x2c, 0x0, r4, 0x0, 0xffffffffffffff9c}, 0x10) setsockopt$RDS_GET_MR_FOR_DEST(0xffffffffffffffff, 0x114, 0x7, &(0x7f0000000740)={@vsock={0x28, 0x0, 0xffffffff, @my=0x1}, {&(0x7f0000000680)=""/183, 0xb7}, &(0x7f0000000300), 0x8}, 0x9c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000180)='vcan0\x00', 0x10) io_setup(0x9, &(0x7f0000000380)) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000800)='./cgroup/syz1\x00', 0x1ff) r7 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r7, 0x4c81, 0x0) r8 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000140)='/dev/loop-control\x00', 0x2, 0x0) r9 = ioctl$LOOP_CTL_GET_FREE(r8, 0x4c82) ioctl$LOOP_CTL_ADD(r7, 0x4c80, r9) r10 = openat(r7, &(0x7f00000000c0)='./file0\x00', 0x147564520c1d047d, 0x10) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r11 = getpid() sched_setscheduler(r11, 0x5, &(0x7f0000000040)) lgetxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=@known='security.capability\x00', &(0x7f00000001c0)=""/99, 0x63) write$eventfd(r10, &(0x7f0000000100)=0x7fff, 0x8) 15:57:41 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0xb, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:41 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x300}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:41 executing program 5: mknod$loop(&(0x7f0000000200)='./file0\x00', 0x0, 0xffffffffffffffff) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x50, &(0x7f0000000100)={0x0, 0x0}}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0)=r0, 0x4) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000240)='/dev/rtc0\x00', 0x2000, 0x0) ioctl$RTC_ALM_SET(r1, 0x40247007, &(0x7f0000000400)={0x5, 0x0, 0x15, 0x0, 0x8, 0x9}) 15:57:41 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0xb, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 343.494862] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:41 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0xffffffffffffffff, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:41 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x54, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:41 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000140)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) prctl$getreaper(0x9, &(0x7f0000000300)) getsockname(r1, &(0x7f0000000900)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @loopback}}}, &(0x7f0000000000)=0x80) connect$rds(r2, &(0x7f0000000980)={0x2, 0x0, @remote}, 0x10) r3 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r3, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast1}, 0x4, 0x8}}, 0x2e) r4 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x200000, 0x0) ioctl$SNDRV_TIMER_IOCTL_INFO(r4, 0x80e05411, &(0x7f0000000180)=""/225) creat(&(0x7f0000000080)='./file0\x00', 0x20) 15:57:41 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xfffffff0}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:41 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x6000000, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:41 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0xb00000000000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 343.705982] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:42 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000380)={0x0, @in={{0x2, 0x0, @multicast2}}, 0x0, 0x0, 0x0, 0x7f, 0x8}, &(0x7f00000001c0)=0x98) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000240)={0xffffffffffffffff, 0x28, &(0x7f0000000200)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000280)={r0, 0x1c88, 0x18}, 0xc) r1 = memfd_create(&(0x7f0000000840)="656d30e6d0657270722ac8a9f5b38e25e2dd6f632500630e0489c98b1d06285cc037e956cdf575b04dbf8f009383c6fbcb84fb772a2624599e6f02ba896ccbb0030005d05c2943d24c16ddc9c196e49095f7c1eb5e0e70909c61e6ff8464cddd603a55ee471fe6e186e1b4ba9629c6b8bbd80de2a9e90934e58f1f881b1dc8f91ada3acd2dda93e27718e107b0c2228c1cfac540b9773aee7983eb21090124e61a1b7c10d6ae3b7e41450c306bcb6ae6538d1f5ea3ae4e8020e659e8a8fd22b9cb459d08ead0e9721c580a098839a7434190d7bc26ae008915c41efb175ddaefee25bb94a93624ce19b548731ac08f1351f5f09c13acd2b8afb09651", 0x0) connect$can_bcm(0xffffffffffffffff, &(0x7f0000000180), 0x10) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000), 0x10, &(0x7f0000000040)={&(0x7f00000000c0)={0x5, 0x0, 0x0, {0x0, 0x2710}, {0x77359400}, {}, 0x8, @can={{}, 0x0, 0x0, 0x0, 0x0, "c4d981ae211e6951"}}, 0x20000108}}, 0x0) ioctl$VT_RESIZE(r1, 0x5609, &(0x7f0000000080)={0x6, 0xad4}) creat(&(0x7f0000000100)='./file0\x00', 0x21) r2 = syz_open_procfs(0x0, &(0x7f0000000500)="2f65786500000000000409004bddd9de91be10eebf000ee9a90f798058439ed554fa07424adee901d2da75af1f02acc7edbcd7a071fb35331ce39c5a0bcb98a3e1f46fd51b139d755efce9768b84ea75c2ff4b3c85caef374d126a56fa4743af7ef55c846bfe7dd16072d260ffddcc8a6d22e02f44d6a360524b86b51a4b58afca35f12201adb024bfb20fbd364e78a232fbef31595029f755740ab15e173dc73ba964a4189007c7c40db8fb4b64dd8ec4d366") fcntl$setstatus(r2, 0x4, 0x4000) sendfile(r1, r2, &(0x7f0000000040)=0xe00000000000600, 0x1080000004) bind(r1, &(0x7f00000002c0)=@ipx={0x4, 0x1, 0x9, "d891f27faf15", 0x4}, 0x80) mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1) 15:57:42 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x34000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:42 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x3000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:42 executing program 4: setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000100)=@req3={0x0, 0x0, 0x0, 0x5}, 0x1c) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='attr/current\x00') write$nbd(r0, &(0x7f0000000340)={0x67446698, 0x1, 0x1, 0x4, 0x1, "4e631112bfb80e63571b0e828479539e43083464ec43ec60d08d9d96620f3d9870531e3ddf6577450da741b7fa072fec8446749187b99abc0941fcac553a3e96e94c5e7efe791b9e5168c00610c5f10e683ff5a88dc0965e0d593ce72f1d40bfccbbbad3ea02d16b7d0976856399761a91b7c3c5d2f440a51d88be7578e961a893ebc5db3af54b96a84ae1b9009521991b5c89e1ccbadd96851c852274a9e472db243402e2aea5918cf5e3cfb167744d372a461cb6dcc089f4abb0a93e210e0969be9799afb6de97f7868c710d6488078324c2bceb74f1aa649698a60e785c0aaf0a1f5b458809f02da27d67f84711108845060d656671519bcfb8ab45c09750e6816b22b8e8eee493d4631ba4dd9f518072af09697b4b72768c5818703398b47be1928e0bd36ce11527fbbffac156f1e0ca2d3625a901819073f2136c22f7a5489aa7f5d2584a21a366b052922205c4e4196d9a8cece108b28a7bfff97609667adafda6755662a5c0efee021763d37afc912d9b87133b898c143629949b1c80a5d22f8f2802438f87e75066eeb7caa6565d2f551c30cf251a3508f4c2f48739967c5f0e96c4a80c804df707c0e62d32a43279f4f07b6e742121d6d57a97f15c3f84c324c153ded647818ff161454a68c2d182c958f5d76f19ab31a9fccfaa9053a77a384deed7efdd870ca57d731ef7482169addb2d9062511f6239b7ab0c765664ee9281dc3ad50f071c8e2aabf785bc97edc9d56d260d95848bafccbf2d3e16aaf49f534523138547258469df48110cfb59be79a603c496926e1fb8d9ab72b54e5eedbde4a75131235ad171c930166409cacb1625a3f71d039545797d125427f62b2d539b4f3924c10dff784c154d6eae3eeaea62b732325d86511255fc43ce1bcf0c01ff594831cecb3030c388a1c71964b749c3bf4cd18394a5a02d4db4f3b5db2ece38cf208ddb3b19bab403ef798b24edce2d22b665bd34272500a5f9ee5e0564f7c2e6ec7d98a63a6ff0b18314034a961802f9fb5e05f608dbc2eede5487acbdbfa48c80bafb64313f1d69c5ecdd8846f32a855c0c63aa814e62e5f91b7d244b5b81bf1c5835ef14a12bf943a09c80a46f41662f81bfb15baf39b4614453309d80b3051e9422f6991354c6b063d967e01344f088a91eed33fcc6e9f81c2b569e468296306713fa6766caea33b7bb5bc3542f364320e9cea09208191697cf2c83b4050a36cc801f3a2319cf93c7d70094a89e0dc5c67dda7d321101912e013d4abd5643cc5a2e1d80136847dc0dfc51f4b60281eabb24e137532868d13b6e0e370f93e563b281d626c7a6f132cd604f681ab04181ab08da3590c41b7dc977329a4431d2e3a553c04c8af87ba28b1bfa8d78324c7300b4c23bd68b715656449273985c9280e3ae6be5bfa569453b84dcc9ee8fcaa6b6c2f02726c656ff424ceb1f0b9b3606a9046b6a677b948a2c957114c7caf5e13d2f0b69ab928838c864c042f84d17adb011b012a0faa27632c61d899358231fcac5cbf268bde41a57dd11b4cfea34ce0fb6c36ba71bbd321985d932ccd6e5e850c94cb11373414097a54edda08f04454a3c78f94b898ed5ae859801f1db13a0bb5830ebf95057e53ebc7653daccb1920deb01435c7b230d8c88bfb6f0c01ada5fc94dd65abedbfc2a6ce90fd95e54b20d16f55300833eccda063a255cb28b026748c750a3dafb1928f88ea3036aea6642b8075382a511892b08611cfcfb6405402ca5d2a1863c4abe5a28fc8cd17b7d42cbe4f2fe5f2d396fbafbdb3658a8630477540c120d5a5cfa17b2ab01bdb05882f1dcaadb29b6d08b673aba4c2d519bc4de2b906b0d7582e932f969d6aeb67379e4697a5a5d169c3b12fad944f14976b3a7198cd58ed9f6fedf84dd2e1fd8dd1a2ef70a0fd283d1f8df2404de55474032b93812cd8c15d9af3dd135b38bf33e1e3fddeedd0cb6e1dd174abd1e07be8604fb97283300ead229df2219b5f6f9a7c2b1f14340bf00babea59c8a97ca545bb0fa1ffd0a46733f39e326063986f182ed5931b4a044f192b786303d3e0fa1749cdcb6875b1a9ad69c0689ef2a67e958838683ea69726ec3f0288d36411030b0e31c353a648437408b69521e7240c8bf345dadb83be8624a46104fdeff0dbc37a22302381b673069a87ef10a6f1bbc5be5da9e1cb3043f27bd4a7fcd5c433f5b605c276d6ef6a67f47bd017eec1f10f7ef842ab589e6b0009ee3bf719c2222b6273c1f4006ccb46ce1ce859335d7722c251e8cd9323ed4147adba8726cf9c68ea00a561dd166d2c51de4ff2fa0145bf1449d249f8e6117416e215298ffa86d316d29a9898065457e459d5a420b36b46f97b50e3822d5761c984769b571d815c46c8ea35a0125da5898d0596b75cc9964127465c619c8788dc51215f3dd1f6f424b3a0b4527e18488380563d1cd4355ecb114d60210eaf0485c35077aca3d07a4b0b3717c3ac058ac7f677c6703f3a33d9be46092b58791c3c94b2042df8d1a28888233077616e48cb62f1f283c53c0c94e977603bc59340a6fe2a34ebdfb1e23a4ac2a42f7af1e68204bed833746a9811468afa9138080d288a8d9fe7a502551249457cc3cc5316e5bc6e04b4217a064820c2f1e9f33052427dcaabcebde3a76a4792b9fe78c9bce2c2d86aa301c5148807cb4324687365d2c579e4b5cf2b020cf702e8fad03e40073688a2847b51ce715d7a404e79702819040779f3354ad6716b141e3c7fbcc75fc1d2597d549b52ff26398b32d84f6d238bcd537c0bc0ccb1e4a8632532ea227ca9648c87fd15d8d812928e851dec361a082c382d88bc959e8493c0902fbbc19277e4ebd71c4e5ca55a2f7b23c3b7b17511cf11432584e5338bae26ad828c7cba7ef525ac9d10f0782b936d44b68a99c12e76d5d37dec85ca5051ed21e5630d010f9d1ceb6a653a2a9279794b465720f91ad822e9468f68c9e49a2142e4ac00b3cdac64c3e430f59afd14c92b49e10777eaaa4df59fe4f428884444a86cf9dada219e71ad8a83a20514396dfa427b35818abfae2ed6f78b2a5a8e92329ec077d1a2ed68b6b6dea9fa5fa25b8765d0482e433d9264b696c43233517aad09b04e35016d3ad76a681d286a28b73229b104750a58f92919bd8553a4980691aff4a14b737eb764c1cad516942ea14946a6f10481d2f4771ec02cbb72bb3a94e975c08fffac4ceb98cfa600ff6825fde791855619034bf9586885158f9fdf8d7169314e8aa8767e0cbbc60c79e80fb3250b68cdebce32f7938135b428dfe5eb5d0f1e1a276b83aa18cca7a717b072fbc0e9e8c0518749c0cbe4a04561ba4d2540d11f2760d14862237a59171fedc589cc00e89575c1ca6d9596b98dce3d9c3a9992bc7a79ed2e13319c89ddaff8800a3bad90d904667a415f6cbdfcd7c858d8ec28fd4a4052e322896f18c1a5552fda3aabf8f25f32d51dc90bf0f34fcc6617da7cc5f48c47f1c3eebcdee4f5253b6ded6c02bc0fad2bf8cb01c