09c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, 0x0) 19:17:30 executing program 1: r0 = memfd_create(&(0x7f00000005c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x3) fcntl$addseals(r0, 0x409, 0x200000000000000c) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x2000, 0x0) ioctl$EVIOCGSND(r1, 0x8040451a, &(0x7f0000000040)=""/151) 19:17:30 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:30 executing program 1: r0 = memfd_create(&(0x7f0000000080)='nodev]lo$bdev)\x00', 0x3) fcntl$addseals(r0, 0x409, 0x5) 19:17:30 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:30 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0x7ba27d3a) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000000)={0x0, 0x3, 0x8, 0x9}) read(r2, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:30 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:30 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0), 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:30 executing program 1: memfd_create(&(0x7f00000005c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x3) 19:17:30 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0x7ba27d3a) read(r0, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:30 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:30 executing program 1: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000400)='nbd\x00') sendmsg$NBD_CMD_STATUS(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r1, 0x804, 0x70bd2c, 0x25dfdbfc, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x8}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x200008c0) r2 = memfd_create(&(0x7f0000000240)='\x00', 0x1) fcntl$addseals(r2, 0x409, 0x6) 19:17:30 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:30 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0), 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:30 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000380)='/selinux/avc/cache_stats\x00', 0x0, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x7ba27d3a) 19:17:31 executing program 1: r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/status\x00', 0x0, 0x0) r1 = getpgrp(0x0) fstat(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x5, &(0x7f0000000340)=[0x0, 0xee01, 0xee00, 0xffffffffffffffff, 0xffffffffffffffff]) sendmsg$unix(r0, &(0x7f00000003c0)={&(0x7f0000000100)=@abs={0x1, 0x0, 0x4e20}, 0x6e, &(0x7f0000000280)=[{&(0x7f0000000180)="04fdda6ea92b376134fbaa0cce6f0e97a4aca163e75fd329a006565cbc9c5503afa591cbe59b2906615de4b6f8276e178811f9144559a34121a3fe950e274403682dbac739aa6c88c1ceae80afdec4d34c84d4d3cfbb593cc3d3d3264835751ec26d4eca447eb24cc11534aa192444cf486cd711f7212cb789f336d9b772598d29ede11009790a91a80a5b41b00cc3bae883753c17238a7ee12e", 0x9a}, {&(0x7f0000000240)="66a8190e83a14ad40c5fbaaa8cb61e53483493", 0x13}], 0x2, &(0x7f0000000380)=[@cred={0x20, 0x1, 0x2, r1, r2, r3}], 0x20, 0x1}, 0x4810) r4 = memfd_create(&(0x7f00000005c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x3) fcntl$addseals(r4, 0x409, 0x8) 19:17:31 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x0) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:31 executing program 1: r0 = memfd_create(&(0x7f0000000000)='+\x8b\x8a\x16\x11O\xdd\xdf\xeb(F\x99\xdf\x9a\xd5>oJ\x02u\x9b\x94a\xac', 0x4) fallocate(r0, 0x8, 0x7fffffff, 0x1226) fcntl$addseals(r0, 0x409, 0x8) 19:17:31 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0), 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:31 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:31 executing program 1: r0 = memfd_create(&(0x7f00000005c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x3) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x400000, 0x0) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000040)={0xffff, 0x800}) fcntl$addseals(r0, 0x409, 0x8) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f00000000c0)={0x8, &(0x7f0000000080)=[{0x7, 0x9, 0x3, 0x5f56}, {0x4, 0x7f, 0x0, 0x1}, {0x7, 0x6, 0xc3, 0x4632}, {0x6, 0x9, 0x22, 0xfff}, {0x6, 0xe128, 0x9, 0x1ff}, {0x1, 0x2, 0xffff, 0xc92}, {0x216c567b, 0x2d, 0x4, 0x7}, {0x100000001, 0x3, 0x100000000, 0x7}]}, 0x10) ioctl$EXT4_IOC_MIGRATE(r0, 0x6609) 19:17:31 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x80001, 0x0) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0x7ba27d3a) read(r0, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:31 executing program 1: r0 = memfd_create(&(0x7f00000005c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x3) fcntl$addseals(r0, 0x409, 0x8) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x103000, 0x0) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000080)={0x6, &(0x7f0000000040)=[{}, {}, {}, {}, {}, {}]}) ioctl$FIBMAP(r1, 0x1, &(0x7f00000000c0)) 19:17:31 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:31 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0), 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:31 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x200200, 0x0) ioctl$GIO_FONTX(r0, 0x4b6b, &(0x7f0000000080)=""/201) memfd_create(&(0x7f0000000000)=':\\md5sumgcgroup/ppp0\x00', 0x2) r1 = memfd_create(&(0x7f00000005c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x3) fcntl$addseals(r1, 0x409, 0x8) 19:17:31 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) set_tid_address(&(0x7f0000000000)) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0x7ba27d3a) read(r2, &(0x7f0000000200)=""/250, 0xfffffffffffffde9) 19:17:31 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:31 executing program 1: r0 = memfd_create(&(0x7f00000005c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x3) fcntl$addseals(r0, 0x409, 0x8) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) write$uinput_user_dev(r1, &(0x7f0000000080)={'syz1\x00', {0x81, 0x9, 0x80000000, 0x10000}, 0x23, [0x2, 0x9cb5, 0x1, 0x0, 0x7, 0x4, 0x2, 0x2, 0x3, 0x3, 0x3, 0x0, 0x5, 0x1, 0x1, 0xfffffffffffffc01, 0xfffffffffffffff9, 0x3, 0x3, 0xfff, 0x8, 0xffff, 0x9, 0x1, 0x9c7c, 0x0, 0x7f, 0x3, 0xb0, 0x7, 0x10001, 0x7ff, 0xa66, 0x7fffffff, 0xfffffffffffffffd, 0x101, 0x7fff, 0x850, 0x5, 0x80000001, 0x35ff24cd, 0x7fffffff, 0x7fff, 0x0, 0x10000, 0x0, 0x1, 0x3ff, 0xc2, 0x8, 0x8001, 0x3, 0x5, 0x5, 0x2, 0xfffffffffffffffd, 0x6b83, 0x0, 0xfffffffffffffe00, 0x400, 0x3, 0x100000000, 0x7f, 0x7], [0x5, 0xfffffffffffffffd, 0x90d, 0x6, 0x3, 0x8, 0x8, 0x401, 0x4, 0xffffffffffff602b, 0x4, 0xfffffffffffffff7, 0x3, 0xfffffffffffffff8, 0x2, 0x1, 0x4, 0xfffffffffffffffa, 0x81, 0xadbd, 0x3ba583c0, 0x5, 0x1, 0x6, 0x0, 0x6, 0x0, 0xcc, 0x1, 0x1, 0x49d, 0x8, 0xffffffff, 0x1, 0x20000000000000, 0xb1e, 0x4, 0x6, 0x0, 0x7, 0x68, 0xf1d, 0x4, 0x9, 0x3cc8, 0x1, 0x1286, 0x40, 0x7, 0x5, 0x3, 0x20, 0x65004b8b, 0x4, 0x6, 0x8, 0x1, 0x10000, 0x86, 0xfffffffffffffffa, 0x2, 0xffffffffffff81fe, 0xae5, 0x4], [0x9, 0x2, 0x3ff, 0x4, 0xed, 0x958, 0x0, 0x5, 0x400, 0xffffffffffffff7f, 0x4, 0x1f, 0x6, 0xee, 0x3, 0x5, 0x10001, 0xfffffffffffffffb, 0x4, 0x3, 0x1, 0x0, 0xffffffffffff0000, 0x3901648b, 0x7, 0xfffffffffffffffd, 0x4, 0x71, 0xecc9, 0x359, 0x81, 0x7f, 0x2aec0000000, 0x2, 0xa264, 0x1, 0xffffffffffffffe3, 0x3, 0x0, 0x8a, 0x3, 0x200, 0x3, 0x5, 0x7fffffff, 0x5, 0xfff, 0x80000000000000, 0x80000000, 0x0, 0x6, 0x4, 0x800, 0x8e2, 0xff, 0x800, 0x5, 0x100000001, 0x4a1, 0xfffffffffffffff7, 0x3, 0xe708, 0x7f, 0xf2d6], [0x6, 0x9, 0x7, 0x8000, 0xb1d, 0xfd, 0x0, 0x81, 0x0, 0x1ff, 0x8, 0x2, 0x8, 0x6d7000, 0x0, 0x1, 0x6, 0x10000, 0xe3a, 0x0, 0x400, 0x100000000, 0x80000000, 0x81, 0x570, 0x2, 0xffffffffffff8001, 0x3ff, 0x7, 0x32e7, 0x4812ae70, 0xfffffffffffffff7, 0x9686, 0xfffffffffffffffb, 0x80000000, 0x8, 0x9, 0x7, 0x90000000000, 0x401, 0xf2ef, 0xb72, 0x1, 0x5, 0x2, 0x80000000, 0x3, 0xcca6, 0x8000, 0xb93, 0x0, 0x1, 0x7, 0xffffffff, 0x2, 0x7, 0x1, 0x8, 0x1, 0xfff, 0x8001, 0xc4da, 0x2, 0x6]}, 0x45c) r2 = open(&(0x7f0000000000)='./file0\x00', 0x1, 0x20) ioctl$TCXONC(r2, 0x540a, 0xfffffffffffffc01) fcntl$getown(r0, 0x9) 19:17:31 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:31 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x0) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:31 executing program 1: r0 = memfd_create(&(0x7f00000005c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x3) fcntl$addseals(r0, 0x409, 0x8) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r1, 0x0, 0x488, &(0x7f0000000040)={{0x16, @remote, 0x4e23, 0x1, 'lblcr\x00', 0x10, 0xfffffffffffffffb, 0x70}, {@multicast2, 0x4e24, 0x12003, 0xd14, 0x0, 0x2}}, 0x44) 19:17:31 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:31 executing program 1: r0 = memfd_create(&(0x7f0000000000)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x3) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000080)=0x3) fcntl$addseals(r0, 0x409, 0x8) 19:17:31 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:31 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:31 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$ION_IOC_HEAP_QUERY(0xffffffffffffffff, 0xc0184908, &(0x7f00000000c0)={0x34, 0x0, &(0x7f0000000080)}) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000140)='/dev/full\x00', 0x101000, 0x0) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x0, 0x772f, 0x5, 0x9, 0x0, 0x7}) r4 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000300)='SEG6\x00') sendmsg$SEG6_CMD_GET_TUNSRC(r2, &(0x7f0000000540)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000500)={&(0x7f0000000340)={0x40, r4, 0x1, 0x70bd2a, 0x25dfdbfd, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0xa7}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x4}, @SEG6_ATTR_DST={0x14, 0x1, @rand_addr="69cc50d8f43e6975321c653b2f648b37"}, @SEG6_ATTR_ALGID={0x8, 0x6, 0x9}]}, 0x40}, 0x1, 0x0, 0x0, 0xc0}, 0x20000000) lsetxattr$security_smack_entry(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='security.SMACK64EXEC\x00', &(0x7f00000004c0)='posix_acl_access$selinuxsystemvboxnet1mime_type^,-@\x00', 0x34, 0x2) sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40420010}, 0xc, &(0x7f00000003c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="8c51b7bb3542280d9a596748908fa36f814db59396e2333f1e97b13f56abf852aa6e5effab3399938079b8df0ff918769b49b5b8a5ecc2e3c80420a485027d96e38bfc99eb99795c0a4b758e4f0c0daedcf6ef46cbdfbf46", @ANYRES16=r4, @ANYBLOB="01002abd7000ffdbdf2501000000100004000800000000000000e9000000"], 0x24}, 0x1, 0x0, 0x0, 0x4001}, 0x4000) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCSCTTY(r3, 0x540e, 0x1) r7 = ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82) ioctl$LOOP_CTL_ADD(r1, 0x4c80, r7) write(r6, &(0x7f00000001c0), 0x7ba27d3a) read(r5, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:31 executing program 1: r0 = memfd_create(&(0x7f00000005c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x3) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x1013fc, 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0) ioctl$EVIOCGSW(r1, 0x8040451b, &(0x7f0000000600)=""/4096) fcntl$addseals(r0, 0x409, 0x8) 19:17:32 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) signalfd4(r2, &(0x7f0000000000), 0x8, 0x80000) ioctl$RTC_IRQP_READ(r2, 0x8008700b, &(0x7f0000000040)) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0x7ba27d3a) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:32 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:32 executing program 1: r0 = memfd_create(&(0x7f00000005c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x3) fcntl$setsig(r0, 0xa, 0x30) fcntl$addseals(r0, 0x409, 0x8) splice(r0, &(0x7f0000000080), r0, &(0x7f00000000c0)=0xf, 0x8, 0xe) creat(&(0x7f0000000100)='./file0\x00', 0x104) splice(r0, &(0x7f0000000000), r0, &(0x7f0000000040), 0x44f1, 0x4) 19:17:32 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:32 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x40080, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/254, 0xfe, 0x100, &(0x7f0000000180)={0x2, 0x4e22, @loopback}, 0x10) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x80000, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_aout(r1, &(0x7f0000000c00)={{0x1cf, 0x1080000000000000, 0x1, 0x31e, 0x2f6, 0x9, 0x3dc, 0x1}, "b684029e29d24ced9da664472865fa074b8277e2b48161fa3a9f010df333d0f9764c83beaa1a793dea8105d4f204bac4b13e192f1ec8e669392dfdab526c1e9f663ecd5ef0ef91af45068c9860a5aa738e87ef626bea227cc4680ffa1c04645d91ed7084a6f152f2adec47710b6c57b2fbe1265d1a1fe9b4aa1e52a435a5f2dfac29a68a39cfb670af4802275e7516b9d15019dc24466858c018287d806f5f7c9ffa5192084d8dce0c07d9df0cf050b001d5ccf172103dd2d8e7b2b2f45070a603debc4c94844094fe519bbf6b2b7da66a48", [[], [], [], [], [], [], [], [], []]}, 0x9f2) write(r3, &(0x7f00000001c0), 0x7ba27d3a) read(r2, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:32 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0), 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:32 executing program 1: r0 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000000)={0xffffffffffffffff, 0x100, 0x10}, 0xc) write$binfmt_aout(r0, &(0x7f0000000600)={{0x108, 0x8, 0x0, 0x3a7, 0x257, 0x1, 0x282, 0x5}, "06b26897a2876995d9c9a004720bfdcebeed79f5b390afc4157daa7c5cbd2b7e6b316c163020bdc8802519900de24f15f228150b40f2b599b915a0cb57451f646168d4663c49f09d38ab91552143a64b4bbc548919a335c1fc5ca77740d6d620d304e85389f7beea8b6dc2eaebf820433396b31f4537bc23ada01e86d565631e2b68ef1b6b435bb52d79c7f531ae32b35ac2981a44974447c047d130e51933c9f322c9", [[], [], [], [], [], [], []]}, 0x7c3) r1 = memfd_create(&(0x7f00000005c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x3) fcntl$addseals(r1, 0x409, 0x8) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/commit_pending_bools\x00', 0x1, 0x0) 19:17:32 executing program 1: r0 = memfd_create(&(0x7f00000005c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x3) fcntl$addseals(r0, 0x409, 0x8) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x84000) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000040), &(0x7f0000000080)=0x14) dup3(r1, r0, 0x80000) 19:17:32 executing program 1: r0 = memfd_create(&(0x7f00000005c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x3) fcntl$addseals(r0, 0x409, 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) 19:17:32 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:32 executing program 1: r0 = memfd_create(&(0x7f00000005c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x3) fcntl$addseals(r0, 0x409, 0x2) 19:17:32 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0), 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:33 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0x7ba27d3a) read(r2, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:33 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:33 executing program 1: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') sendmsg$IPVS_CMD_NEW_SERVICE(r0, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40040}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x90, r1, 0x400, 0x70bd28, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x100000001}, @IPVS_CMD_ATTR_DEST={0x58, 0x2, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@dev={0xac, 0x14, 0x14, 0x15}}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x4}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x100}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x7f}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x3f}, @IPVS_DEST_ATTR_FWD_METHOD={0x8}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffffffff7fff}]}, @IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x1}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'lc\x00'}]}]}, 0x90}, 0x1, 0x0, 0x0, 0x8004}, 0x8080) setxattr$security_ima(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.ima\x00', &(0x7f0000000080)=ANY=[@ANYBLOB="07010e000000000300258f32b3d73afd114f62188225211143dc6fe47f00d7336ce0b73405f28d1325fb4d2f17ff5c"], 0x2f, 0x0) r2 = memfd_create(&(0x7f00000005c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x3) fcntl$addseals(r2, 0x409, 0x80000007) 19:17:33 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:33 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x7ba27d3a) preadv(r0, &(0x7f0000000740)=[{&(0x7f0000000000)=""/161, 0xa1}, {&(0x7f00000000c0)=""/149, 0x95}, {&(0x7f0000000300)=""/72, 0x48}, {&(0x7f00000003c0)=""/122, 0x7a}, {&(0x7f0000000440)=""/140, 0x8c}, {&(0x7f0000000500)=""/230, 0xe6}, {&(0x7f0000000680)=""/142, 0x8e}], 0x7, 0x0) read(r1, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:33 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, 0x0, 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:33 executing program 1: openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) memfd_create(&(0x7f00000005c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x200000000000003) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xaa3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x401000000801, 0x0) r1 = openat$keychord(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) read(r0, &(0x7f0000000800)=""/231, 