264cb2427200bd6a3c74d64fc0aee2e458d2ee7bc7f1515c776b56834869fc3c7dc197d29717786ae379d34576fd8dd317a25b2f9a405018ed497799f82366f4101151da4a5baaee1472862809094ab67bb5f1ac2a7dcde9cbd0bde24823ec97dbab4ed0d429d578802326846200d6c694846a75503c7932916465f890c66ae6b2c4ad850a2a7927c60b54d5e560f188a0a64dcde00dd025620e682147de708bdd4c5469b481648bb579a9b6e677e961ee5212b7252b52363eae14fc0abffb766ea3f9d1a657d48bea0661141e4b69997507641039f201d121812734c39a1f2390d6bd69804763b5fb69ec406c94ecea6ee0818f7b008e1e4b0aeda3d81b8d2e5573949cda867c836244a715aa67c6d16e69e291e699b41582e86fb93d2f27948a01bc11a5b4f8ce76a542e1eeb6539ce277e74f48f51cfb4e1652fa90e06ad1f74dba06ff35443469041c24109ea4397bb39dc5fce66cf13eb90218b9a5e1a0f0c4365bc62ac8e1a002bc332e65d13e001d9562653e99e6c19e536ef64e03a17dc03713c4e89982318c2834b11dc1cbf6a9460d638342cf895640136b6be843e199a446a4f7a0e40d0d96cf01129bd1537bcd509c0537f06a715cd82f1e8a44a37b50716df51c34d9b4664f9d978975e7eaab288eb5f66191037afd20dc966def90ab37654703f3482f96ad56fa3fb1958eb215064055ed0d57869219c50084c651b94439142c55c5e9ddced7f2e32b0854fc9540945f8914a9ac4c2aa133a69eeaee7020a92988ba8817a1e2d321b3afdf53b9b44f7387f46ad293bd7e7562d0de3e49cdefc27c4312956e387cad582149a070e5d6f570f563d6dcb0c1bbca862df60fc5b950a8661509c2c79b8a3a72df40fd4c18863f4df685059c2ba24fff98ef2c7adea97c5f95e3ca6b84221b44d9efd154150187cba82620571811d2dd478390680e7157420f7f4a1db62264f8d246cfc472e16cb5caefdff3eeaa767ca14ca17a717db81491f6bfd906e41fc90ef1a1aee628ae983eadf716077e3b39956fb55308ddbc6ce5d95f5e116536143c5e8c44366c6601b151dd8cc7851dfde9f866976acc0b67b60e6c0a0326eed6d909de708c4a6a03dae5e78ed26951cf0126a3ec15204a8f75bdcb97933aa8ad03fb2862217b4a09e1bdda3b01f7b18a6c49d30018056ef1e1aa3f28a969e443516eb94a5b0e0d8631b66e89c6aa03ccb6e57bf7615958b59c7981447792293469bfdca97acfd291d5ce46f2ee30143b2ff1e6b144e6fde590d873bcf0c784c6e7e8382296d9f792b18f74aad5551968fedfef07994a6a8be8cd36bffc528c857a0d8076d4ffb010442739efff5612292f2d0df98c54816e72fe1e44c52cab941204b2e013573f5668ffed0edca762df0122b5894768593bc1735f14d7d274e580a2d23996d76613acf944cb475546d0b8830383e51b7974978152f02799d999ca3a956cce5b367cc48f3e8b9547ca6a274a77d48cc0231f6a2a827f1748503b7a2ab558e376b14e0a73dea72e012a38593a616f6614c379a08e14d57bb28c403c825014560612c67773c404282d2f36fd95a7cd76b1d3f763ff8e606df2b358c84b260f57ea6e0162e8a323771d311422d9df85d202895ba876b11a13a2dff48fe8a63525cbdb68b82395f2325398630530b527e4131d0a2720c7f1582e7662096fc4c5fd093fcd62c47df77ac7d8ba7c89d339c77d65c61906efd47a3ac9f26a2d792580cba178f4779b4ae7142c43843e7e908990b6d439326a7130f8eb3bcfd276cb8acf340261e2cb7826a9afbc68110ae1abee197593f616faedab4d18168847756451d044637775419a9e167ae66cb407e98670c7738369446fb411d85bc8f85dfc3b5962cd62408afd5382e6ab307ebe359fe2972769d2f00d65156797e57f97dccd1675ca7d1adc5a98af7639a31abae0616dc8d4e47ec82b1704093fdc053318e1b4aedd4b8d60c9bec1b47f6b383b30a17ae4bf2d80375e1fcb35104a3c00011c0c6a1883b1b211c52c4c3d62e9be3b93bcbc13f74b3f5c1697e9d1be7a1136f2994ec195a98e9b5bfa2c488466261f55bfdb47e409f58aa4fb417958324d09990e3a9560f9dd058f76f8e350dfbd0b7db0315068348c116bdb132bbc61156a81226863aedd40c64960ea1bbfda0f15f45b1ccf98a1c7cab32f29c9e888dfe05bff5e9dcce6155000d47d462381d3c9e6c0424382bb3a6e4532287e984cc85e29dcd8c7609146ecd29412fa115240c656761a"}, 0x1010) setsockopt$inet_mreq(r0, 0x0, 0x0, &(0x7f00000000c0)={@broadcast}, 0x8) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0xa, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={r1, &(0x7f0000000040), &(0x7f0000000140)}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000300)={r1, &(0x7f0000000140), &(0x7f0000000340)}, 0x20) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000080)=""/1, 0x1}], 0x2000000000000021, 0x0) fadvise64(r0, 0x0, 0x7ff, 0xefcae1132325caad) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) 15:57:42 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000380)='/dev/net/tun\x00', 0x8000200001, 0x0) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000140)='/dev/qat_adf_ctl\x00', 0x400000, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x110, r0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={&(0x7f00000000c0)={0x10, 0x0, 0x300000000000000}, 0xc, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2800000800000600", @ANYRES32=0x0, @ANYBLOB="030000000000000008001b0000000000"], 0x28}}, 0x0) getsockopt$inet_sctp_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000180), &(0x7f0000000200)=0x4) 15:57:42 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x3f00000000000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:42 executing program 4: r0 = syz_open_dev$sndctrl(&(0x7f0000000000)='/dev/snd/controlC#\x00', 0x0, 0x0) r1 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0xd42, 0x4000) getsockopt$bt_rfcomm_RFCOMM_LM(r1, 0x12, 0x3, &(0x7f00000000c0), &(0x7f0000000100)=0x4) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r0, 0x40405514, &(0x7f0000000040)={0x2, 0x0, 0x0, 0x0, 'syz0\x00'}) [ 344.176305] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:42 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x40000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:42 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x8000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:42 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mount(&(0x7f00000000c0), &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) r0 = open(&(0x7f0000000380)='./file0//ile0\x00', 0x8000000000, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000100), 0x12) syz_genetlink_get_family_id$fou(&(0x7f0000000280)='fou\x00') perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82) r3 = memfd_create(&(0x7f0000000100)="74086e750000000000000000008c00", 0x0) getsockopt$bt_hci(r0, 0x0, 0x1, &(0x7f0000000540)=""/66, &(0x7f00000006c0)=0x42) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket(0xa, 0x1, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(r5, 0x0, 0x50, &(0x7f0000000080)=""/8, &(0x7f0000000040)=0x111) syz_open_dev$vcsn(&(0x7f0000000240)='/dev/vcs#\x00', 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2800a53088c2e92bbf8e49875ed9ddb36a000000100000200000000000000000000000", @ANYBLOB="030000000000000008001b0000000000"], 0x2}}, 0x0) dup2(r6, r4) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81806) ioctl$LOOP_CHANGE_FD(r2, 0x4c00, r3) munlockall() syz_open_dev$loop(&(0x7f0000000140)='/dev/loop#\x00', 0x1, 0x7d134285536b5ab3) r7 = memfd_create(&(0x7f0000000380)="000000000000000100000001000000768e05f7c155ad7dc6947c573e5a69244e76382c0aa63d575ea3597f8b1728277ef76b30544d7ba92dcf978f1f81dc1b7f8f7b3451dada02ecb4f1ddcc8b5241da8945666e0073c25a6201004dbea37aabd3eb9888c4c629419f50937a6848e0d281e4ee568c4de9a036c26f1922f64971d4df97fbab04e8ce4938b31dcf259b4bc60901e18661fab8fb2988cd2bc260c2f572353e6bb0a002fc164d4f189b068062d10100000000000000400c0c4ca57b546b9430172ea5362ee0141b3df06ad235e815d89eead3d9473409c09c2e27a952337a24f20188c013123cc0316a33d8b443453773e4a09edd8031124dee13ce9c75288f2ec833c7e66af5b19a00000000000000", 0x0) pwritev(r7, &(0x7f0000000340)=[{&(0x7f00000001c0)='\'', 0x1}], 0x1, 0x81806) fcntl$setflags(r2, 0x2, 0x1) io_setup(0x3, &(0x7f0000000240)=0x0) r9 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) io_submit(r8, 0x40000000000001e6, &(0x7f0000000b00)=[&(0x7f00000002c0)={0x0, 0x0, 0x0, 0x3, 0x0, r9, 0x0}]) 15:57:42 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000000100)={0x43d}, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000000000), 0x70) ioctl(r0, 0x4000008907, &(0x7f00000001c0)) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) recvmsg(r0, &(0x7f00000000c0)={&(0x7f0000000140)=@ax25, 0x80, &(0x7f0000000000), 0x0, &(0x7f00000002c0)=""/4096, 0x1000}, 0x0) 15:57:42 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 344.615899] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 344.644017] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:42 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0xb000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:42 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'authencesn(sha3-224-generic,cbc-camellia-asm)\x00'}, 0x58) 15:57:42 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xf00000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:42 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x6000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:42 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x100000000000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:42 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mount(&(0x7f00000000c0), &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) r0 = open(&(0x7f0000000380)='./file0//ile0\x00', 0x8000000000, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000100), 0x12) syz_genetlink_get_family_id$fou(&(0x7f0000000280)='fou\x00') perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82) r3 = memfd_create(&(0x7f0000000100)="74086e750000000000000000008c00", 0x0) getsockopt$bt_hci(r0, 0x0, 0x1, &(0x7f0000000540)=""/66, &(0x7f00000006c0)=0x42) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket(0xa, 0x1, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(r5, 0x0, 0x50, &(0x7f0000000080)=""/8, &(0x7f0000000040)=0x111) syz_open_dev$vcsn(&(0x7f0000000240)='/dev/vcs#\x00', 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2800a53088c2e92bbf8e49875ed9ddb36a000000100000200000000000000000000000", @ANYBLOB="030000000000000008001b0000000000"], 0x2}}, 0x0) dup2(r6, r4) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81806) ioctl$LOOP_CHANGE_FD(r2, 0x4c00, r3) munlockall() syz_open_dev$loop(&(0x7f0000000140)='/dev/loop#\x00', 0x1, 0x7d134285536b5ab3) r7 = memfd_create(&(0x7f0000000380)="000000000000000100000001000000768e05f7c155ad7dc6947c573e5a69244e76382c0aa63d575ea3597f8b1728277ef76b30544d7ba92dcf978f1f81dc1b7f8f7b3451dada02ecb4f1ddcc8b5241da8945666e0073c25a6201004dbea37aabd3eb9888c4c629419f50937a6848e0d281e4ee568c4de9a036c26f1922f64971d4df97fbab04e8ce4938b31dcf259b4bc60901e18661fab8fb2988cd2bc260c2f572353e6bb0a002fc164d4f189b068062d10100000000000000400c0c4ca57b546b9430172ea5362ee0141b3df06ad235e815d89eead3d9473409c09c2e27a952337a24f20188c013123cc0316a33d8b443453773e4a09edd8031124dee13ce9c75288f2ec833c7e66af5b19a00000000000000", 0x0) pwritev(r7, &(0x7f0000000340)=[{&(0x7f00000001c0)='\'', 0x1}], 0x1, 0x81806) fcntl$setflags(r2, 0x2, 0x1) io_setup(0x3, &(0x7f0000000240)=0x0) r9 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) io_submit(r8, 0x40000000000001e6, &(0x7f0000000b00)=[&(0x7f00000002c0)={0x0, 0x0, 0x0, 0x3, 0x0, r9, 0x0}]) 15:57:42 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x8000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 