0xe7) pipe(&(0x7f0000000200)) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz1\x00', 0x1ff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000000), 0x1c) getpid() bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0x0, 0x0, &(0x7f0000000140)='syzkaller\x00'}, 0xffffffffffffffef) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair(0x0, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r4, 0x40086602, 0x400007) ioctl$EVIOCGSND(r1, 0x8040451a, &(0x7f0000000700)=""/209) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) fsetxattr$security_selinux(r5, &(0x7f0000000240)='security.selinux\x00', &(0x7f0000000280)='system_u:object_r:ping_exec_t:s0\x00', 0x21, 0x3) write$cgroup_subtree(r4, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r5, &(0x7f0000000000)=ANY=[], 0x20032600) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f00000004c0)={{{@in6=@ipv4={[], [], @initdev}, @in6=@initdev}}, {{@in6=@dev}, 0x0, @in6=@dev}}, 0x0) fstat(0xffffffffffffffff, 0x0) fsetxattr$trusted_overlay_redirect(r5, 0x0, 0x0, 0x0, 0x1) ioctl$EXT4_IOC_MIGRATE(r5, 0x6609) close(r0) syz_open_procfs(0x0, &(0x7f0000000100)='comm\x00') r6 = open(&(0x7f0000000400)='./bus\x00', 0x1141042, 0x0) ioctl$LOOP_SET_FD(r6, 0x4c00, r6) 19:17:33 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:33 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:33 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1014.371337] audit: type=1400 audit(1553627853.215:76): avc: denied { associate } for pid=4606 comm="syz-executor.1" name="syz1" scontext=unconfined_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1 19:17:33 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x0, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:33 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:33 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') sendmsg$IPVS_CMD_GET_CONFIG(r2, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000380)=ANY=[@ANYBLOB="0a6859f21b023d1a1c1322b7e5229a91424dee9a2b1230e5fa77f98f264567a4f7a52c48bc4b0000000000000000000000", @ANYRES16=r3, @ANYBLOB="04022cbd7000fbdbdf250d0000000800060003000000"], 0x1c}, 0x1, 0x0, 0x0, 0x20004040}, 0xeef329d11a2dded8) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f00000001c0), 0x7ba27d3a) setsockopt$packet_buf(r4, 0x107, 0x16, &(0x7f0000000300)="13b1b43f51770bde276c0f74b67dddcad7f15711fddee47182ed3f416a8b671d5169b737ce7ea4aa5c5a27608092ce779b3a83c6e2fe4298c4731902ce80c5c5c1faf8c673056dac711b8f11cd8a32acf1e0141f791e8a8071e8200c491f34024aead4d795ac649771f39c149ba1f040", 0x70) read(r4, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:33 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:33 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:33 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:34 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0x7ba27d3a) read(r0, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:34 executing program 1: r0 = memfd_create(&(0x7f00000005c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x3) fcntl$addseals(r0, 0x409, 0x8000000000000b) 19:17:34 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:34 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:34 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x4, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000000)="c67c296201ecbcfad1bf18b141b26b36f305", 0xffffffef) fadvise64(r2, 0x0, 0xec2, 0x5) read(r2, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:34 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xb, 0x1, &(0x7f0000000000)=@raw=[@call={0x85, 0x0, 0x0, 0x2}], &(0x7f0000000040)='syzkaller\x00', 0x3, 0x9a, &(0x7f0000000080)=""/154, 0x41000, 0x1, [], 0x0, 0x7}, 0x48) flock(r0, 0xb) r1 = memfd_create(&(0x7f00000005c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x2) fcntl$addseals(r1, 0x409, 0x8) 19:17:34 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:34 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:34 executing program 1: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x80, 0x101) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000080)={@loopback, 0x9, 0x0, 0x1, 0x80008, 0x7, 0x800}, 0x20) r1 = memfd_create(&(0x7f00000005c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x3) fcntl$addseals(r1, 0x409, 0x8) 19:17:34 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:34 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, 0xffffffffffffffff, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:34 executing program 1: r0 = memfd_create(&(0x7f00000005c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x3) fcntl$addseals(r0, 0x409, 0x8) lseek(r0, 0x0, 0x1) 19:17:34 executing program 1: r0 = memfd_create(&(0x7f00000005c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x3) syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x1) fcntl$addseals(r0, 0x409, 0x8) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000000000)={0x0, @speck128, 0x0, "c20b79da7f180cc1"}) 19:17:34 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:34 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:34 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, 0xffffffffffffffff, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:34 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'veth1_to_bridge\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000080)={@initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x23, r2}) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$inet(r3, &(0x7f00000000c0)={0x2, 0x4e22, @rand_addr=0x1ab}, 0x10) getsockopt$sock_timeval(r1, 0x1, 0x1a, &(0x7f0000000000), &(0x7f0000000040)=0xfdb3) fallocate(r0, 0x40, 0xffffffffffffff00, 0x1) write(r4, &(0x7f00000001c0), 0x7ba27d3a) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') sendmsg$IPVS_CMD_GET_DAEMON(r1, &(0x7f0000000400)={&(0x7f0000000140), 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x4c, r5, 0x8, 0x70bd28, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x7fffffff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000) 19:17:34 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0x7ba27d3a) read(r2, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:34 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:34 executing program 1: r0 = memfd_create(&(0x7f00000005c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x3) fcntl$addseals(r0, 0x409, 0x8) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x8) setsockopt$packet_fanout_data(r1, 0x107, 0x16, &(0x7f0000000140)={0x3, &(0x7f0000000100)=[{0x100000000, 0xffffffff7fffffff, 0x1, 0x5}, {0x100, 0x86ac, 0x9, 0x9}, {0x1ff, 0x5, 0x6cf, 0xff}]}, 0x10) ioctl$PPPIOCSPASS(r1, 0x40107447, &(0x7f00000000c0)={0x2, &(0x7f0000000080)=[{0xde, 0x2, 0x1, 0x923}, {0x9d2, 0x6, 0x1ff, 0x100000000}]}) r2 = gettid() fcntl$getownex(r0, 0x10, &(0x7f0000000200)={0x0, 0x0}) getresuid(&(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)=0x0) stat(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={0xffffffffffffffff, r1, 0x0, 0x1, &(0x7f00000003c0)='\x00'}, 0x30) stat(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000500)='./file0\x00', &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$netlink(r1, &(0x7f0000004a40)={&(0x7f0000000180)=@kern={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000001c0)=[{&(0x7f0000000600)={0x43a0, 0x3b, 0x0, 0x70bd2d, 0x25dfdbfd, "", [@nested={0x2100, 0x6, [@generic="0a4d31b1433fe60e6d1c0cb5554b539d0256138a3e0abc7abd23bee9d8b47698a068e0736b0086ab41f0908ff75c664c5199f0e1c82826ca30d1361cd453d44df274c156debb6300aa8e059eae951faf9de3e7f03170e318fd020f03b248f432b2286669572dffc3ab16040b067857a7d747ffb27f7cae37b5022badfef4aa7e88e2bb03d76d4851b377b67d4e1d6c33461ad8df1cd945759558cc69addc165d81239627a107d90c80f509e62dd085cde0800f847a5f1ca2e2ad43ec9d18e14f9d4394c646e0064b24aeac5d1922dfa18c80eca2c5b03c72de194dfbb265d04ae72698367d340161342cf17e57e04f6977565a6741264b876ccce7af0da3698df79d65d2e17fc6e6c09b163c9115dcb989750ee29f78c2237a462f26eb56b1425ef8a0ea804227c84e07526966955cfa4fd23278c5f8ea255e23187492242f53ebaf52549d15cbbf731160427852ceaf7ceb4fbd8074dfdc2a7552e7fb4ba67fba3bfc5db7e9b80e2ebf0d89dd326100f464b576da7be548b03c86454c315ea260b31f73a1822cf3a09be73659f5284156058d6a71d36f25b9d1f71e51aef36a11504b359d12a2502fb9d92d681d382e3cb979563a2882cf3fe19ee6fcad869c50843943d6e0a42baf6394810856dd786240d120ed110b9f585701cfb85602949a1fabed9d17de98261e924ea454c07425f861e8f7cc4980af7e0dfd70ec7780cb6f21a2d1b16b68fbfc45192dbd357554f02b83f4358ac0b4f12e18c09e6f4720b2db245b9b220edb9da2d95cd719c7f239d27e7c33fc5a2cc0a17eff593ea3f7f952713b11ca6ed3a3f49d633bfb2e1305ce33d38bb3104cad18090aa4dcd8fcad9d93fd67834df8372ba7324ee8a9d5cec63b6774647531eda9e63d54cb0269d4d720776126273841cb7da1b27db03c5194e79bc74d5cc4d6b7bb8a2d421bb5185c6c26d5d31ab3be6fa6b4715d914ef9407da6802a9f523fbc8c765d50eb57a322d08439eb2ee544eda55f53555de44f36b9c08417592ddb109276b3d4665a1d44a98d3562be160fd54fed248949af72ffc8c7e38c74f1f388402bbbb14297bb1f02efd0d9c976b9643bcef6b95800daf49b02ed544d163ee9e2310f0cd2b8e9b67264fb80ae6e604f483b9f40fcc70d54a1d4980d00282899543e2c2200ed8a6f4fb27e9530871d3ef85f4ec3b6f9526194978699373bbb530140cdc8f3cb78d7afb29a7174ac62eaaa1fe75d654e0b903c0bc08afd93275d17fee39047a276b8477e8f3cb27d84560f7c9a4e1ad49c4c9c186286854a51b55ea1d106695f8ea532fd6787c16e25192f0e58ddbe0605d5dde006b1fe8f06a66af25bf018cd4b56f7675f8f595f60c89abfd75e454f0c19fd4b6a829c6a6b8939d7bdf6b51103c2d83bec78b8f5151169879ef42b6be888b57cfd5a1c8f0e2e27fde08f9b99fba89cda6933bc2dca20f15d64eaedfc11115a2a729f18aa159f60e854920add3a1dcb7ba61903b1aac0f1380e876f128a09a3836f9bd8067030079e3e34da1c72fbf2b8b230341fba773ea8ffa047f84e73661cfbff45ae951baee4d7cf8e261bf4324503ef943481d580bf75421de3f6fccce43c5a2565da7baa488f2e7e182a2fecd72dce659b3500b9ee17ab838074f4357b7aea68721e035668ba3e4614270e88aee3d15a283eee18999dff196e2ec278bdb078d36f872f24d4eb31da6ca399d3446353aa35bbadd8b8da04c6e69486be6bcbd5c146084706ee8ad9c819272d915e7291bbdd36e82beb546d3307a5ea5ea089493d8fadd09c97cab9aa43c854ae8b50170edbffb4e2995b71dd95d9794f1d050986fbea57964eae4f41901fe1959416a1855d98baffb43db2765914f4dd50930046dec23d36a50d74e28c563397d9e62db1e8dcc01d2c2887e34d1b3bc3d645262128a7faa3f95941380218506337f5c476fe13d0e9a59e30d0681bb6f71f995105d31d630690cb48fb069a6961c864ebc986b522b74a888cf58c6ccb0484e52ef68e348a3fe61118980eefc4a6b410aa7185b11762a42b71389875bca50e471b0c167b402fe56290ca9246dd74132f24243659314f0b315180e5fcdfa493cf60e7d293d2acbc4921a73c9edb044da87e52459d17c4a13da5ae6466c446f3e5f7db0d92948afcf2becdc2acd7e7c5274ab762a8dddff47489c0b019a534b43c4ea714816aa63d89733f28ecd1e0aeac5f68e7c484166eadf39f4daa1c2d0016b30bf0e6d191bcaaf3c3791ced2fcac84cf55bf02cc5d59939e0ca150cb0943402bdc01603befdbbc420dff5b8152d090254ec48985807e3473e4a14727bd6d70e6f8b9e74b93e37a80d0b86e6329d389d02b0930f9c15173b5a860f3eedd0643df139b6bdc1f57f63a868885f84b6b5194eb10573323e875810e68156e0a2b3555907a160fc3974ba97538da701a8fddc4f8eebfcffa5287f74c18e13c2b16d548afeb2047ade39b069aa15e9b7d26134fc1cd34dc1c367cca11b30d4577f3710f17149f3807fdf83b9d673ee7229c43f201afcab2e27fc0b2cfb842595983efbba3e92cdb1ca264ef56349ecea9708e78462c2592281424f5ad3afaa3dac846da6712ecb73a148750dc67a3b7ba091d29042d912bde62adefa69647b8eb91305dca22c8cc38f8f447ca91ec49701ac43ddbd75f89d1a6f9959fa5845d61b3690fe3e44dfe7075724d85d2baa0792775c6b08459d28f6f0ae0222ff6336c69d7f7bc4edcab4a98af9c8b1b9a717d3fe1525cef9d3e9ea7c63b0c4a34c35cadcd741f6aca86d8c80c05b2937e48ed66729546cd78a059a6a4422b20a84c69bf903b06cf1f28ccbed24860e2bf0dc279c37da4021694e026a2f3dd676196d9c0058c330a71233d2db00da91e0d7886729a996a288ac98acf0181c2e9218fdba44d1559c5a2b9190b8c69d73d9f939c4bd6231136fe1d8e31ba634f243ed7fb9f8efba17346e166ca3e98bf9afb4f8e52ad6b34389f26cb047f7da748ac02f60976cdf23d7640eafa5f8a0a7404c41b604ca68847f0c8137184ff4964e5278d44f53585f271c36268eafc245cb38f4827a9f77c2c25b4e94fbf772827959aa1d45834d52d9d75ad3eab4281f0f2f2efe1293db6bf0b2a04ee26bc4ddbd6a3c4bd6bcd63cd2b8d1a5ae9d42a57cb8793fcc31c48a8f05b051d4be0a6f9cb3ba65e5d7b4f2e090c93c43774fa8983c22ff38fcb3447c8d08a40648aa964c18c040658e7091fde35ece651397c535fad023b64f09c8a4da51ba2bece75ce8c07a3bbd83b0370284e60d66876ca9d694c1fb97945f41985ad1ba102c882c869caaa6184861e317eac0129384504adbfac0e1eef40c8d64f6327d394505bccd063330f51b48fd3709724c3400cd4d63fdeaf4a0b886dccf058b0bbbd1f324cdd5e57fb1be09fb5231d6a7850eb33d8339ea80bbd3b51ab84a9d7976e88271f009e478f02010a68d36fd960a08beedbef5f93bf0d6c5276497be84b1e41d8c9a9de84104ee3508f8b3422f925f14e2a1546be88eb4794b346fd2413f08989aeb52d4b0cfca6f086a760c0876ac1b361aa34532c250dffa8f0987baea459a4f0cce02bf7fb4c1a10e3037929ecef9643d64ebbf568b5c6a64e7cddb3115d73a116bc5adfaf845b5711166d17b86161e407697e16411ef88c1071f50528939762e9c30bbfe470151332526bede963bb31c62c447ddf388834c66ec2a41d15ac6634996c139b125b3a097c80e7d14d7e594556d5dda8bbed0a9d0b66264502f606660b72fc6f654e107609643d25845cd1d069aa2e1e2d179dc2a14f24dba01f62b02f3e37075eaea89ceb6406202e13125e9ee0f4ea4649a98fae6448de47c48aeee5691a7cff99c8b7347637d518c5ed9db53ec0c6d73b51479eb5a7f86f563351a28bb3be613a0676b9560f0014e64d3dfd54e50478d3264b80b07ffe82e958fc4c18ab50fa3b9d2e9dd716e1365aa7e3acd15525a20b154ae7f1afd62acb7ce79b0c17b2cc72f22368c7b7973bb54f38bab91debe82d4bb22623a9085f5b2d2fbdc7cb81903d0198b4462c8a132d1b3519c68b8b18b7dde3bca2c07882c87ccdda229d54e848566ab34523ed99690c1346c4d10437ac98df152f3fa6470bfa60f902be08ac3c1558fdd1de9d0fa05f4275b4ec32537ed3bd91aa6705a85cb69c8adb2eb43c5e9639c3da8769e04ddf0ebe4e1d77c034fe0bc4cf08668bfae385919e42b97a29ba40a461a445a31df4698e2f6492eabc8a2177e023570765934bf5b05aa1568c5e6eb21716932c3789c209ae48ff001cbeb05e40c4972733e6db857c66f61ed1b68614e1510bdd5ed8b88ffb1607b370750906e8e568ca00048667cd1038862186596de117912444d0b3a613f76f477fc9ef577cc84110da7a7c83b7b5c4dc7ed4ac72ad8e7acbb0f56172d9ecd981492daa1452fa862f13fa0b6101b1d795399ae15ce68fb00ec69ecb79cf8b532b9e96d338766681614a8fb87e1674555f9ecdbf4c3ce7a1083b1363df0f53cd01384c874e02fa7224729a224e35996c4766b136297f93cab0ea12e2e0f8ba673c6125050c77f79d165682687ad1e93fd2fa3e7a8caca045d4e5304a6b6f370ea674b6c5a6dab6b74bb9740fec8a8ec9d10b329385a505a7b3e945fce613ce77c8f44f0fadd6e2b6a29ef7b90030a5a7ada8b9aa246470e2aa499285cc7a66bd3fb86154ea5dcf98c0683dbe11aa7815a18c27b98f4ebe0e2ea79dc9c52883e773e779250f15d976f757a6734f69c268995df67345568cdd275e0867d168cc2e97f2ba556cf2ac015424bd417a2e3ae7051e67cb712b3420d0c6f7a6dcb63753d2aa7482d30cccaa7b7bbe39c7917257c61db20f9af01d9246b0733a718bf26c829b40e3d2f535370c355ad13baa90f3fa02d100dd7a8d1d9f4fa7a3e8d9b0b214255a7dd8e9e816832da7fd157e5d92bf92cbe85a306581061279c93d5bd610ec7bd943a9cc52f751cf46294d1967e33abbddb4978567c657aafbf9c4d8bce248b4b8c44dfcbabe047a85c0d814d7fad66f3e12ea3540d30481ada6072da875dc9bb47e792ccb0cdd9dcf24140f33d0d6f9f915c69ea372b6c4d1cbdd763d62d23bad9fa9a2a5c573c1e3837a1fd9ea63c2462b3c25b905be8129a0219858d275581e54c409fda4111e398de4486edaf04e88df46bdfe89602cdd4d4c9035fe578a277eb466940e20e55d5f63fcfecd856903e263eaade0ff5c3f545dbef0c9c7800d097c63312e7cb13d06f22750dedb5747c381516000f7f196ddbb1874123d27bce553c7f0ac21994b08b59aa145ebaf06b75458a9f6ed21f921bca0c189215665f46eb0c1c6cb85dae7dfa1a135bfaa2b1580816d6b2275332538a0d6692b87432bb792079c48f1cd3a3f5e350448f9ead243e1b76b98275d66b9827c045bfb643a9ad1c2573986fa2877e06d8b601b06411b19729fe21dd82a835b0dda559dbfafe08d45ef2c3ad4be465c401e6e14df3344af5a59aeb9ced9a74887a2eeb2d1f3f22edc5b94a64a29d0d74ff68b2ef232b944ec97fda393f6084af59e9351a3632d0656cef1adeaeee7c4a5d77a8f33a6bd6274c2a5ceaf1287f7e462a4fe8e12f83d61a538a5df8ece20178a27ce03426ff930588c85290e6fce45f8d195bca4b62d62c425a54310fbf5ff893094f32e1097f8d173293027befcfe73f06021d9b4110325729b6bb0b33ef89796e35600f47c5308774ec05c73d20e33c0f08dfe0ac5c869908d466ecfc9a4d07bfc88109634bf96dbe", @typed={0x8, 0x37, @pid=r2}, @typed={0x8, 0x82, @u32=0x4}, @typed={0x4, 0x17}, @typed={0x8, 0x4f, @u32=0x1ff}, @typed={0xa0, 0x13, @binary="7034e88c326e92d2fff6d5ec4247a96ee7f335e021cd5bc2942f1d0ed425c4147894d1c923fad6b6f7441ba25ccc7a7f53c2bdc888c676a01d0790d93c369b86515278813282edd496337e8849952292261e25834eb19ba38a14310265245f12716f29cd23612c75c5dad5166b6130d56dea936475a64f362a4b6d2f0f2f28fa131e457035813a784b49629c6c0789414bdba83dd044295c45"}, @typed={0x8, 0xe, @ipv4=@dev={0xac, 0x14, 0x14, 