344.791944] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:42 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:42 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0xfffffffffffffffe, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0xffffffffffffff7f, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffd, @perf_bp={&(0x7f0000000080), 0x1}, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x420400, 0x0) ioctl$KVM_SET_ONE_REG(r0, 0x4010aeac, &(0x7f0000000040)={0x0, 0x1}) ioctl$int_in(r0, 0x5473, &(0x7f0000000300)) getpeername$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, &(0x7f0000000100)=0x10) ioctl$VHOST_GET_VRING_ENDIAN(0xffffffffffffffff, 0x4008af20, &(0x7f00000002c0)) 15:57:42 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x7000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 345.069756] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:43 executing program 5: r0 = socket$inet6(0xa, 0x5, 0x0) dup2(r0, r0) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f00000000c0), 0x4) 15:57:43 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0xfeffffff, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:43 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x700, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:43 executing program 1: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x7000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:43 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40030000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:43 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000600)='pagemap\x00') fcntl$setstatus(r0, 0x4, 0x2000) sendfile(r0, r1, &(0x7f0000000140), 0x20010000) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000040)={0x8001, 0x7, 0x1000}, 0x4) [ 345.345380] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:43 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000002d80)=[{{&(0x7f0000000000)=@alg, 0x80, &(0x7f0000000100), 0x0, &(0x7f0000002740)=""/218, 0xda}}], 0x1, 0x0, &(0x7f0000002e40)={0x77359400}) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0\x00') recvmmsg(0xffffffffffffffff, &(0x7f0000006340)=[{{&(0x7f0000002840)=@l2, 0x80, &(0x7f0000002dc0)=[{&(0x7f00000028c0)=""/220, 0xdc}, {&(0x7f00000029c0)=""/214, 0xd6}], 0x2, &(0x7f0000002d40)=""/47, 0x2f}}], 0x1, 0x0, &(0x7f0000006400)={0x77359400}) sendmsg$nl_generic(r0, &(0x7f0000000340)={&(0x7f0000000080), 0xc, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="14000000420501000000000000000000000000"], 0x1}}, 0x0) 15:57:43 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0xb000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:43 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x700000000000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:43 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x6000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:43 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$TIOCMBIC(r0, 0x5417, &(0x7f0000000000)=0xef6) r1 = fcntl$dupfd(r0, 0x406, r0) getsockopt$packet_int(r1, 0x107, 0xe, &(0x7f0000000040), &(0x7f0000000080)=0x4) sendmsg$nl_route(r0, &(0x7f0000001340)={&(0x7f00000000c0), 0xc, &(0x7f0000001300)={&(0x7f0000000280)=ANY=[@ANYBLOB="480000001000010000000000000000000000000017804eb4c3786f94bd108d5721c4ea078013bbb91d1a58de054f92f5b7b1467a0d80e48305e189850489e7e56955e55b66dfa9cee043e1e44528878b4a882b9f356f3dac6959e084d71954c2bde14d8f1c8ea26dabb39c224f5c462119658ca0614f1af33eaabf48019f6b5eb5badecca24e9a89b667fd29d55815fd160b31d1c23ed80d64e571dcdd0ffa59d7fca1a49dc10c2ea114935f1403af114686a66523c4936c4b563110ccb7839aa4246b", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012001000010069703665727370616e0000001400020008000200000000000800030000000000"], 0x48}}, 0x0) 15:57:43 executing program 5: r0 = socket$inet6(0xa, 0x3, 0x6) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000200)) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x0, 0x0) ioctl$KDSETKEYCODE(r1, 0x4b4d, &(0x7f0000000340)={0x262, 0xc000}) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f0000000740), &(0x7f0000000780)=0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_PIE_OFF(r1, 0x7006) setsockopt$RDS_GET_MR_FOR_DEST(0xffffffffffffffff, 0x114, 0x7, &(0x7f0000000880)={@un=@abs={0x1, 0x0, 0x4e21}, {&(0x7f0000000680)=""/183, 0xb7}, &(0x7f0000000300), 0x3}, 0xa0) ioctl$KVM_GET_NESTED_STATE(r1, 0xc080aebe, &(0x7f0000000ec0)={0x0, 0x0, 0x2080}) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}}, &(0x7f0000000380)) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000280)=r0, 0x4) r2 = socket(0x40000000015, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r2, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4) socketpair$inet6_dccp(0xa, 0x6, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) ioctl$sock_SIOCADDDLCI(r3, 0x8980, &(0x7f0000000400)={'ip6gretap0\x00', 0x7}) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f00006dbffc), 0x4) bind$inet(r2, &(0x7f0000000840)={0x2, 0x4e20, @loopback}, 0x10) ioctl$int_in(r2, 0x5421, &(0x7f0000000900)=0x6) setsockopt$RDS_CONG_MONITOR(r2, 0x114, 0x6, &(0x7f0000000080), 0x1) sendto$inet(0xffffffffffffffff, &(0x7f0000000a00)="ba671368d1010000004900000001000000018be49e9301442865319997d0efdb2f54b6a10c7327757482bfce945c2a91fb8dfafc1d3f56bc543ab87321e12cca08a744a2d128b00634bc882151d36809229a96bc3437ef159489384ade077ba295eac2882dbfd3781dd4d4e609c42628dbb709b3eb1fa030009045dd98b9e6d77b6cec9ceb685595d43995e0f04c32260943add79831e661c6a351dedc8b9d220fbf9fb6e44fb6a629ce9a82025124fec9f3ee751f7da0cd7e799be88ddbdac20b48e890ff81d7fa28c2d017d7932f2569038740461accd4582f576e4fdb6150a3399f8266bc19eb943648ad1ad81420ed6c382436e474390c8995e829e4f9df43eed85a60b9ee254e31eb62900857fa134e76cc64880334adbff069a2e5e647d2ed36a96b23834b6f6ca6b8113baf4cf30347fbb7ffc30aea99872cc0dba03b07d3347b2d257edbe2733c26b7337a79962d8ce85469e3bcbe0e4a48a6ae69d13f2d4b5155b390ef67aa714b82b6313ee277cb8986eca5db2e97cb1ae2243bba80274f614ece521baef443394b4c161cb9ae926e21892578b49cfd6efe1cb1572148c10d92218ed73ec116a18de80ac42d2726a4523a764fc6dc356c5fbbf9d2c947ae3bc9a3dc76099f3257c8d5952876151b0326d8cb1d5683ee4ad5ded9a34c00ac1b03f34627ec18a7c2e92c87b7896549cfab5eb55fa85a970994bd4b22b5f0d045e241256d06f485a47b4a55ed389bc1734541232cd41908b5cfa4b8fcfcafce500a0c7ae99767713a98e7927aa69f6ccd7daea62f19ceb82559f41899c9", 0x241, 0x0, &(0x7f000069affb)={0x2, 0x4e20, @loopback}, 0x10) r4 = mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000040)={0x0, 0x1, 0x5}) mq_timedsend(r4, &(0x7f0000000040), 0x0, 0x0, &(0x7f00000000c0)={0x77359400}) r5 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x8000, 0x0) ioctl$GIO_SCRNMAP(r5, 0x4b40, &(0x7f0000000200)=""/122) ioctl$GIO_SCRNMAP(r5, 0x4b40, &(0x7f00000002c0)=""/60) mq_timedsend(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000140)={0x77359400}) mq_timedreceive(r4, &(0x7f0000000100)=""/24, 0x18, 0x0, 0x0) getcwd(&(0x7f0000000180)=""/118, 0x76) sendto$inet(r2, &(0x7f00004b3fff), 0x0, 0x0, &(0x7f00002b4000)={0x2, 0x4e20, @loopback}, 0x10) 15:57:43 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x2, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 345.521959] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:43 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0xffffffff00000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:43 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 345.582515] netlink: 40 bytes leftover after parsing attributes in process `syz-executor4'. 15:57:43 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0xffffffff00000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:43 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x200000000000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 345.702721] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:43 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$FS_IOC_GETFSMAP(r1, 0xc0c0583b, &(0x7f0000000100)={0x0, 0x0, 0x7, 0x0, [], [{0x9, 0xffffffffffff7fff, 0x5, 0x0, 0x5, 0x6}, {0xff, 0x3, 0x4, 0x3, 0x100, 0x1}], [[], [], [], [], [], [], []]}) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000000)={'vlan0\x00', 0xd803}) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r2, 0x40045542, &(0x7f00000000c0)=0x1) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000040)={"766c616e300000f6ffffffffffffff00", {0x2, 0x0, @local}}) dup3(r1, r3, 0x0) [ 345.751281] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:44 executing program 1: mbind(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, &(0x7f0000000000), 0x45, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x802, 0x0) ioctl$BLKZEROOUT(r0, 0x127f, &(0x7f0000000280)={0x0, 0x8}) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x600000, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000040)) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000080)={@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x10a) syz_open_dev$sndctrl(&(0x7f0000000240)='/dev/snd/controlC#\x00', 0x0, 0x882) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, &(0x7f00000007c0)=ANY=[@ANYBLOB="ff1b2af7f23582df0af09f77e53be7ce651b8caf9716d5b506b91a94b322414b395ea70e5a11f481b14517df3cb67b5c39c0718b5d3e8e6d18262846d71763053361f712abfd5f8cea7b9411addc2329d6591280e768df491aec25a1424c9d4ea1ea4b50aa24f455f20000000000008a67481663ed19d885846b47b8730c788a47c73311c98ee3a1258acbc3e3de28abbc30ebb3a87c8beb6a31d72be0d827df0000000000000000000000000000746d8ea7a4a1d5494f33143f935737c95380ff5086f72cfdf73139bddd58a689437b68a0415270bcb7ef08774c9a6e0f886d47ee555212d19365946876d5999d3063bc82dc50ea8738439ced4dacb7c70b20ecd1c1df8d7849cd145d5730a7d42bc4b3d99c11eab34f0b5d0743a6d0c069f18b77185a76ec4c3fbbf0cc394903d5033267c00e62446630115a8d60f76d9b7cf2dca1f752e6886b58813805906f86c5a64f0c90fbb7d1a74169203f91b0a115115b513fa3575b42d8", @ANYRES16, @ANYPTR64=&(0x7f00000000c0)=ANY=[@ANYRESHEX=r2], @ANYRESDEC]) getsockname$packet(r1, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000400)=0x14) getresuid(&(0x7f0000000440), &(0x7f0000000640), &(0x7f0000000680)=0x0) setsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@mcast2, @in6=@remote, 0x4e20, 0x1, 0x4e22, 0x101, 0x2, 0x80, 0xa0, 0xbf, r4, r5}, {0x81, 0xc48, 0x3, 0x1, 0x5, 0xffff, 0x80000001, 0x800}, {0x800, 0x0, 0x6, 0x1f}, 0x1, 0x0, 0x1, 0x1, 0x1, 0x3}, {{@in=@dev={0xac, 0x14, 0x14, 0x17}, 0x4d3, 0x6c}, 0x2, @in6=@dev={0xfe, 0x80, [], 0xc}, 0x3503, 0x0, 0x2, 0xfff, 0x1, 0x8, 0x100000001}}, 0xe8) mount(&(0x7f00000000c0), &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r6 = openat$null(0xffffffffffffff9c, &(0x7f0000000140)='/dev/null\x00', 0x2000, 0x0) ioctl$TIOCGLCKTRMIOS(0xffffffffffffffff, 