0x18}}, @generic="445c273c4a0e98b18b41f5f6ac6b06b375b018743ebd20828e1dbe896e0e13026f95b40b5360bf8305abc1c7632e57c8261c113a69046920d1c428f3cb73e5e548b2fd92583b0f4125eef317ac92349a24d7fd61a5479cfc95f09e93cd49caf575263f7cc178782be093d0ee76b0576219b34196a839f597657609debaa3b67d76ad431a504bd27a880c884d21423c80df74b030306816a483c47f757cf95486881b014b533959ce26b638ca3bcd6a243630961ba04c10b06ef1bd9150ce7c6708c16d8671d8dcbd478dc0c38f5aaf4faac1b585c6d3c87eacd91f9b963a870dbe1da5457095ed6470ec119f9773be865d3009c09106f725b174ad325f73aa84130bdd9974e308e2af66ccba48e2744f2b2b580b9bd827f37cd7a4cc23eec65be5856f776cd2c76fb46f263e178640a604eb8484f29367c2a1a0edd2f9ba570d84325000c4e3739e81e10bed2453e8d2ea10f01e75954a1821059a4f9e469b090011d497afac07657e9f53e98c3a07d450d66541805413aea71d568f721f4458a94704b3ea62ab73d34c260f0b413deb7feef2232ff0bf686589e2685a6835c0f233b36514b9cb4ac9f61804b0559bd7cf218c3533e06cc760f8b62e9f2710b2cea4178951806dde0c3085edaf5ea2a12c1c3a01583afcd694fd8505df32b67cca2a1578428f5b8ff54cf6272c6f77bea8456ff8bdf2c76f524483441e20bd54a9f05627e51455a9c155ffc16462d8cfe4257d4dc242076a0f242ca78f5f4dd57f0098429fff4dce43b201ef3a52fef583e0998dbddd0748aa2dbb6fa0b3f348304636602c3064abebfee60cf321d577081b2e908cc65db26ba723659921ee2d2e124c3b2d0d46d65917fc46bba5fa11b918851355cf2f95823c28c2f8a03d766905e1b9a13fd8185a69e4babdc9e76b75ba826eb853837d38fc3ff282f027869d7d804a5f3e32e45658a18ffb8f025a98ef9558acb1b6603b6889e64d7a4a10fe0f9d4eaeab0b4c5a30e72cdef78a2a650f3bc0c34718d254150f3f9065dc194e6f378b4c2ab584e21c4ba6471cb296f17b5a46e05833df5374c1722180f6ffdaaa90c23116c0ed268b0fbe128845f3843f0bf773f6c5c39b7fe6508fe1c9e19051abee259f004ef7d0e8bb013faff79734855f16687ef9a7634d982ac15fbd1329250a22aa427835bccd52e35f3a51783906c76624561620983146809da5e882e6b5a27394a80c1838626c470d701958871ee8135401c3adfde41f358100df972890f2e51d3fe405a97a404838464161ed8ad44d08017ab9473bde7415d76b9ec5ba46512bf1045e43e963456ac212968e9bf5e0aa5654eaf1a83fd69698036b6c874405b31634008f521621544e9ae664501ea2c15ab36ab1c0594b235033716ac325226ebbeb1e7b251a81ce505b074193667b0c931a0dc585a60f7cdda5c9a4e06fffaba3fdd56c7872c7bc58c62166e0c4a39dde20e6dcbaaee6233a13989cc95d77e1d4d2f4216d95af3283f6fdcb5303292175944b7cd5c7eeb8bb7921acadc8ef72f773459d8a7908a18008038221e3fcea1a94bdb800eb72a0b3e341cf60ebdcbcce186b1f5a96a9586c8a0dff3378e57affb73045e0f2cb94e3ef1af1cabde860234575afed1e72347784bf30b54ecfed65ea11c0191bf33c807687974db705b1b4ed78a0542eff498de087cd56460caede5dac82a882843497f124e3c9c8032680af6ce63763e5d1a7511cf17fdc143449987129514ab65ecbb7a0c81df25e7bdab41c4e6b7e23338fc5edf3d87c78a6ecf3e75e6da70aa954eed9878cf3a4aef0ea73ae55803511d675955ffd8d20b60cdf655e53c5ed11cc57d5beb48e70aeea3951cd0999a6704da023d35c8ca48fb329e80361fefb8b4bd26635569f2edea558b197231de4a04eacf57cf28d2123514be70710abfafea15ab2944552fabcd8401fcc771373b79438224dc6d3e1a27f69975270ea777239fddbb8ee5817e5c9f6881800e1317a8c7a24a051e0266659caa8c24717e0d1f28aade53ad7f811659ba6de13fc7a2e8df8b08e5fb4db5bc8d585a9e6d4cca43110c63d6fcadbb5baf7950eeeef90f54df07943cbdc1d04ea2ead50066de4e5b03f79ade364f954194f42ec699a82fd9f2da52a9d6bfb60f593fc582cdf94fa9f2e8ba73a29a769aa4b36d1c2b311cdbcea7c747d6c9dfb02dadb1bee2c16cd1542e11ca3034136ea0c6eb775741a3bacb3bb26dd5750ca6154ea112755bcf6a3be0be6f87ffb5f7bd2a40d1de2cc4ce75313f99bd2acc2f9b31e363d3299c2461851d5ebf239c52026b8607ad76853c5c2c19358e8f0d8ddbe1dda7a5e36aeca2cd4ebaa3eb4b674738a04e71f1cfa6937c92ebb17798d7a15735de0ee9aecf4ae26d16940531eda9f68333c50b960daf50dcec836c213a62254a7ca859d2e11cec810793b70a97333f5e03f8f2d392f3e10f9b55545da6deb3c7500ba8474e468e24300b43c414a5fdd9b6e78a25c6a706f2efbb3515f3f2a105b075dd6027427c5f3e1a21daf4d6e3351872c2921da26fbe2ed47d886c656cddf5346e7a9bee0cd453d80931eab6ec1137fd3fdbe1f313361f9b8388bcf5c36bf022bd2e5f34c7cd8183bd32a7f7ea355904a884cbc90b2e3627025e752633011b4288c203ac0db9fec40819cac6c6173b672447037db774e630ba845a486850b2567e935aa9b817621c997db112f8c277321ce834eedff30784ece68df5d76eb02e3ab68cdcf6d1fcee9f61fe62bac967ac58fe998ea2a195f8a63a469c1a778df374f5abb8d895321c3f39a53c6eeccba3e3d3166341c8ee45bddf0130b8565cab70267360af6fe51cd3a0ed1f5043d57313510ee09083324271a960bf22225b34f4a94e61856a906f4c5b7fbe5092357828b63fb24b524a7bcfee585d317192653d15a31a0646bacc9fc937d5c65bccfe43b3599382499225b857d4c59bfc78163b8aefd98df17c5f30d51da11489f5a8428721399761943139bc9bd7cd6d0352445277a4738ec0d0adacf328934f2c4c6f6480bb735580b8a3c837788884f9fcd405ab219f81b52a4429352123dfa7f3fa395e965c15ece7294f930fc41b37c3017724259d4f7af73ad493a836a94cecf2f92bce0c908f27aacefd20462e9c91487d601e9bf160b985084cb2122214f478b141c7d20e23c129bd05971a0692af0ec075d3a20c6cd991152639d106d85e6b26b9fff39b216cb5ab4234552e52bf21e2abf15db71747745f43574265e766cb0248af4e61fe0c8076cd9508cd4a8f5b09d32c4352f60186671187ab357a9538c0099419a19c0f1a3697eb9d165775358209d7b7b254d5e9ccfdc2af42e4023bf231e6dc7dacb17524c7cea6d50fd30879c9ad88c58bb61c3e937f1cd5dfc5e45204e75292633e690a12600688839ab6fb529d9fc73d89ea8e7f2389c07239d8c5f8ce67af1d48a2f12ef88d24026522596e2653eda99a19c1477d452d1fe057cd303f43d3768d55b00ad6b951fbd5af069529780b6497317585c3477185c0e84bfb279382322b4def40a512c4788397c35af9df342abd4edad00e598148af9733af55d6b98159b01f1afda891350304f7f3a0c1f079c0ceb40e0cfdbcdabbbdbb614e92f3afcd71caeb6dcec0596c5c66bb2144708e2d3635b32c81c4612e52617d24e52198b3e08797d9ddf7d0eacbbc30a903fece6faff755e83f62997ac644729a6afa04c68f5a8c2fe50a87d8ab8a63b7517cecf90ce4e31860dc4d2889483c150fd3414ba4649bc4f0bf3b1cdb977c1b3e0d5ef30790efd8bbd376d75e109ed4d731fce5d1bf440b1001d6bdb4b89f86bfe40e4e1dc0a2437282cc44fc53830597e82ee356a5a904da487f5442df71b3ce14b4142a48d89e25e5ae6b3a3fc2188ef8c4085f78ee1e48317e69c6837d9aa948bc864473007484cac872bcf659b71fbc1b440cd1eaa41991544a26cb694ca541b0cc2e53c741a6e57e280c30b600415128248fbbd4442b9a5e13392dda0d4ff3bd24c5be7d0d9fe3c4d21dae2e8d2f6841a7ea4bcccd3324637feed8351f21520b29d916b178d0b6464c0175ac3434255b841af23bab169221bb5d7235c05182318915d2a1ce85dc6142daf429a2294f797d7fca89ebe5ab6ba8326c747f6805d4c7b2c5ec36fa6b4473ecd52b85bcca1c79399f8c7cff1348ac5967e856972c17e6b2df81f35df40412bff6af7c046c958372d59f49187255d4cec5f11bcb13ae3b21ea14b5eaba1e63b647c6d44621531d2e3cb8ef16b98055668cdd51efbc72ae86de9c67deca6b572fcf41e549b6916f87736b9d98872feadc2b1cbda4b9563505444f2fc12971ac1756faad101bdf067c293a80a392bb2d2e915a2e0ba5f8599a158f1bc5b15b366f24456d9f721efb0406639fd208675c9578980dc15a258082ba4a165e7bd40ab39e3e1bd8b2abbb48e4046a0a05b95b3405267e34bdf62a3818ff2967e14def66ceb0d8c3f14fb3440140709edf38bdb986156e22a76cbfa332f70ba056c9ce09af8169a100b9c54f5a9fca2edb5610201d8e2f848b39bc608f87cbef888e1ee0dc0243409bf297313eff66fdd5ccaf9d23adf0e8e165927855fdf02565aaef2d0adb00ef0c6f529fbdbf057515c6f9fb2262f4e1a5145aae0e1564b28d80de75f551a493dc92546ddae9bc69a578200fcf4601c95804af2029b6ee2054dc1c3e5f20b4a5c39cbcdabe492978408dc47b890ab8c1c430094f54b7506641fdf55ce0b9e926cfae47d27823d75d441b21c9ecceeeb64c08637e148ae85a9a8b2452ff2fa7b9ec9e22526d5e63a7a2b5fac61cdae36d897eda0f0035bb5f882db58bfa0567cf5cd285e60c6d1ac3b5f4770d40dc00dc71161571c11ed05453a1565bd81344d6645f470b60002a3013d6b8a64eceb2bbac2a92dc00d3607075175785dc51c254e00f44ae9c3a9e5e1143eb8126ac53d572250879e2fd75435f28a7a3c6d5c730626ed56cf241e39b810ddd5b917a3306c3d422188be4a970c999b3df26b82fcefe1e4dfa3a8b0477fb39da465e4be8d0abb34533ffde37b07db83826af3b4a6e5edb7784bf72df5086399ad23f6afbc8540ebe96ff7423e386a4441c425d50ea14e16e35f833de09e6a754723a429995a97e35266eeff291c89b4ae10bc208a557ab8fe6d9b2136f7a75575f6fbcd4611011a366a18d2f8d294ecd51c0c9faff3c8feb033980d94e1aa55c56e628111db7a67c9b652832cc1efc63ab42be6b82fb6c2a1bd550e0e8cbb046def3e5e49f0bf4d20155865e96041e8a46d45a976567676376e06add7639d05b6cbc5a86705b0a376dadc5928f9bf0aaba41ff604515256919ca639c548c1cd23dc924f87e9d120208540df24a655f178cdd0b2b43c089137ca8461384c6d9c9c16d563caaf8ba8edd71f66a9d061a2aa648a18c84c342e4842366cc1d8d1d555bc490143bc3f143dd82bf98350b6556a5bd405a0837a69e6c4604e949ba80af767f373ef5fe7f9f6c5b6cf66b8ac51d59d3ded666380dec00002b59a819f89b0a270d9b50a9f6dba99db7d2784b96b3b670145297fdccfc51bfdaf5601afdca565c898bcf3f35df3fca99f71b4c00024d00cf4ee0bc0f88f4cf3c8576e730b6406a2164b78b5eda3e96bdab7b63f00345feabafc13d3e473f6fb93df15bfee49721c7b820e4317673bc9bca65a3ff6c55622429d352d0e043dab8895884130dfb8642cbd16b2aa73a289ac7f005e278ba510e0b6ccde42d72088e3e06112df5565b9fb6d", @generic="5144018c6989c2e6f96232fbb1caa4d692b0810448bd0f19b41529c770ea9dbbcd781a8aa2b4624b11c219bd076aaa95e461f764b294"]}, @typed={0x8, 0x7, @ipv4=@local}, @typed={0xd8, 0x75, @binary="44c69c9f75fe4e195650b6b95bcbf82197d31dbde47dbc750521f4a35717bea3c218b9b2c7d1858a1e678f3217beca696bc63ebd5e3be8c046f0a0ca3bd63a0a09d7bd77398a3ddb290823c8f9a54f85ee135f7e4b1de5e022211c21272d6bc630b35b3f0ba2d25f0cb4f72f2c30cbfe2d0a4f8bc8f4667402940a5511cc6f4a0cf34b00485e9d50af056427d8331e189cf7c457c0d84a844e7be40a9f1d5b74d85467c9b098383a04cb17c9035ad17519fe57308671432249b64d9b0f3051e3ed1da558f2d8ef068f78b1bf0a9a01626e"}, @nested={0x115c, 