0x5456, &(0x7f0000000340)={0x0, 0x4d, 0x401, 0x5, 0x8000, 0x8, 0x1, 0x1, 0x4, 0x0, 0x2}) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000480)='/dev/ptmx\x00', 0x1, 0x0) ioctl$TCSETS(r7, 0x40045431, &(0x7f00003b9fdc)) migrate_pages(0xffffffffffffffff, 0x20, &(0x7f0000000300)=0xffffffff, &(0x7f0000000380)=0x9) syz_open_pts(r7, 0xfffffffffffffffd) write(r7, &(0x7f0000c34fff), 0xffffff0b) ioctl$DRM_IOCTL_RM_MAP(r6, 0x4018641b, &(0x7f00000002c0)={&(0x7f0000f24000/0x3000)=nil, 0x7, 0x4, 0x80, &(0x7f0000409000/0xc000)=nil, 0x1}) ioctl$sock_inet_tcp_SIOCOUTQ(r1, 0x5411, &(0x7f00000001c0)) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2000005, 0x5c831, 0xffffffffffffffff, 0x0) write$cgroup_pid(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(0xffffffffffffffff, 0x80045530, &(0x7f00000004c0)=""/110) r8 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x0, 0x1) syz_kvm_setup_cpu$x86(r1, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000100)="c4e1e95f3ab9800000c00f3235000400000f30c4c275040d670000000f01cb0f30660f01180f06c4c2fd329f16000000660ff665fdf3660f221b", 0x3a}], 0x1, 0x2, &(0x7f0000000180)=[@vmwrite={0x8, 0x0, 0x0, 0x0, 0x6, 0x0, 0x100000000}, @efer={0x2, 0x1}], 0x2) 15:57:44 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x600}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:44 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x40000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:44 executing program 5: r0 = socket$inet6(0xa, 0x3, 0x6) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000200)) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x0, 0x0) ioctl$KDSETKEYCODE(r1, 0x4b4d, &(0x7f0000000340)={0x262, 0xc000}) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f0000000740), &(0x7f0000000780)=0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_PIE_OFF(r1, 0x7006) setsockopt$RDS_GET_MR_FOR_DEST(0xffffffffffffffff, 0x114, 0x7, &(0x7f0000000880)={@un=@abs={0x1, 0x0, 0x4e21}, {&(0x7f0000000680)=""/183, 0xb7}, &(0x7f0000000300), 0x3}, 0xa0) ioctl$KVM_GET_NESTED_STATE(r1, 0xc080aebe, &(0x7f0000000ec0)={0x0, 0x0, 0x2080}) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}}, &(0x7f0000000380)) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000280)=r0, 0x4) r2 = socket(0x40000000015, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r2, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4) socketpair$inet6_dccp(0xa, 0x6, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) ioctl$sock_SIOCADDDLCI(r3, 0x8980, &(0x7f0000000400)={'ip6gretap0\x00', 0x7}) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f00006dbffc), 0x4) bind$inet(r2, &(0x7f0000000840)={0x2, 0x4e20, @loopback}, 0x10) ioctl$int_in(r2, 0x5421, &(0x7f0000000900)=0x6) setsockopt$RDS_CONG_MONITOR(r2, 0x114, 0x6, &(0x7f0000000080), 0x1) sendto$inet(0xffffffffffffffff, &(0x7f0000000a00)="ba671368d1010000004900000001000000018be49e9301442865319997d0efdb2f54b6a10c7327757482bfce945c2a91fb8dfafc1d3f56bc543ab87321e12cca08a744a2d128b00634bc882151d36809229a96bc3437ef159489384ade077ba295eac2882dbfd3781dd4d4e609c42628dbb709b3eb1fa030009045dd98b9e6d77b6cec9ceb685595d43995e0f04c32260943add79831e661c6a351dedc8b9d220fbf9fb6e44fb6a629ce9a82025124fec9f3ee751f7da0cd7e799be88ddbdac20b48e890ff81d7fa28c2d017d7932f2569038740461accd4582f576e4fdb6150a3399f8266bc19eb943648ad1ad81420ed6c382436e474390c8995e829e4f9df43eed85a60b9ee254e31eb62900857fa134e76cc64880334adbff069a2e5e647d2ed36a96b23834b6f6ca6b8113baf4cf30347fbb7ffc30aea99872cc0dba03b07d3347b2d257edbe2733c26b7337a79962d8ce85469e3bcbe0e4a48a6ae69d13f2d4b5155b390ef67aa714b82b6313ee277cb8986eca5db2e97cb1ae2243bba80274f614ece521baef443394b4c161cb9ae926e21892578b49cfd6efe1cb1572148c10d92218ed73ec116a18de80ac42d2726a4523a764fc6dc356c5fbbf9d2c947ae3bc9a3dc76099f3257c8d5952876151b0326d8cb1d5683ee4ad5ded9a34c00ac1b03f34627ec18a7c2e92c87b7896549cfab5eb55fa85a970994bd4b22b5f0d045e241256d06f485a47b4a55ed389bc1734541232cd41908b5cfa4b8fcfcafce500a0c7ae99767713a98e7927aa69f6ccd7daea62f19ceb82559f41899c9", 0x241, 0x0, &(0x7f000069affb)={0x2, 0x4e20, @loopback}, 0x10) r4 = mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000040)={0x0, 0x1, 0x5}) mq_timedsend(r4, &(0x7f0000000040), 0x0, 0x0, &(0x7f00000000c0)={0x77359400}) r5 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x8000, 0x0) ioctl$GIO_SCRNMAP(r5, 0x4b40, &(0x7f0000000200)=""/122) ioctl$GIO_SCRNMAP(r5, 0x4b40, &(0x7f00000002c0)=""/60) mq_timedsend(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000140)={0x77359400}) mq_timedreceive(r4, &(0x7f0000000100)=""/24, 0x18, 0x0, 0x0) getcwd(&(0x7f0000000180)=""/118, 0x76) sendto$inet(r2, &(0x7f00004b3fff), 0x0, 0x0, &(0x7f00002b4000)={0x2, 0x4e20, @loopback}, 0x10) 15:57:44 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x4000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:44 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$FS_IOC_GETFSMAP(r1, 0xc0c0583b, &(0x7f0000000100)={0x0, 0x0, 0x7, 0x0, [], [{0x9, 0xffffffffffff7fff, 0x5, 0x0, 0x5, 0x6}, {0xff, 0x3, 0x4, 0x3, 0x100, 0x1}], [[], [], [], [], [], [], []]}) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000000)={'vlan0\x00', 0xd803}) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r2, 0x40045542, &(0x7f00000000c0)=0x1) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000040)={"766c616e300000f6ffffffffffffff00", {0x2, 0x0, @local}}) dup3(r1, r3, 0x0) [ 346.351268] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:44 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xffffff9e}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:44 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0xb00, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:44 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x7000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:44 executing program 5: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000780)) openat$tun(0xffffffffffffff9c, &(0x7f0000000640)='/dev/net/tun\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$mice(&(0x7f0000000200)='/dev/input/mice\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)="2e2f6367726f75d9b6a30000008000000000", 0x1ff) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000040)={0x0, 0x7, "1c7edd8a28e9c8"}, &(0x7f0000000080)=0xf) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f00000000c0)={0x61, 0x800, 0x8000, 0x20, 0x0, 0x503, 0x0, 0x0, r1}, &(0x7f0000000100)=0x20) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000280)='/dev/autofs\x00', 0x0, 0x0) unshare(0x8020000) r4 = syz_open_procfs$namespace(0x0, &(0x7f0000000140)='ns/mnt\x00') ioctl$TCSBRK(r0, 0x5409, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r3, 0x84, 0x19, &(0x7f00000001c0)={r2, 0x80}, 0x8) setns(r4, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000340)="2e2f6367726f75702e6e65742f73797a312775ca1e56b82a6b2c9610345bf0841f9c0102ea8317e1c2fd7ad819a4e039", 0x1ff) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000240)={0xffffffffffffffff}, 0x13f, 0xb}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r3, &(0x7f0000000480)={0x14, 0x88, 0xfa00, {r5, 0x30, 0x0, @in={0x2, 0x4e24}}}, 0x90) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(0xffffffffffffffff, 0x40a45321, &(0x7f0000000540)={{0x7, 0x6}, 'port1\x00', 0x0, 0x1010, 0x0, 0x0, 0x7, 0x143c}) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, &(0x7f0000000180)=0x10800, 0x4) getresuid(&(0x7f0000000440), &(0x7f0000000600), &(0x7f0000000640)) ioctl$LOOP_CTL_ADD(0xffffffffffffffff, 0x4c80, 0x0) ioctl$TCSBRK(r3, 0x5409, 0x80) ioctl$KVM_DEASSIGN_PCI_DEVICE(0xffffffffffffffff, 0x4040ae72, &(0x7f0000000680)={0xa6, 0x0, 0x7093}) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000740)={&(0x7f0000000700)='./file0\x00'}, 0x10) ioctl$UI_GET_VERSION(r0, 0x8004552d, &(0x7f0000000000)) [ 346.610557] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:44 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x8, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:44 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x5c, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:45 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) r1 = accept4$alg(r0, 0x0, 0x0, 0x4) recvmsg$kcm(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000100)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000300)=[{&(0x7f0000000180)=""/210, 0xd2}, {&(0x7f0000000280)=""/87, 0x57}], 0x2, &(0x7f0000000340)=""/127, 0x7f, 0x7ff}, 0x20) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000000)) bind(r1, &(0x7f0000000400)=@nfc={0x27, 0x1, 0x1, 0x1}, 0x100000053) 15:57:45 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xffffffff00000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:45 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0xb00000000000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:45 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x6, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:45 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$FS_IOC_GETFSMAP(r1, 0xc0c0583b, &(0x7f0000000100)={0x0, 0x0, 0x7, 0x0, [], [{0x9, 0xffffffffffff7fff, 0x5, 0x0, 0x5, 0x6}, {0xff, 0x3, 0x4, 0x3, 0x100, 0x1}], [[], [], [], [], [], [], []]}) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000000)={'vlan0\x00', 0xd803}) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r2, 0x40045542, &(0x7f00000000c0)=0x1) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000040)={"766c616e300000f6ffffffffffffff00", {0x2, 0x0, @local}}) dup3(r1, r3, 0x0) 15:57:45 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) accept4(r0, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @remote}}}, &(0x7f00000000c0)=0x80, 0x800) sendmmsg(r0, &(0x7f0000002000)=[{{&(0x7f0000001c00)=@in={0x2, 0x4e23, @broadcast}, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000000100)=[{0x20, 0x0, 0x7, "8612b75e7eff7f0000000000004a927364"}], 0x20}}], 0x1, 0x0) 15:57:45 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x800000000000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:45 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x300, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 347.288497] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:45 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000000)=ANY=[@ANYBLOB="020d000010000000000000000300060722000086000002000000e0000001000000000000000008f8ff0002000200000009007d22000018000000030300000000001000400000000000100000000016090051d5680001ac1414bb000014000000000000000003000500000000000200000000010000000000000000000049d1d2c6bcf7d2150d913c2e18541af56b75d63ec153573ff7e05ced9b7893126428825a537a68261d72c38646d8b7b9237b578bf1ee15c6"], 0x80}}, 0x0) 15:57:45 