0x29, [@generic="0b2e19c3402e5773b1dfd264828527a412a0a6d98bca1b24411b0b0885a659df34b3417a6efc6576064743c7c9d3fcd2c6b49fed79319ebb061ecfb0bc01b441d223172c50e015532aa6558e4a5ade3da59bd4fdb700f1e4ac4b213cdf88c26337b74144d3528b9e0bf2d691cb3d57943d2a352103009c73469f43ea2cfea561b66008cf64af136133e59e846ad2c48dfadd380b34eb4d37bc32268ccb471cf97556b0a8cdf3254c3b1ef61551a7fad2eecdbf62a700eff49fba125e50d4d6711cc63fdf102c43b81f1746be90b3828721eb9511", @generic="d3a4674f773b392a0183006ea45a8df453c36587021193296916913e95fb55586e1598332ffc54cfd401a8cf2f7072585bf79e313f37a7732301c844cb6db4d1e11f30df308b0d2a3884c86d841b62eba308227c1de7db0c13dba22a27b1c04167026fd105adc3352fce787f44c40ce11fc04edbdec97116de08430eb5e81d5830decc5ab8da5b1df8faad057f939c61e8495edf4fc8ef0ac268a99406e0c5f79b96661f0c77c8a04183a0fc7ae79f9f127195b9993ae3b8002cae81a0a2816cf8dff05ba3a65e761ca4b880fa24ed9d140842bc44f35a7933b740c01c6f0cb1838723df3c05f27135a828d8c93a6478297fdd963b66749dd0176b4b2df26faa8fd505f868dfacd4a9b48db2c5c5bdbc497576c75b2b336957324ffe9baea919bc4829da89971be93b3586dc4b884655a1cdb2e9e334617ca7081fc06c2635c9193342237fba1cb113405c3c1d20d47d8179586be4fca3d72e93553e8682739371154b45c6d435761b432d85174456193440f275617e5f823fc9cfdaed60747bebc8be56a3998845220c21064fe440900a0fb130dd3e02ff2f99a186904aaec0a204546765f622ce3e75aa240303463cfee3d92ee9df739a67f6238e76ab855ba5304145759bef248a2444dbd181b8d5979e357fa5fe859c1cb779b638fa15d2495f2a7f9cccb6beb1eaf985946efbabbc765eb4aa7a5d86af60de49dbcad7d8bec8c2c7c23a0bd55330203aafdc06d1dd75738a633ba439ce87ec98e6b113f4787c9c0392a3482cdeaee3f8cc8fd4f554db3e3e2c3091eed709f5e8834b783bf45bdf103ab70bd2996e47fed1986aede9307a00b3323da4d2fed66e9f9a5fa821e9c9d0a71d27a45b2e01fa981377c756d79c4e565afd9f8dad81c2816d9dc52ecd732272b64d3484e899fe4b60b8d0738afafd8d4a0dac46ea51ed7403b522b03aefe2bcea683a84f70626a2f33552c8c481714e400335a9e09fd1d5c345ad3f6db5dfdcac15a369df766852828da51bf40c1f0fe7b2cd2dce32f9c3efd9e8b363f9ed59011b7d97c9bdf849d45cfe1ba83f7a478bd779275b7f00655966964123966a2c721a9f0a505c58317b6ae94a53825c02a6f20c0202b1c1dd3149feb0ced01730c2b2c0de8707e7bdd44e27fdbb38e0f7ec1d7be41e6eff67d840587c78ba7b441ea2c69700e1bf23e8c3a1bad2f11b77ae54dbe905b975f04143f9c2ee29e2e06007e7595fb19c335c56a81d98b124fbda867ed7aa2c9da8412c340f80b226e5724338d41389cd4bc7c23f92e1b65657d332f53ca3a80625802ad203b5ae7ab8aafc20eca3276e0d4980379c08a5d3de5fc296ceda368da91686a7671409474684b71f79d666b7162cdc79ee32e3165d3c2f556c38ba63c8c7fd796ed94aafb9982cd4da4ed481de047fe4f76594d62b5b014a17394f4d42f895ff026f0fa4716a5a16eed17f8203ab96647a1a527f4aa00d82952eded204b7d60f1a8b99f8f8f1cb7d3046dd83429506e09de54d7615b65fce78583d40e2d2a69887283ad4adaeabcf65dea3036e6383fdcedb2d65f5a1a552267549bc89fac0826a7d99b4568284a80b09406951f612216f36788d1e8499d66e46f8974d4651cf25b99b43c84307652dbba3f82c7d37810f4ebfde5777601b42cafc0d19c303b79a71f1f00e62a5cc6384a27a9f8f6d13027eb562adf64ece1fc211c6096cf1a22165d84df105041dc5cfd4cea120dddd7e046260a1432344ccfb99e824b3f10b47615455ccab70b33d063605c48197700368d7d7fac64473bf2b3c498593262f1ee74751c1949685421d5ff241784a5dc483e15ee574a003f78ea355454859d5d22ffa2e2c604376610b963155915cf10326aba8dfaabff84b6340a1721c7dba4496d3a6773034f798355087153ed0c241c7a382608427d22ae5de085dd4fac421644559d81040b0a283ce7a37f3e40ad6ecd99c5b498e86aabdca1d9b9bf5c2ef3f4ea94fd145785d752db56c9c6e4e8a5d9a9230e5bfec839cba0ad16dd5b4f9caca03fdf93df71b238920f5dc65be898c8d689f633d8fd11df993bbe28930022c6195c2b4dda72ed05e45235f150e3ad28ad4277884dcc8f16d7d10ce55ed5d302a48d2e57cf85856c8e4b0e7f384ecfdb8ac28ffa0ad57e60c5b85ee539b26b1e29082f6e73017e799499206cbc238c4ba25b0832b646078ab0808c71fb172cecb27e39c9319da5d46b98222c24708b546586a5bb5b0af1b6f5ef8530acacb4ed664400c7f994720e51ea6f200751fd96dff02797b4b30e7829380aa3ed232506b14ecba9a16a4aa67e1b4f33974df73e390fae693d6de8055d2310d03fe966fe4d18e26c6bfcd88410db2a27c92a83db5645fafa0bdd09bb60f881334f677c5324740dbb525ca279f296e546aa48f2730c0a4a34c646d64df131ab65fcf3b2341e3eb230b499811874a8ace03f8677bb97f1a5b8a4bee2668ac8c742f3ac8d61552182eddb1976bea9afa474f643c1d0f81bf3200bec25563e1a8b39f8ef6deeec70ececb0431f960acebf3015619db138f86d1c406f329aea2b683a8ec281011ac2bb5a1f03434474c29e6a49db5d42e6d6b06e1601474466b6d742e09a95c0b1203db0ff2b6e52033e08fc40e32a226d02a84803fc483696ab2cc221f5c672a2f9398ffbd6990dac30bca08025613af51888cbe91a44800ad2a0ec90ba4d9a110f03d5cf4e174b2ab648eff07244118c47c4d1f12220e2ab4292f5cc1297be32d9594a638f22023cb4e58d575bd1a4793cc68aedf0aa830fcfe68188c08d58008d0e553eee73bdf1706ffc135bc14c09c2c79aab607632e22e67f90f238b62509515fd3e8c11bdcd448fac3b99862694638d71b614d5276bb07d0fb492f06200d7bfd2a1be14c7559be0d72291a83478e2a4c5d9c222a8c1c8e742404827a71d6436379f3d6526ed102cc92e3bfb2e53924af9169e2a2b1571a7ed402cee01d0052e8fe3ab6dd58f65260f81a0762093411a48866d8c341a621332aeac01533a8c611b597275ecdfc707e8f5ae3178cdbb3bffd5f361499e28b2a7c7ad0213b92ee1ca699efeb0182cfed55d1c1ea320c6ca6ed0c1051d3aafe6e58ca55faa559d0fce76633082cd0a629a47c9a967ae6a610dfd62074b4a3758c2b07c6292f334d677e538a718ae4f037dcf8ffec657bef63bb316f3d0e11250afd57a5a0e64ec3f339773e4871e1c563113930ed1a85b8f11ca483772b64e77cf03b7ecbaaa921edfde588ed7be40f72748a7060c7c5b0c7629780c15f90101dddad4d5c6632b13596f6aea97517ea916d8b7f3cfa8c31ceae67193ffefb4631075ab9d505fd68026028d5cd3cac9f6ae3111fde62dd3353a6c18f1abe01a9f1eeeef8f6291702dda9b960396f2c99238a43c6d4a4b9798b18a9c1d501847f186ab76bf5c3b79054b032937d61c2c92fc8324fff8fa699cf7cba0d35566ff7fdf6ff2eccfd35e87b98a4f13184b43ac27d8b6d7bcad0de503bacea9d72df9dc84901e3c5c60e7fa5ce4867fa38bf6e7e8e821b767ab7bf0cf8239b8a1eb5f2b94381d2a1fc56b84c589da621e872a024122298bd65629ce2065c8569fc9a1122243bb5141baf195f290ec5a64279bdbdf2ae55c55e7611d0cd078eb8e9794c28fe7d5ff16998aa04b649d260d9658fd15399c20df992ac5beb9d5addcc5b967b84a541a4464beb05b66f82f61346f50aeb9fbd221b3dd58364ae7a4b88437c9ab3131740ecddda5d6e880d04747d0e1b1b09713f845464607acbe3ed55fda1be270dbe38aae81cf27eeffb2fa7045011fc2a6a502ee86621be92d445d57b419d3297126c00e18f98093298662ba9d0ef18fe6237010fda71e2716733d7a5e764ad3da1a02491e293e8620bb899e25d2d232c1870a079cd7d05045d00ddc3eaeaf85fa4560968d465a5e80e9d0deea2488b056c04ae69fca65869ee7acce6e0f8ef671c3d16355e84493964b23aa3c4b59ebfd22ffac1bff8354983794ab806e8c4b9d784f9acdd90235779199ddab12921fd69c56c58fb66352587e071fe708c29f83aa85bbd85e5d22ae6cbbe91bea8b4b4925c2afe3c07aa39e7ae5afbc3e6456a6a67cc3c2bd269ec9cf53098b6f0242373df059ca53cf4ef4a6c94849bebc96866d8723589fa57287459043f8f0e49a749b8c4dcb7cb5a982efa2bee35576cb6ff6f4d96ebc749945f10f274e524ae5175754934343559984d5767d59bbfdd11f48c4f04ec832a42aad75f71c972a87311455a9e1dfa3da9380c3c19fbc8e58e22db2830ce7eaf9882bec2a6f3b31d475f33fda2385020b21e640c04ec9948b9d2693996e4954b499a722e06a95e845de3e70ef5869a3033d7d791d76b0db78284983e79678e419d44bc39b836946be02f523cb9b8d6b3bee297cf9093f4abf39f661c25a45403dc476f52122382aec1b69f0bf89f8b425893e366cfb3e3e469c8ae0b435d66166fe02a2717b8b6949b30c9dede0cf8d9f7a5866f7dc1b46d8415dc77b0a15c86c74f23d22356ee848b755f6a1e917598b20541b59bba14b38b4c8f03afe26d3adc8e414020f821f729d91bac22194f76c4dfe8546e0e9938c69262532491a3be679dc1d476f1b6c84f5078e0b364674e0e3000d5002ff07f67abbc2e76909be938d9e0108d2af8f34fde50c48f518d1084de573a0344264a30b460148d3b4283b8194a0ddcf40498aaf1d3781307c607b37c7218166b569b25fe0779f0896efd3beb71baef058f3acff224120cf76c929f9d217f23a32ff40f3738bb111f5dbfc15bf08672d81ef917f74dcf19cbfcbef1561356330a13eacbffcdd46a7ce9c5a60acd862a8552a2b699c36fcb3c93b09ae92be22d007c6f6c202975bc6e30505211426020a6e2b2d74981347316d6820da8c12242b07fe7bf34d11cf00464a07e7dc4d273446fc846e7768e40b78ca7218ae93c04073e8b6290a557d8f4833b12ba10810b5f33bdaba697fff961869209d331466f62ba1e2f27c2ae6aaebc8fc2683440640f7998c91f6f98e641ea34173204ce46e496aef2bf2ce7af569b217095d0cc2028f377c0a5fe9449c294dad10f8120a89cd2158c3640d765963209b18adce4e18814caad6b58a596eac6183548288ab5b8ea1d5cab1b54e08aa605155e5fc873d7c076544235dbf3613f10dd2568f5720b21d8cc8031e3b4ae16465963841a00928f71cdb30dc25a04ad1c9d7d9ca5f2383cd5264ed73cd7597e30f45622e319c26b5c9fbe5ce22d9221ee32eae1d2f31552d6513e66a7d8c719b2c97dfbd345c55f409d5e3fc9bc7c46bc3362e393865728d891f5f3b9eca7cefc884cb201f5ba9cd9bb2b6f8464d0ce7be198298d43bfcdb8d2871d48a055e74ee12ca5559c5ee746938e92e140df466e95041dd0fa78c305e459231f7b537cc7c2597325c767dcbf870d6c4f00fecd5f0159ea3fdbb960ba0a22f82225ed81fb7793e4f7115e6421660517f43ccde4413ab25fdd14d2077b75699acf3631d4fef11559b5b4aeab3afcad6faaa66d9b2be46d98630d9921f12bb457c21635e5f82a273345e977a4ccc99ff944eb7bb5cac3cc7c9a85562db56fd52cfd4bc902e9080e378cab81720bc84b61e43344eb1dce15d6468748b77b94d77a6d018b51e34a237053ab120f69cd9e0e7f72d5860b08ddd32fde58af2a406a32aa46a542edc701e80e19d9f9de725464bef6805768e5b32ee001722a08f9e5a02bf39520218c23f949342672a40254bc905f76d7f5f6a34ee8051c45a