executing program 5: r0 = inotify_init() uname(&(0x7f0000000440)=""/211) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000300)={{{@in6, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@remote}}, &(0x7f0000000400)=0xe8) syz_genetlink_get_family_id$team(&(0x7f0000000140)='team\x00') ioctl(r0, 0x3, &(0x7f0000000740)="cf8c24bc2fc19854b6532b15388ce4600911b81866c0") recvmmsg(0xffffffffffffff9c, &(0x7f0000004440)=[{{&(0x7f0000001bc0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, 0x80, &(0x7f0000001f80)=[{&(0x7f0000001c40)=""/37, 0x25}, {&(0x7f0000001c80)=""/27, 0x1b}, {&(0x7f0000001cc0)=""/160, 0xa0}], 0x3, &(0x7f0000002000)=""/112, 0x70}}, {{&(0x7f00000040c0)=@l2, 0x80, &(0x7f00000043c0)}}], 0x2, 0x21, &(0x7f00000045c0)={0x0, 0x989680}) ioctl$NBD_DISCONNECT(0xffffffffffffffff, 0xab08) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f0000000180)={{0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x14}}, {0x306, @broadcast}, 0x0, {0x2, 0x4e20, @rand_addr}, 'teql0\x00'}) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x10000, 0x0, 0x8e}, &(0x7f0000000040)=0x14) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000007180)={0x0, @broadcast, @broadcast}, &(0x7f0000000280)=0x52c38c26) ioctl$SNDRV_TIMER_IOCTL_INFO(0xffffffffffffffff, 0x80e85411, &(0x7f0000004600)=""/4096) r3 = memfd_create(&(0x7f0000000700)='team\x00', 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r3, 0x84, 0x7, &(0x7f0000000200)={0x1}, 0x4) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f00000096c0)={'team0\x00'}) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(0xffffffffffffffff, 0x84, 0x12, &(0x7f0000000540), &(0x7f0000000580)=0x4) setsockopt$inet_sctp6_SCTP_RTOINFO(r3, 0x84, 0x0, &(0x7f00000006c0)={r2, 0x1f, 0x9, 0x7}, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000080)={'vcan0\x00', r1}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000009e40)={'ip6gretap0\x00'}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000005c0)='status\x00') preadv(r4, &(0x7f00000017c0), 0x1fe, 0x0) 15:57:45 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x9effffff}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:45 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x600000000000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:45 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x5c00000000000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:45 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0xfeffffff00000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 347.565359] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:45 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x40000000000009) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000440)={0x0, 0x0, 0x1}, 0x14) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x2, &(0x7f00000000c0)=0x201, 0x4) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) bind$inet6(r2, &(0x7f0000000240)={0xa, 0x40, 0x3, @local, 0x2}, 0x1c) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000180)='veno\x00', 0x5) sendto$inet6(r3, &(0x7f0000000280), 0xfffffffffffffedd, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty={[0xe00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd9050000]}}, 0x1c) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f00000003c0)='IPVS\x00') init_module(&(0x7f00000001c0)='eth0\x00', 0x5, &(0x7f0000000200)='.GPLsecurity\\@vmnet1\x00') sendmsg$IPVS_CMD_GET_SERVICE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000400)={&(0x7f0000000480)={0xb8, r4, 0x2, 0x70bd28, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e22}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}, @IPVS_CMD_ATTR_SERVICE={0x44, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x29}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast1}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblcr\x00'}]}, @IPVS_CMD_ATTR_DAEMON={0x3c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syzkaller1\x00'}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x9}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x70000000000000}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}]}]}, 0xb8}, 0x1, 0x0, 0x0, 0x1}, 0x20000000) fsetxattr(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="a91e"], &(0x7f00000002c0)='keyring+%\x00', 0xa, 0x1) r5 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x12, 0x0, @thr={&(0x7f0000000340), &(0x7f0000000180)}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000100)={{0x0, 0x8}, {0x0, 0x1c9c380}}, &(0x7f0000040000)) set_tid_address(&(0x7f0000000580)) tkill(r5, 0x401104000000016) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000340)="62627200127a7befb1aecd9d343c125105380d534d033390f728a1d423f4e7de0e284f4e76cd331830592dd776c542f5279a821f624aa22dc8d441c18a0f716a6df525e17304091496afcbc5bb1fdeb3a2b1669c2de799359c50b894", 0x5c) shutdown(r0, 0x1) 15:57:45 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0xfeffffff00000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 347.762589] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 15:57:45 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xf0ffffff}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:45 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x6, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:45 executing program 4: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) unshare(0x2000000000005fd) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e23, @broadcast}}, 0x808f, 0x6}, &(0x7f0000000180)=0x88) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f00000001c0)={r1, 0xd975}, &(0x7f0000000200)=0x8) pselect6(0x40, &(0x7f0000000000)={0x8}, &(0x7f0000000040), &(0x7f0000000300), &(0x7f0000000340)={0x0, 0x1c9c380}, &(0x7f00000003c0)={&(0x7f0000000380), 0x8}) 15:57:45 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x3f00, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:45 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x800000000000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 347.895615] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:46 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000ffc000/0x2000)=nil}) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000180)=0x2) getsockopt$ARPT_SO_GET_REVISION_TARGET(r3, 0x0, 0x63, &(0x7f0000000040)={'NETMAP\x00'}, &(0x7f00000000c0)=0x1e) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000ffe000/0x1000)=nil}) ioctl$KVM_GET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000000)) ioctl$KVM_RUN(r2, 0xae80, 0x0) 15:57:46 executing program 4: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x1) ioctl$KVM_GET_NESTED_STATE(r0, 0x8108551b, &(0x7f0000002280)={0x0, 0x0, 0x2080}) 15:57:46 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x6000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:46 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x4000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:46 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x1000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 348.301785] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:46 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x805000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:46 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0xffffffffffffffff, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:46 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0xffffffffffffffff, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:46 executing program 4: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x1) ioctl$KVM_GET_NESTED_STATE(r0, 0x8108551b, &(0x7f0000002280)={0x0, 0x0, 0x2080}) 15:57:46 executing program 1: socketpair(0x11, 0xa, 0x5, &(0x7f0000000000)={0xffffffffffffffff}) readahead(r0, 0x1c226101, 0x3) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000733000)={0x5, 0x5, 0x7, 0x9}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0xd, 0x1fe, 0x4, 0x100000009, 0x4, r1}, 0x2c) 15:57:46 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000002b000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000002500)='./file0/bus\x00', 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r1, 0xc10c5541, &(0x7f0000000240)={0x3, 0x4e65, 0x1ff, 0x0, 0x0, [], [], [], 0x8, 0x7fff}) r2 = open$dir(&(0x7f0000000380)='./file0/bus/file0\x00', 0x0, 0x2000000000000) ioctl$sock_inet_SIOCDARP(r1, 0x8953, &(0x7f0000000000)={{0x2, 0x4e21, @remote}, {0x1, @dev={[], 0x15}}, 0x8, {0x2, 0x4e22, @multicast1}, 'bcsf0\x00'}) setsockopt$inet6_MRT6_DEL_MFC(r1, 0x29, 0xcd, &(0x7f00000003c0)={{0xa, 0x4e24, 0x0, @empty, 0xffffffff}, {0xa, 0x4e23, 0x0, @mcast1, 0x1}, 0x0, [0x9, 0x1, 0x0, 0x9, 0x453, 0x7, 0x4, 0x7f]}, 0x5c) syz_open_dev$ndb(&(0x7f0000000080)='/dev/nbd#\x00', 0x0, 0x101000) r3 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x7, 0x12000) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r3, 0x84, 0x20, &(0x7f0000000440), &(0x7f0000000480)=0x4) ioctl$FIDEDUPERANGE(r2, 0xc0189436, &(0x7f0000000180)=ANY=[@ANYBLOB="ffffff771a0c3e8a02000000000000000000", @ANYRES32=r0, @ANYBLOB="00000000800000000000000000000000000000000000000000000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r0, @ANYBLOB="00000000fd5200000000000000000000000000000000000000000000", @ANYRES32=r2, @ANYBLOB="0000000078a100000000000000000000000000000000000000000000"]) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f00000000c0), &(0x7f0000000140)=0x8) [ 348.633136] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:46 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x4000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:46 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x7, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:46 executing program 4: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x1) ioctl$KVM_GET_NESTED_STATE(r0, 0x8108551b, &(0x7f0000002280)={0x0, 0x0, 0x2080}) 15:57:46 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xf0ffffffffffff}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:46 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000001a40)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, &(0x7f0000c97ff8)) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/audio\x00', 0x0, 0x0) close(r1) openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000100)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000f1dff8)={0x0, r1}) 15:57:46 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x3f000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:46 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x300000000000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 348.818127] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:46 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x600000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:46 executing program 4: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x1) ioctl$KVM_GET_NESTED_STATE(r0, 0x8108551b, &(0x7f0000002280)={0x0, 0x0, 0x2080}) 15:57:46 executing program 1: io_setup(0x203, &(0x7f0000000040)=0x0) r1 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) close(r1) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x0, 0x0) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r2, 0x84, 0x7, &(0x7f0000000100)={0xc5}, 0x4) ioctl$KVM_SET_PIT(r2, 0x8048ae66, &(0x7f0000000140)={[{0x4, 0x9, 0x100000000, 0xfffffffffffffff8, 0xff, 0xfff, 0x200, 0x10001, 0x9, 0x7f, 0x1, 0x5, 0x2}, {0x5, 0xffffffffffffff2c, 0x0, 0x6, 0xeac0000000000, 0x400, 0x800, 0x5, 0x8, 0x915, 0x4, 0x7fff, 0xfffffffffffffffa}, {0x0, 0x3f, 0x8, 0x64, 0x2, 0x1, 0x5, 0x10001, 0x7, 0x80, 0x7, 0x8000, 0x9}], 0x73e}) setsockopt$l2tp_PPPOL2TP_SO_LNSMODE(r2, 0x111, 0x4, 0x0, 0x4) ioctl$TIOCLINUX7(r2, 0x541c, &(0x7f00000000c0)={0x7, 0x7f}) io_submit(r0, 0x1, &(0x7f0000000b00)=[&(0x7f00000002c0)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) 15:57:46 executing program 5: sendmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000140)=@ipx={0x4, 0x80000001, 0x0, "0950fe4adba7"}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000000240)}, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000000), 0x2b5) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f00000000c0)=@in6={0x31100, 0x894f, 0x5, @dev={0xfe, 0x80, [0x1517, 0x0, 0x0, 0x329]}}, 0x80, &(0x7f0000000340), 0x25d, &(0x7f0000000380)}, 0x0) 15:57:46 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x700}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 348.963231] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:46 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x3, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:46 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x1000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:47 executing program 4: ioctl$KVM_GET_NESTED_STATE(0xffffffffffffffff, 0x8108551b, &(0x7f0000002280)={0x0, 0x0, 0x2080}) 15:57:47 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/connector\x00') fsetxattr(r0, &(0x7f0000000280)=@known='user.syz\x00', &(0x7f00000002c0)='\x00', 0x398, 0x0) fremovexattr(r0, &(0x7f00000000c0)=@known='user.syz\x00') 15:57:47 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0xb00, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 349.116563] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:47 executing program 5: sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x40000000000009) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, &(0x7f0000000100), 0xacdbf90f7b4ecd63, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @ipv4={[0x6453af3d52000000, 0x20eb7d0a70000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1100000000000000], [], @dev={0xac, 0x14, 0x14, 0x10}}}, 0x1c) r2 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x12, 0x0, @thr={&(0x7f0000000340), &(0x7f0000000180)}}, &(0x7f0000000100)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x1c9c380}}, &(0x7f0000040000)) r3 = syz_open_dev$dmmidi(&(0x7f0000000180)='/dev/dmmidi#\x00', 0x81, 0x10402) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f00000001c0)={0x0, 0x80}, &(0x7f0000000200)=0x8) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r3, 0x84, 0x79, &(0x7f0000000240)={r4, 0x2, 0x7ff}, 0x8) tkill(r2, 0x401104000000016) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqsrc(r5, 0x0, 0x27, &(0x7f0000000000)={@multicast2, @remote, @loopback}, 0xc) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f00000000c0)={0x0, 0x3}, &(0x7f0000000100)=0xc) 15:57:47 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0xb, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:47 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x6000000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:47 executing program 4: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x0, 0x1) ioctl$KVM_GET_NESTED_STATE(r0, 0x8108551b, &(0x7f0000002280)={0x0, 0x0, 0x2080}) 15:57:47 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) setxattr$system_posix_acl(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000640)={{}, {}, [], {}, [{}], {}, {0x20, 0x4}}, 0x2c, 0x0) 15:57:47 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x600, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:47 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x600000000000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 349.311942] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:47 executing program 4: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) ioctl$KVM_GET_NESTED_STATE(r0, 0x8108551b, &(0x7f0000002280)={0x0, 0x0, 0x2080}) 15:57:47 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) getgid() recvmmsg(r0, &(0x7f0000002d80)=[{{&(0x7f0000000000)=@alg, 0x80, &(0x7f0000000100)=[{&(0x7f0000001480)=""/4096, 0x1013}, {&(0x7f0000000240)=""/147, 0x1f}], 0x2, &(0x7f0000002740)=""/218, 0xda}}], 0xf9e1221a8413ff5d, 0x0, &(0x7f0000002e40)={0x77359400}) recvmmsg(0xffffffffffffffff, &(0x7f0000006340)=[{{&(0x7f0000002840)=@l2, 0x80, &(0x7f0000002dc0)=[{&(0x7f00000028c0)=""/220, 0xdc}, {&(0x7f00000029c0)=""/214, 0xd6}], 0x2, &(0x7f0000002d40)=""/47, 0x2f}}], 0x1, 0x0, &(0x7f0000006400)={0x77359400}) sendmsg$nl_generic(r0, &(0x7f0000000340)={&(0x7f0000000400), 0xc, &(0x7f0000000300)={&(0x7f0000000140)={0x14, 0x40000000042, 0x105}, 0x14}}, 0x0) 15:57:47 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x300000000000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:47 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0xf000, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:47 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x5c000000, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 349.490855] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:48 executing program 5: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xc, &(0x7f0000d1c000)=0x102f, 0x18c) getsockopt$inet6_int(r1, 0x29, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x4) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, &(0x7f0000000300)={0x29, @local, 0x0, 0x1, 'rr\x00', 0x28, 0x4, 0x3d}, 0x2c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) r2 = memfd_create(&(0x7f00000001c0)='/dev/audio#\x00', 0x2) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f00000002c0)=0x0) perf_event_open(&(0x7f0000000240)={0x4, 0x70, 0x80000000, 0xfffffffffffffffa, 0x20, 0x2, 0x0, 0xfffffffffffffff7, 0x40082, 0x1, 0x9, 0x9, 0xd6, 0x9, 0xffffffffffff2b1b, 0x1, 0x6, 0x3, 0x0, 0x2, 0x3f, 0xcb, 0x6, 0x5, 0x8, 0x3ff, 0xffff, 0x1, 0x5, 0xfffffffffffffffe, 0x81, 0xc3, 0x1, 0x6, 0x7fff, 0xffff, 0x2, 0x7, 0x0, 0x3, 0x2, @perf_config_ext={0x2, 0x9}, 0x400, 0xff66, 0x101, 0x7, 0x3, 0x3612, 0xfff}, r3, 0x8, r2, 0x0) r4 = syz_open_dev$audion(&(0x7f0000000080)='/dev/audio#\x00', 0x100, 0x0) setsockopt$IP_VS_SO_SET_EDIT(r2, 0x0, 0x483, &(0x7f0000000200)={0x67, @remote, 0x4e23, 0x2, 'none\x00', 0x3, 0x8001, 0x6c}, 0x2c) getsockopt$inet_tcp_buf(r4, 0x6, 0x1f, &(0x7f00000000c0)=""/32, &(0x7f0000000100)=0x20) 15:57:48 executing program 4: syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x1) ioctl$KVM_GET_NESTED_STATE(0xffffffffffffffff, 0x8108551b, &(0x7f0000002280)={0x0, 0x0, 0x2080}) 15:57:48 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:48 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) 15:57:48 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x5c00, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:48 executing program 1: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000e73000/0x2000)=nil, 0x2000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair(0x1, 0x0, 0x7, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_mreq(r3, 0x29, 0x15, &(0x7f0000000500)={@remote, 0x0}, &(0x7f0000000540)=0x14) ioctl$sock_inet6_SIOCDELRT(r2, 0x890c, &(0x7f0000000580)={@ipv4={[], [], @broadcast}, @mcast2, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1e}}, 0x401, 0x7ff, 0x75b3, 0x100, 0x8, 0x800c0, r4}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000200)={{{@in=@multicast2, @in=@broadcast}}, {{@in=@multicast2}, 0x0, @in6=@dev}}, &(0x7f0000000300)=0xe8) write$FUSE_LSEEK(0xffffffffffffffff, &(0x7f00000001c0)={0x18, 0x0, 0x6, {0x5da90358}}, 0x18) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffff9c, 0x84, 0xa, &(0x7f0000000080)={0x651, 0xfffffffffffff65f, 0x200, 0x7b09, 0x100020000000000, 0x7, 0x8, 0x4, 0x0}, &(0x7f0000000140)=0x20) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, &(0x7f0000000180)={r5}, 0xc) r6 = ioctl$KVM_CREATE_VCPU(r1, 0x5450, 0x0) fcntl$getown(r6, 0x9) ioctl$TIOCGSID(r2, 0x5429, &(0x7f00000004c0)) ioctl$KVM_SET_BOOT_CPU_ID(0xffffffffffffffff, 0xae78, &(0x7f0000001f00)) ioctl$UI_SET_KEYBIT(r3, 0x40045565, 0x19) ioctl$KDSETMODE(r2, 0x4b3a, 0x1) getpgid(0xffffffffffffffff) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000001e40)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) sendmsg$netlink(r2, &(0x7f0000001ec0)={&(0x7f0000000480)=@kern={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000001e00)=[{&(0x7f0000001c80)=ANY=[@ANYBLOB], 0x1}], 0x1, &(0x7f0000000040)=ANY=[@ANYBLOB="200000000100000001000000", @ANYRES32=r3, @ANYRES32=r7, @ANYRES32=r2, @ANYRES32=r2], 0x1c, 0x40040}, 0x40040) r8 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r8, 0x4c06, r1) ioctl$PPPOEIOCDFWD(r2, 0xb101, 0x0) getsockopt$IP6T_SO_GET_INFO(r3, 0x29, 0x40, &(0x7f0000000340)={'nat\x00'}, &(0x7f0000000440)=0x54) syz_kvm_setup_cpu$x86(r8, r6, &(0x7f0000209000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000400)="66b8010000000f01c1baf80c66b8f8a2e28366efbafc0c66b8dd52aa7966ef6436f2a40f30dbd07c800f2169650f019d64d90f214d0f01df", 0x38}], 0x1, 0x0, &(0x7f0000000140), 0x0) [ 350.166524] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:48 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0xfff, 0x400000) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x13, 0x5, 0xfffffffffffffffd, 0x2000000000000000, 0x0, r0}, 0x2c) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x8, 0x5, &(0x7f0000000000)=@framed={{}, [@map={0x18, 0x4, 0x1, 0x0, r1}]}, &(0x7f0000000140)='GPL\x00', 0x0, 0xf4, &(0x7f0000000280)=""/244}, 0x15) 15:57:48 executing program 4 (fault-call:1 fault-nth:0): r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x1) ioctl$KVM_GET_NESTED_STATE(r0, 0x8108551b, &(0x7f0000002280)={0x0, 0x0, 0x2080}) 15:57:48 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x3c, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:48 