67a", @generic="e5a47fc5ec5ad691146a410aed5be764d607fb9e52ac96782c05f33e502d654444833ae01a11dbf59e0f760c60a121f184ac7f8acfa9d95359cc7d944929b381a2f85ca7a96ff2c4ec8e6ad09ae50280102166ec31f5e49f9a4b5c9efa28941f00428f0cc1b539b98c0011e2962948a085ab10b608ab47dce1bb8d30030a765fdb1e"]}, @generic="9fb05e239921db20c87bc2e811e137313098ed44969fcfb7e39f416fda4a017b2ede491d48bf0bbdc9b36dcf419c2f09b218e35fcceadbeafe82c22d891bdf6e8df8d3c16dca7ddd4d2c8daef3c2df6a63a7db47", @generic="2d4a913c1774b14bbe079748a26dcec9c756c8cebe1583530b6df6ed5e86fcc4e368fb95587829a172f27694ae645de304ba2e68ff2b61b327d0ed5de83d42d3ffe015d40ba50384ea05ad8b33c8deaf69c0b2ca1412fe1b78439f1eb56bc749937deac1466cfb61b775fe76b241131022db0af360e966f2abc63fed3daf934f2abe047dd48de92945a51bab07760be4ac6677951dcea29065abf41473edbb1b048e4b6e8d06a68849eca2593b46ddf4351afeb22cc060bf19b47cc5302b149644bb97b2f4bc10d34d8ae54c9cf0d09b7c268d46af0a062e6e1491ebe23f39eabf148bcaa3b43ac6563cf7025a0398b47ae3436e3ee353deabeb277d2aef233a530a4b7857b1ddcaeda2f0525cb961766b8e2ec58003927f61944d1f905ae963a141c4ca5a10f8cd767cc0a1ff6df0c962f1e76e6ade84327f462155ed5d8f9d4d3764740d411828b510de0636e11bb427649e0b55620de83819e5affd5ed1d8940aeba55f35338b3f728dd3452710ca9e500e49381e61f104065d0492f7e78e75ce5ef098e0af534c825754577eba81aa1122db85d02b3cd5db1e47b0fab45c1212aabb1957aebca140a19224e9f91cbd2680cf1a0d9176312240fc26b8da271de99ba1ab89680a2e0b7869539bfbaf7c473ba8d45aa942c9322a8098f88ecbc410458e883e16c8e3a8cd1eebf421cf1307b51075b36a43719e19d8bee8339bbef0431f8dc34aa87e5c494b174bca4402cfcc348939e80efb869034e8fc8918590bd09da0ca040dad3fde6b675065a62c55af930cf63f01808e5f206eea48dac8e5b415f886bdf3bf771ae2c3b7db6deb7ac41368d021838c5ceb265ce40249ffb9a0b67f06adccf0cf61881dcc27982e5dd9aabbe3883ff9355feb5a41ebf43299e566c261c0d4e47b9a0b69f0daeb48a3365d1cfa93d6233adf40919a51b961c0e62e8088541641836751108fa91e1cc4ddbfce187327ff405f56feec338d99a7e8c63b156f48eb3099f33d39c9fd0228ddfc8a127c14d06ef9b519e7eb266e81c51036be84eee7e4dd31f6a3dd3b313ca5635c2acf7c74d7bd410ba70f255e5f7643161c3cb42f13f8541e9bdc69b6bda370dfed82645cfb2179762ce20fff9a82c1f19a0c3699e1d32c25b998053fe75180a8a7f972223f2ac1aaa03a25bbb71f524846bc963e7790ba23079fc3be0b54f2f84b6568dee7f545d2e6f12e7736f21cc4459b0f267caf48dfbd5b6dd72d7e21b911860e603deff2e2062fc9daf32733bab3b1febbbad75e594a0b4ee51a07504446943f1a05d08769f88d2822ad18449f352348e702411622ad4f791e00cb3b908e718c2f263264afe2683e28086a3df402a3b2998c14a47e0fb6d1dda7f120e59d07744e49352cea24c73ecb601976dc3965c89628c25034d3689537915d4ae061fa59ca052c8e2cab00ef4ddcf8bebb0ae670bd156ae12b05c3cd4cde2e9151a8926dd770101e0df9c2fa53515e4ff948f7b170d565741572dc5f563b43561c9adcd569c4616b25b4845c158575dabfbf6fdc1bf05e15b5cb704d2d71c79406b3892d3558504ea357a35db4012ae2b543f4e4c427320c909c2af3fe436a7c55ad549695b7b1974469d6b579a8cb1fecbd1f334e3fa9564247ad5b1e8987332afab5328c1bda4649a224d3349a2f00d7013953b734e8933e446579a2e7c18114c1b9afa5d2289dfb24f64e32beb64b423e5a615c90ae4f31d77a979b02b325207c419de8f8786fe66a03e96bc30eb382a571ebefe9559f1cc51010e202be357070108803766854eb868dca551ebfded335773bdc32573c1ed5c91cb32a9bc6d62e32e6b11c6c69cd5e925d7534a56aa7c0f17d9e70634d57d6f6c523314ee961755cc81f698b7e5c00984ae01b4b7915a088c4b946f6580f02efb699bbe8d2048e3be3b4d83169bdc5f1cfaca3b4deb04267b9412dac6fea7fc1591a57710acf38a750dfe6a1a83973ab298e80045b1761e4ee7868e3d751dd6e159ccb2873c6e5304273780053f77d6d68123ddbd07ae691f4a91dd6fd4de865e2df898c284b3c6a183aad79ba793073dcaf950486c7b0d0df2c541b085b5692ce7cb1e0705dc84dbb9f4b83905660a0558ac2356dd9d27bfd57bf57d1b9f1b9e903731452fa16e58cf1c070be98aaee33bdfb465e6a93b9f78b448c8a013a00abca21594f6c45c2a7620f96071f8614f2251d6790c87ae1cb73c6c1eb798330700466548b07ae3440c6d49c4e721e15c1263ca72a22c63ef2f1e2babf52c496d0db3d662cda0ff953cae5d522030ff23d929179a4ddebfff8f81fb95c6e80933daddb34068643b03e2a524bba68ad7a14ab79a66b52c7e91826445ab61a15d20265d1d720f6f3374db3dad4098bd53a849a12a5e83235c24b32d18eb61e68ca9ad9dad1e1830314c64cfa6b7955f14619e40a6b426c40202e3f6db90a56a42371201a1259331b476696deec6071310c0b7647d0cc2e7cfb9bfa48a2c5d803bcbede11f660688e0407193206a074dec4ee843373eb53336a9dc0d954af03fe23911b7f7c5b1f23435fcab3e188aff789336a816c9b8ec7a61e38115fc8de991eaff4d843880d0a17c9c4eb35a7567d6c9b34121ad730799a24291b73b914822ef7c4e572189b334f41695a36a546df8eecee9a1c3962524bd6852222f4f8cc2ca5672e5850d30fd2b115658986bb01dd08715346dbc677c04eaf8ea0a3915e729e46f96208e1ae900981b1c3b6b7b25fb31eb04aecc07eb8f094a932e30b7b8bd33f83e4aa766e187724643b4b7c1037773d8eb88223ebbd56f4f96956f9164b617156143b7a14900014e115f37e02ceb2f2257629bb180abfcf7ab63d3ddf46a9d69fbb96b25fbf6f13fb9c9a42456ccffcbae17046f982ae25f0305389d9c0a477105cbf28be4ba44a3a94cedf76dbd3271f05430cf00370b3e5bb3dde41c505e44af1c964db83466abba2b5297eefa8722a461c5b88086f891bbdef990f67700f486514ee16058ce599da0b6402b5ecf20b43ddab552bda86f6e437e0468b580d48ea897f24faaee51c29417b0cbf51c3cfbe21cab4db4577d650020aeb71e26fc6de4e8afbb787234cdd12c1a62099daed2485ce20a181eb3b70157b4d833bf184dd25fcbad282d66acb35f3fdb81e65b828c19676661196ddc1aacb0f4de55372943fc5d32ae8a840b3d203742bf7da18c26702642cb6456f98300851043383c9466c1df266bd99a38341127763e1bb7b88eecb74aaf140a1b1bb020ddf46a9ce9b65745bc0cfa891698545cff3a5aee352c8ff48ec8b110345eb7203e8fbee3979395f53569a4f9f452d6eeb4c3c4cb5171f4660767d8f0d817ab9e53dcdba698aaeab5f9022a18fbc32cd5efdeba38233b94758b3c6653a48dd098794d06c6f666301efb4f58e687e942e6979f5da7ae47850264332bf44e407db99bcb4290758cc2be17e9f31ac7ea67f7787a5f5899e0fc72520e1a39605f195f09de57e4d05c0b81e620bdb21e1b6f5093971d60dbe3f78489057a4f95fc4021fa3204cbd09fbd168277b761f647caba917bf38994d5bb68622d97648e34431761271f13d20a316926dae6708264fe3680422e4ceb507ebd5e3fb67cb878fbd9e4aa365a026fe5ce4eccf567bed2dcb39851dd56250bf5032b2b5c812e7639b903064fbc31ecddc9049016c27f7c4ed40b5da21646234516a12261505dc820cb59422dc084bca7e05cf8a792ba7c4c025b53a879cd9d1a82e0eb512d1e3450b8e0275fbff415b7793fcfd00fa082854e45bbbf071b27254045f68db4aa55dd5f46e5d40cb444854d36caeed61fa0d86cb422fdf7023b354345007bbef9c18b6e6e796ee5a9d8c26ccb1067a7da26af44bdd90f0c22ab115e3f9e801c058c1fd816247bac0963d6472f67673cd3bdad0c17067f00bded3afacae9e52c7226f671d8b868617e7d8576e0e4525535ba5eb520fed5f15c2efc3b81458ead81ea29d66a3f5a7c1f3b2c1bd57ba6533017a8d75bcb05c8d62bc74c3f582ac1725b93d191fd98f6aa116937a1a5bf57ce4ebd7c7880b7cbe2a213109478e710558ff15f27339a467d17f27b828acc99946effa7096509e64f6173f29f7102c2be6a9d1a06c5e0823024d2d69fdb6467c572815fe33b0594ec840a4631f0e0146e57b2b3de049f469aa12c6ab9fae07207713482130bb1358eb8ba8ca51fbbb6fdcb3f3c498fc986a1fce13e556f29778216976b4d18b182213e5e4d9921740c35bacf1891b49ff56252ba0cad987507f54872a76763cc29e39e663a7a4b5bb58d517738d769a6e48d70ab52e4ce04bd16ea1e6efc381102427affd784fb1dc2b45f09589378d3a65d67b0d25c3ef79cb8f14abd6d8790366016cfa5214fcb4c4f703993196086d658833259b3f6ca21193d16254d85873ddc5589db65491a3d8c11661ea3979489c6141b39eb7af9798543b67191557075a6ebc550bb38f785029048d4514fcf0c46253fb2bf84e8b1959b1e357be41c159e35380df1ec5c92edff2b945632f73771ba5d1ee658b36f80ad3bce01801ae579dfc7cd9d1b4b3e4a384c9dc440cc35e226a907855ca2662339cd9a8fe2099723cc8fc219a68c47abe2df7782acd8b5a7d8a79e1d7931149ebb0914d440cbbb2c97a300032b4d1f6dc297b98d4b70806e68dbad0559217b5665be2b6bc550a92fb2c3e053607cfe7e92488ce85b1dbadb04d7baf7eca2f7f953a3b7319274f6517ec5f070ec5b0d28d8c950e1e923a99a465def0c988caf09fc8c50a9986134b3838e0d33a9133c480fbeeeedb5e6f5ab61dc7abfc79e4ff7dac6870d7988f0a8c25f9c7f6a187b63af1a20a0fbc19fb0c307aadc518c279cbb67949f570895381d716f1ada565b1d396ca02304dab627077ce9a3a1342ae19b7ba4151dfed9e984cae187dd7908ff720c52f1abc6980d7c5b5a4859b4dfad39ef4602ce371ba766193888882f50d0b053d460706449bc06931fad8e1e41ba3d32b2b29831c539b22ee98f0d8daf7c417ee7296397566c49025d0af3ad54909254bac54e70ff4918f580bcc1001f3695a207bb255c029610f1194f8cd7ff0505fd85a599dd3ef9395260ec6be8e8b2b87c357bd197e7591b7b6388f5f440459b7030c4be0307380080d83a684e19f0712553ca408cfeb56ed662cb38663a16566eab26fec829709b495175dd9a42aef13369ffe11fe65869a4bbdb7706d17cae6c87a8412231b6706838fa97addba7d64e8105262d51286a673555d50b6f98335eba35aa32b71bb0d2d222bdeeb03c47aa1f3bb997c4fe04ceb65c7146fe5cb5f39da872116d83d2cd06834feeb76ff61e3095c1da7d30d728c8cd6149c4fbfef5cfb87c95f28ee404850c0a10fc40e5d198e5a9dfa37f86c10542427d1e5ca80f80674459113634069f684621e79cdd20190b91746325e2207aed6f373349043021e9b4cc7fcf25d30acfdbc483e1e48d80227e4f851790c76fea1d7087a3bbdd4086378cb47efc1b8e9ed6155212ed550d8c353e717013ad86315bd3a47fbeac91292af9aca1794f39c34836d4cc5ee3570644a9a33e4856313e18c583a652b864fc64d761551e5a159826743faa45ff4e70dbeabc78146f74d18736a7c82436f819666ae0d4a6679aee7901437f57224c701cafee18e82b92a9b10dd69b02ceb788c4aa40875d914e1074ecaa9d76d6a4997a11d2309b7da9681f777b72d79abd979e57028ab24633a313cc56fe589f18d49332bcf9fbcda82630250287bc89f6a6e48"]}, 