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x48, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) [ 350.315994] FAULT_INJECTION: forcing a failure. [ 350.315994] name failslab, interval 1, probability 0, space 0, times 0 [ 350.333142] CPU: 1 PID: 18068 Comm: syz-executor4 Not tainted 4.19.0-rc3+ #142 [ 350.340540] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 350.349909] Call Trace: [ 350.352522] dump_stack+0x1c4/0x2b4 [ 350.356180] ? dump_stack_print_info.cold.2+0x52/0x52 [ 350.361414] should_fail.cold.4+0xa/0x17 [ 350.365511] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 350.370636] ? print_usage_bug+0xc0/0xc0 [ 350.374717] ? graph_lock+0x170/0x170 [ 350.378530] ? __lock_acquire+0x7ec/0x4ec0 [ 350.382779] ? print_usage_bug+0xc0/0xc0 [ 350.386854] ? graph_lock+0x170/0x170 [ 350.390678] ? find_held_lock+0x36/0x1c0 [ 350.394759] ? __lock_is_held+0xb5/0x140 [ 350.398851] ? ___might_sleep+0x1ed/0x300 [ 350.403018] ? arch_local_save_flags+0x40/0x40 [ 350.407621] ? mark_held_locks+0x130/0x130 [ 350.411886] __should_failslab+0x124/0x180 [ 350.416147] should_failslab+0x9/0x14 [ 350.419969] __kmalloc_track_caller+0x2d0/0x750 [ 350.424657] ? debug_smp_processor_id+0x1c/0x20 [ 350.429345] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 350.434898] ? check_preemption_disabled+0x48/0x200 [ 350.439935] ? kstrdup_const+0x66/0x80 [ 350.443841] kstrdup+0x39/0x70 [ 350.447052] kstrdup_const+0x66/0x80 [ 350.450783] __kernfs_new_node+0xe8/0x8d0 [ 350.454949] ? kernfs_dop_revalidate+0x3c0/0x3c0 [ 350.459725] ? graph_lock+0x170/0x170 [ 350.463547] ? blocking_notifier_call_chain+0x129/0x190 [ 350.468936] ? find_held_lock+0x36/0x1c0 [ 350.473018] ? find_held_lock+0x36/0x1c0 [ 350.477107] ? sysfs_do_create_link_sd.isra.2+0x82/0x130 [ 350.482574] ? lock_downgrade+0x900/0x900 [ 350.486753] kernfs_new_node+0x95/0x120 [ 350.490755] kernfs_create_link+0xdb/0x250 [ 350.495011] sysfs_do_create_link_sd.isra.2+0x90/0x130 [ 350.500311] sysfs_create_link+0x65/0xc0 [ 350.504398] driver_sysfs_add+0x109/0x350 [ 350.508564] device_bind_driver+0x19/0xd0 [ 350.512730] usb_driver_claim_interface+0x34d/0x3f0 [ 350.517768] claimintf+0x10e/0x170 [ 350.521326] proc_disconnect_claim+0x2cc/0x440 [ 350.525923] ? proc_ioctl+0x7e0/0x7e0 [ 350.529784] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 350.535350] usbdev_do_ioctl+0x17e3/0x3b50 [ 350.539607] ? processcompl_compat+0x680/0x680 [ 350.544212] ? perf_trace_lock+0x7a0/0x7a0 [ 350.548477] ? graph_lock+0x170/0x170 [ 350.552301] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 350.557855] ? _kstrtoull+0x188/0x250 [ 350.561669] ? graph_lock+0x170/0x170 [ 350.565489] ? _parse_integer+0x180/0x180 [ 350.569649] ? graph_lock+0x170/0x170 [ 350.573477] ? lock_release+0x970/0x970 [ 350.577486] ? find_held_lock+0x36/0x1c0 [ 350.581831] ? __fget+0x4aa/0x740 [ 350.585296] ? lock_downgrade+0x900/0x900 [ 350.589465] ? check_preemption_disabled+0x48/0x200 [ 350.594506] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 350.600327] ? kasan_check_read+0x11/0x20 [ 350.604494] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 350.609785] ? rcu_bh_qs+0xc0/0xc0 [ 350.613359] ? __fget+0x4d1/0x740 15:57:48 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xf0ffff}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 350.616833] ? ksys_dup3+0x680/0x680 [ 350.620569] ? kasan_check_write+0x14/0x20 [ 350.624821] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 350.629775] ? wait_for_completion+0x8a0/0x8a0 [ 350.634377] ? __lock_is_held+0xb5/0x140 [ 350.638469] ? __fget_light+0x2e9/0x430 [ 350.642467] ? fget_raw+0x20/0x20 [ 350.645940] ? __sb_end_write+0xd9/0x110 [ 350.650023] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 350.655574] ? fput+0x130/0x1a0 [ 350.658872] ? do_fast_syscall_32+0x150/0xfb2 [ 350.663387] ? do_fast_syscall_32+0x150/0xfb2 [ 350.667902] ? lockdep_hardirqs_on+0x421/0x5c0 [ 350.672499] ? usbdev_do_ioctl+0x3b50/0x3b50 [ 350.676647] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 350.676916] usbdev_compat_ioctl+0x24/0x30 [ 350.676941] __ia32_compat_sys_ioctl+0x20e/0x630 [ 350.676968] do_fast_syscall_32+0x34d/0xfb2 [ 350.698789] ? do_int80_syscall_32+0x890/0x890 [ 350.703400] ? entry_SYSENTER_compat+0x68/0x7f [ 350.708003] ? trace_hardirqs_off_caller+0xbb/0x310 [ 350.713050] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 350.717902] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 350.722762] ? trace_hardirqs_on_caller+0x310/0x310 [ 350.727800] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 350.732832] ? prepare_exit_to_usermode+0x291/0x3b0 [ 350.737875] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 350.743235] entry_SYSENTER_compat+0x70/0x7f [ 350.747660] RIP: 0023:0xf7fa7ca9 15:57:48 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xf000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 350.751041] Code: 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 0c 24 c3 8b 1c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 350.769996] RSP: 002b:00000000f5fa30cc EFLAGS: 00000296 ORIG_RAX: 0000000000000036 [ 350.777739] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000008108551b [ 350.785025] RDX: 0000000020002280 RSI: 0000000000000000 RDI: 0000000000000000 [ 350.792313] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 350.799601] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 350.806886] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 15:57:48 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0xfff, 0x400000) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x13, 0x5, 0xfffffffffffffffd, 0x2000000000000000, 0x0, r0}, 0x2c) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x8, 0x5, &(0x7f0000000000)=@framed={{}, [@map={0x18, 0x4, 0x1, 0x0, r1}]}, &(0x7f0000000140)='GPL\x00', 0x0, 0xf4, &(0x7f0000000280)=""/244}, 0x15) 15:57:48 executing program 4 (fault-call:1 fault-nth:1): r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x1) ioctl$KVM_GET_NESTED_STATE(r0, 0x8108551b, &(0x7f0000002280)={0x0, 0x0, 0x2080}) [ 350.874097] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port 15:57:48 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0xfffffffe, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1], 0x8000000}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:48 executing program 3: syz_emit_ethernet(0x62, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x8, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x5c}, @dev, {[@timestamp={0x8, 0x24, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000140)) 15:57:48 executing program 2: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x28, 0x13, 0x205, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKMODE={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) [ 351.061149] team0: Device bridge_slave_0 is up. Set it down before adding it as a team port [ 351.131378] ================================================================== [ 351.140731] BUG: KASAN: use-after-free in perf_trace_lock_acquire+0x66b/0x800 [ 351.140754] Read of size 8 at addr ffff8801c979c890 by task syz-executor4/18094 [ 351.155462] [ 351.157099] CPU: 0 PID: 18094 Comm: syz-executor4 Not tainted 4.19.0-rc3+ #142 [ 351.164468] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 351.173815] Call Trace: [ 351.173839] dump_stack+0x1c4/0x2b4 [ 351.173855] ? dump_stack_print_info.cold.2+0x52/0x52 [ 351.173871] ? printk+0xa7/0xcf [ 351.173888] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 351.173908] print_address_description.cold.8+0x9/0x1ff [ 351.173922] kasan_report.cold.9+0x242/0x309 [ 351.173937] ? perf_trace_lock_acquire+0x66b/0x800 [ 351.173956] __asan_report_load8_noabort+0x14/0x20 [ 351.212935] perf_trace_lock_acquire+0x66b/0x800 [ 351.217707] ? perf_trace_lock+0x7a0/0x7a0 [ 351.221960] ? perf_trace_lock+0x7a0/0x7a0 [ 351.226204] ? mark_held_locks+0x130/0x130 [ 351.230461] ? graph_lock+0x170/0x170 [ 351.234269] ? lock_acquire+0x1ed/0x520 [ 351.238252] ? graph_lock+0x170/0x170 [ 351.242067] lock_acquire+0x385/0x520 [ 351.245881] ? destroy_async_on_interface+0x155/0x560 [ 351.251077] ? lock_release+0x970/0x970 [ 351.255059] ? trace_hardirqs_off+0xb8/0x310 [ 351.259478] ? _raw_spin_unlock_irq+0x27/0x80 [ 351.263984] ? destroy_async_on_interface+0x155/0x560 [ 351.269180] ? trace_hardirqs_on+0x310/0x310 [ 351.273604] ? trace_hardirqs_on+0xbd/0x310 [ 351.277928] ? kasan_check_read+0x11/0x20 [ 351.282081] ? usb_hcd_flush_endpoint+0x370/0x5c0 [ 351.286934] _raw_spin_lock_irqsave+0x99/0xd0 [ 351.291434] ? destroy_async_on_interface+0x155/0x560 [ 351.296705] destroy_async_on_interface+0x155/0x560 [ 351.301745] ? destroy_async+0x470/0x470 [ 351.305817] ? usb_hcd_unlink_urb+0x2f0/0x2f0 [ 351.310315] ? lockdep_hardirqs_on+0x421/0x5c0 [ 351.314902] ? trace_hardirqs_on+0xbd/0x310 [ 351.319259] ? kasan_check_read+0x11/0x20 [ 351.323423] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 351.328892] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 351.334438] ? usb_disable_endpoint+0x1c6/0x200 [ 351.334467] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 351.344141] driver_disconnect+0xea/0x150 [ 351.344157] ? usb_autoresume_device+0x60/0x60 [ 351.344176] usb_unbind_interface+0x25a/0xbe0 [ 351.344195] ? __pm_runtime_idle+0xcc/0x150 [ 351.344210] ? lockdep_hardirqs_on+0x421/0x5c0 [ 351.344222] ? usb_autoresume_device+0x60/0x60 [ 351.344238] ? kasan_check_read+0x11/0x20 [ 351.344258] ? __pm_runtime_idle+0xcc/0x150 [ 351.379334] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 351.384795] ? kasan_check_write+0x14/0x20 [ 351.389036] ? do_raw_spin_lock+0xc1/0x200 [ 351.393281] ? _raw_spin_unlock_irqrestore+0x6d/0xd0 [ 351.398389] ? usb_autoresume_device+0x60/0x60 [ 351.402983] device_release_driver_internal+0x651/0x750 [ 351.408355] device_release_driver+0x19/0x20 [ 351.412771] usb_driver_release_interface+0x110/0x190 [ 351.417966] proc_disconnect_claim+0x297/0x440 [ 351.422559] ? proc_ioctl+0x7e0/0x7e0 [ 351.426381] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 351.431927] usbdev_do_ioctl+0x17e3/0x3b50 [ 351.436168] ? processcompl_compat+0x680/0x680 [ 351.440757] ? perf_trace_lock+0x7a0/0x7a0 [ 351.444994] ? graph_lock+0x170/0x170 [ 351.448811] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 351.454357] ? _kstrtoull+0x188/0x250 [ 351.458165] ? graph_lock+0x170/0x170 [ 351.461971] ? _parse_integer+0x180/0x180 [ 351.466122] ? graph_lock+0x170/0x170 [ 351.469925] ? lock_release+0x970/0x970 [ 351.473912] ? find_held_lock+0x36/0x1c0 [ 351.477981] ? __fget+0x4aa/0x740 [ 351.481437] ? lock_downgrade+0x900/0x900 [ 351.485599] ? check_preemption_disabled+0x48/0x200 [ 351.490627] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 351.496431] ? kasan_check_read+0x11/0x20 [ 351.500583] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 351.505856] ? rcu_bh_qs+0xc0/0xc0 [ 351.509405] ? __fget+0x4d1/0x740 [ 351.512864] ? ksys_dup3+0x680/0x680 [ 351.516587] ? kasan_check_write+0x14/0x20 [ 351.520832] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 351.525770] ? wait_for_completion+0x8a0/0x8a0 [ 351.530360] ? __lock_is_held+0xb5/0x140 [ 351.534423] ? __fget_light+0x2e9/0x430 [ 351.538402] ? fget_raw+0x20/0x20 [ 351.541850] ? __sb_end_write+0xd9/0x110 [ 351.545912] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 351.551475] ? fput+0x130/0x1a0 [ 351.554755] ? do_fast_syscall_32+0x150/0xfb2 [ 351.559249] ? do_fast_syscall_32+0x150/0xfb2 [ 351.563746] ? lockdep_hardirqs_on+0x421/0x5c0 [ 351.568324] ? usbdev_do_ioctl+0x3b50/0x3b50 [ 351.572992] usbdev_compat_ioctl+0x24/0x30 [ 351.577229] __ia32_compat_sys_ioctl+0x20e/0x630 [ 351.581989] do_fast_syscall_32+0x34d/0xfb2 [ 351.586325] ? do_int80_syscall_32+0x890/0x890 [ 351.590915] ? entry_SYSENTER_compat+0x68/0x7f [ 351.595503] ? trace_hardirqs_off_caller+0xbb/0x310 [ 351.600529] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 351.605368] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 351.610659] ? trace_hardirqs_on_caller+0x310/0x310 [ 351.615678] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 351.620690] ? prepare_exit_to_usermode+0x291/0x3b0 [ 351.625710] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 351.630561] entry_SYSENTER_compat+0x70/0x7f [ 351.634965] RIP: 0023:0xf7fa7ca9 [ 351.638332] Code: 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 0c 24 c3 8b 1c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 351.657226] RSP: 002b:00000000f5fa30cc EFLAGS: 00000296 ORIG_RAX: 0000000000000036 [ 351.664933] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000008108551b [ 351.672194] RDX: 0000000020002280 RSI: 0000000000000000 RDI: 0000000000000000 [ 351.679464] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 351.686732] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 351.693996] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 351.701266] [ 351.702886] Allocated by task 18068: [ 351.706598] save_stack+0x43/0xd0 [ 351.710050] kasan_kmalloc+0xc7/0xe0 [ 351.713759] kmem_cache_alloc_trace+0x152/0x750 [ 351.718427] usbdev_open+0xe4/0xa20 [ 351.722055] chrdev_open+0x25a/0x710 [ 351.725764] do_dentry_open+0x499/0x1250 [ 351.729816] vfs_open+0xa0/0xd0 [ 351.733092] path_openat+0x12bf/0x5160 [ 351.736971] do_filp_open+0x255/0x380 [ 351.741021] do_sys_open+0x568/0x700 [ 351.744738] __ia32_compat_sys_open+0x79/0xb0 [ 351.749230] do_fast_syscall_32+0x34d/0xfb2 [ 351.753548] entry_SYSENTER_compat+0x70/0x7f [ 351.757942] [ 351.759558] Freed by task 18066: [ 351.762920] save_stack+0x43/0xd0 [ 351.766365] __kasan_slab_free+0x102/0x150 [ 351.770590] kasan_slab_free+0xe/0x10 [ 351.775030] kfree+0xcf/0x230 [ 351.778137] usbdev_release+0x413/0x560 [ 351.782103] __fput+0x385/0xa30 [ 351.785376] ____fput+0x15/0x20 [ 351.788652] task_work_run+0x1e8/0x2a0 [ 351.792536] exit_to_usermode_loop+0x318/0x380 [ 351.797113] do_fast_syscall_32+0xcd5/0xfb2 [ 351.801433] entry_SYSENTER_compat+0x70/0x7f [ 351.805835] [ 351.807463] The buggy address belongs to the object at ffff8801c979c840 [ 351.807463] which belongs to the cache kmalloc-512 of size 512 [ 351.820123] The buggy address is located 80 bytes inside of [ 351.820123] 512-byte region [ffff8801c979c840, ffff8801c979ca40) [ 351.831903] The buggy address belongs to the page: [ 351.836833] page:ffffea000725e700 count:1 mapcount:0 mapping:ffff8801da800940 index:0x0 [ 351.844979] flags: 0x2fffc0000000100(slab) [ 351.849218] raw: 02fffc0000000100 ffffea0006fbe5c8 ffffea0007150388 ffff8801da800940 [ 351.857102] raw: 0000000000000000 ffff8801c979c0c0 0000000100000006 0000000000000000 [ 351.864976] page dumped because: kasan: bad access detected [ 351.870672] [ 351.872285] Memory state around the buggy address: [ 351.877208] ffff8801c979c780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 351.884566] ffff8801c979c800: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 351.891921] >ffff8801c979c880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 351.899271] ^ [ 351.903152] ffff8801c979c900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 351.910508] ffff8801c979c980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 351.917858] ================================================================== [ 351.925377] Disabling lock debugging due to kernel taint [ 351.930816] Kernel panic - not syncing: panic_on_warn set ... [ 351.930816] [ 351.938182] CPU: 0 PID: 18094 Comm: syz-executor4 Tainted: G B 4.19.0-rc3+ #142 [ 351.946922] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 351.956356] Call Trace: [ 351.958948] dump_stack+0x1c4/0x2b4 [ 351.962579] ? dump_stack_print_info.cold.2+0x52/0x52 [ 351.967783] ? lock_downgrade+0x900/0x900 [ 351.971937] panic+0x238/0x4e7 [ 351.975134] ? add_taint.cold.5+0x16/0x16 [ 351.979281] ? add_taint.cold.5+0x5/0x16 [ 351.983342] ? trace_hardirqs_off+0xaf/0x310 [ 351.987754] kasan_end_report+0x47/0x4f [ 351.991737] kasan_report.cold.9+0x76/0x309 [ 351.996066] ? perf_trace_lock_acquire+0x66b/0x800 [ 352.001003] __asan_report_load8_noabort+0x14/0x20 [ 352.005943] perf_trace_lock_acquire+0x66b/0x800 [ 352.010701] ? perf_trace_lock+0x7a0/0x7a0 [ 352.014942] ? perf_trace_lock+0x7a0/0x7a0 [ 352.019176] ? mark_held_locks+0x130/0x130 [ 352.023406] ? graph_lock+0x170/0x170 [ 352.027205] ? lock_acquire+0x1ed/0x520 [ 352.031173] ? graph_lock+0x170/0x170 [ 352.034975] lock_acquire+0x385/0x520 [ 352.038779] ? destroy_async_on_interface+0x155/0x560 [ 352.043971] ? lock_release+0x970/0x970 [ 352.047949] ? trace_hardirqs_off+0xb8/0x310 [ 352.052357] ? _raw_spin_unlock_irq+0x27/0x80 [ 352.056857] ? destroy_async_on_interface+0x155/0x560 [ 352.062046] ? trace_hardirqs_on+0x310/0x310 [ 352.066464] ? trace_hardirqs_on+0xbd/0x310 [ 352.070787] ? kasan_check_read+0x11/0x20 [ 352.074933] ? usb_hcd_flush_endpoint+0x370/0x5c0 [ 352.079778] _raw_spin_lock_irqsave+0x99/0xd0 [ 352.084277] ? destroy_async_on_interface+0x155/0x560 [ 352.089474] destroy_async_on_interface+0x155/0x560 [ 352.094497] ? destroy_async+0x470/0x470 [ 352.098556] ? usb_hcd_unlink_urb+0x2f0/0x2f0 [ 352.103052] ? lockdep_hardirqs_on+0x421/0x5c0 [ 352.107630] ? trace_hardirqs_on+0xbd/0x310 [ 352.111954] ? kasan_check_read+0x11/0x20 [ 352.116101] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 352.121549] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 352.127084] ? usb_disable_endpoint+0x1c6/0x200 [ 352.131750] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 352.136767] driver_disconnect+0xea/0x150 [ 352.140917] ? usb_autoresume_device+0x60/0x60 [ 352.145499] usb_unbind_interface+0x25a/0xbe0 [ 352.149996] ? __pm_runtime_idle+0xcc/0x150 [ 352.154321] ? lockdep_hardirqs_on+0x421/0x5c0 [ 352.158904] ? usb_autoresume_device+0x60/0x60 [ 352.163484] ? kasan_check_read+0x11/0x20 [ 352.167635] ? __pm_runtime_idle+0xcc/0x150 [ 352.171959] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 352.177407] ? kasan_check_write+0x14/0x20 [ 352.181644] ? do_raw_spin_lock+0xc1/0x200 [ 352.185885] ? _raw_spin_unlock_irqrestore+0x6d/0xd0 [ 352.190989] ? usb_autoresume_device+0x60/0x60 [ 352.195570] device_release_driver_internal+0x651/0x750 [ 352.200940] device_release_driver+0x19/0x20 [ 352.205346] usb_driver_release_interface+0x110/0x190 [ 352.210536] proc_disconnect_claim+0x297/0x440 [ 352.215115] ? proc_ioctl+0x7e0/0x7e0 [ 352.218936] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 352.224498] usbdev_do_ioctl+0x17e3/0x3b50 [ 352.228757] ? processcompl_compat+0x680/0x680 [ 352.233354] ? perf_trace_lock+0x7a0/0x7a0 [ 352.237609] ? graph_lock+0x170/0x170 [ 352.241425] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 352.246968] ? _kstrtoull+0x188/0x250 [ 352.250766] ? graph_lock+0x170/0x170 [ 352.254560] ? _parse_integer+0x180/0x180 [ 352.258703] ? graph_lock+0x170/0x170 [ 352.262526] ? lock_release+0x970/0x970 [ 352.266505] ? find_held_lock+0x36/0x1c0 [ 352.270569] ? __fget+0x4aa/0x740 [ 352.274018] ? lock_downgrade+0x900/0x900 [ 352.278175] ? check_preemption_disabled+0x48/0x200 [ 352.283192] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 352.288992] ? kasan_check_read+0x11/0x20 [ 352.293138] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 352.298409] ? rcu_bh_qs+0xc0/0xc0 [ 352.301952] ? __fget+0x4d1/0x740 [ 352.305405] ? ksys_dup3+0x680/0x680 [ 352.309118] ? kasan_check_write+0x14/0x20 [ 352.313354] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 352.318295] ? wait_for_completion+0x8a0/0x8a0 [ 352.322878] ? __lock_is_held+0xb5/0x140 [ 352.326940] ? __fget_light+0x2e9/0x430 [ 352.330910] ? fget_raw+0x20/0x20 [ 352.334363] ? __sb_end_write+0xd9/0x110 [ 352.338423] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 352.343964] ? fput+0x130/0x1a0 [ 352.347245] ? do_fast_syscall_32+0x150/0xfb2 [ 352.351742] ? do_fast_syscall_32+0x150/0xfb2 [ 352.356235] ? lockdep_hardirqs_on+0x421/0x5c0 [ 352.360812] ? usbdev_do_ioctl+0x3b50/0x3b50 [ 352.365216] usbdev_compat_ioctl+0x24/0x30 [ 352.369465] __ia32_compat_sys_ioctl+0x20e/0x630 [ 352.374222] do_fast_syscall_32+0x34d/0xfb2 [ 352.378542] ? do_int80_syscall_32+0x890/0x890 [ 352.383122] ? entry_SYSENTER_compat+0x68/0x7f [ 352.387701] ? trace_hardirqs_off_caller+0xbb/0x310 [ 352.392724] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 352.397566] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 352.402406] ? trace_hardirqs_on_caller+0x310/0x310 [ 352.407422] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 352.412460] ? prepare_exit_to_usermode+0x291/0x3b0 [ 352.417482] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 352.422330] entry_SYSENTER_compat+0x70/0x7f [ 352.426741] RIP: 0023:0xf7fa7ca9 [ 352.430109] Code: 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 0c 24 c3 8b 1c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 352.449003] RSP: 002b:00000000f5fa30cc EFLAGS: 00000296 ORIG_RAX: 0000000000000036 [ 352.456713] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000008108551b [ 352.463982] RDX: 0000000020002280 RSI: 0000000000000000 RDI: 0000000000000000 [ 352.471245] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 352.478512] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 352.485772] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 352.493970] Kernel Offset: disabled [ 352.497591] Rebooting in 86400 seconds..