0x43a0}], 0x1, &(0x7f00000049c0)=[@cred={0x20, 0x1, 0x2, r3, r4, r5}, @rights={0x20, 0x1, 0x1, [r1, r1, r1]}, @cred={0x20, 0x1, 0x2, r6, r7, r8}, @rights={0x10}], 0x70}, 0x2004c000) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) 19:17:34 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, 0xffffffffffffffff, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:34 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:34 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, 0xffffffffffffffff, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:34 executing program 1: r0 = memfd_create(&(0x7f00000005c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x3) fcntl$addseals(r0, 0x409, 0x6) 19:17:34 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, 0xffffffffffffffff, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:34 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000300)={0x41, 0x6, 0x0, {0x2, 0x5, 0x18, 0x0, '+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac'}}, 0x41) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpu.stat\x00', 0x0, 0x0) time(&(0x7f0000000000)) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') sendmsg$TIPC_NL_NET_SET(r1, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10001}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB="f8000000", @ANYRES16=r2, @ANYBLOB="000125bd7000fedbdf250f0000004c0009000800010000000000080002000004000008000200a70000000800010006000000080001000800000008000200020000000800020000020000080001000200000008000100090000003c000200040004000800010001000000080001004000000004000400080002000200000008000100ffff0300080002005d0a00000400040004000400500007000c00030008000000000000000c0003004b07000000000000080002000400000008000100040000000c00040082050000000000000c000300fcffffffffffffff0c00040000000000000000000c0005000800010069620000"], 0xf8}, 0x1, 0x0, 0x0, 0x10}, 0x20000000) r3 = memfd_create(&(0x7f00000005c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x3) fcntl$addseals(r3, 0x409, 0x8) 19:17:34 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, 0x0, 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:34 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, 0xffffffffffffffff, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:35 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000040)={{{@in=@dev, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@empty}}, &(0x7f0000000140)=0xe8) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000180)={0x0, 0x0}, &(0x7f0000000300)=0xc) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000003c0)={{{@in=@remote, @in6=@ipv4={[], [], @broadcast}, 0x4e23, 0x0, 0x4e20, 0x0, 0x0, 0x80, 0xa0, 0x3a, r1, r2}, {0xbef3, 0xff, 0x9, 0x6, 0xea4, 0x5, 0x0, 0x6}, {0x7, 0x9, 0x3947}, 0x4, 0x6e6bb1, 0x1, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d2, 0xff}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x2, 0x0, 0x9, 0x2, 0x7fffffff, 0x81e4}}, 0xe8) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0x7ba27d3a) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:35 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, 0xffffffffffffffff, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:35 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, 0x0, 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:35 executing program 1: r0 = memfd_create(&(0x7f00000005c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x3) fcntl$addseals(r0, 0x409, 0x8) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x182) mmap$perf(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2, 0x10010, r1, 0x0) 19:17:35 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) pipe(&(0x7f0000000040)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0x7ba27d3a) read(r2, &(0x7f0000000200)=""/250, 0x29e4ba6b) keyctl$join(0x1, &(0x7f0000000000)={'syz', 0x3}) 19:17:35 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, 0xffffffffffffffff, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:35 executing program 1: r0 = memfd_create(&(0x7f00000005c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x3) fcntl$addseals(r0, 0x409, 0x8) 19:17:35 executing program 1: r0 = open(&(0x7f0000000000)='./file0\x00', 0x101000, 0x100) fsync(r0) r1 = memfd_create(&(0x7f00000005c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x3) fcntl$addseals(r1, 0x409, 0x8) 19:17:35 executing program 1: r0 = memfd_create(&(0x7f00000005c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x3) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x8000, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'veth0_to_team\x00', 0xc54b42a3cf0996}) fcntl$setsig(r1, 0xa, 0xf) r2 = fcntl$getown(r1, 0x9) ptrace$getenv(0x4201, r2, 0x2e2, &(0x7f0000000040)) fcntl$addseals(r0, 0x409, 0x8) 19:17:35 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, 0x0, 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:35 executing program 1: r0 = openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/create\x00', 0x2, 0x0) fcntl$addseals(r0, 0x409, 0x8) 19:17:35 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, 0x0, 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:35 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(r0, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x7ba27d3a) read(r1, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:35 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, 0xffffffffffffffff, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:35 executing program 1: r0 = memfd_create(&(0x7f0000000040)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x1) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1', "3bc45bb7309de82833533965777d658dc39997453e38e89866860e71af5ee1b0b7b4efb11463087f9d03dc7a8627b4aa99fd1cdfa6e0b1d0a77d7d700072be9cc564c75cec14ce3c6d2f14f5a73f03db27fc8ead4d67f60bafe22ac2d452639c1f0b92c2dbb77b24604396b1615ec0187b80512123"}, 0x79) fcntl$addseals(r0, 0x409, 0x8) 19:17:35 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, 0x0, 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:35 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:35 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0xffffffffffffffff, r0, 0x0) r2 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0x7ba27d3a) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x100, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) setsockopt$inet_tcp_TLS_RX(r2, 0x6, 0x2, &(0x7f0000000040), 0x4) ioctl$RNDADDENTROPY(r5, 0x40085203, &(0x7f0000001c40)=ANY=[@ANYBLOB="02000000001000003984c517a7ea030aef11b078eaeac8141c75a1afa93a8d5b41558098a4b3a1ef8521e8d1b7ef2c2c7a170319d616accf104c59f2d3790dbe742e7d9bd7ec6f2544836bbf541676786db8dc5ae2e32d632d78ec6fc4df2f36e88373758ddac77006ce35213e0f4dd820ad12c41b6daa9ba1713aaf0a3c0c3d6822aadf8da949675a71338d791974b85afccfac20ed9cb0c308042dc1716eac62d01fcf484d19afda5be18863bbd9b729f36afcf57934eb65f80dd715c9a6de28f78b347f1559c8d96efee0593f26c4b8e2649863db1fad1c4b1b00414eb23e32f6df79a5e400f4952a1d5b7c59b4553447dd8e0d587f38f62e75bd6c9b85850f249c4fe36cb42864314a391d159674267e237e031c96b9f531951bcd33bbfe436261c9b7d8b6ebda5af97e7d1b879e20172b9fbbc7575d36c270beafea055a58a1814e660e69973306b368216b6d9ccc9ac245b3d4ff2fa147955e583b8719dba1cce99be6db708b18e157d92432e86a62fb015f4680db809ce9333f318273e25fc8d7274af56a81eb07ed2af9e842820b74ace69d8a79ae055c7b3251082704bc459890be7357e13ec4e63392c5e023ae9f71ee4117b355af643dae0d48a2ed7efce2d4999b9bae1d34584d59b66fac5d65cbf839116159d42ad7e943dffaa0da70d029fe0f4b31c9267c837ae1839c7237c1edcada37cb6816d9564e19cc0776f948c4015e211e5cbf42d46afeac0257f530fe7ed74c0414fb8d0d34db7ddfe9a629b420c191f8679104bd7bf91fa601dc57bacfd629d16758ae8876f6a71a2e92b6a75883020c1030c9ac718710f4d905283dcd78a21bf91e5b5324755cad7d12ad2f7be91ba543f73e99e696c96f5b39709d3cd5609174e999470551acff6d7cd2170b159027da8fbdad4deff7a260faa0c3976f39eeedab5c03a07155fb5f65578f1301b7f19a75205a6288f0ab7731d273572f7926166003f6816be58e3673bbdf99ddb9258f5e6f7aba4bb0c5975d898c1e01f60ce2abae72c111116c7b0a86b894ead56a5e01ec4858ef41cac0aab81d43aee9a7135289385d310a76076e2c3a21b63f30d9402ca2fc2d42c492ab785e1dc9378f1c3d1881fa2fb68e67f0580c1e2cf49720153ddbc0730e73be624b0eb51556e348d8d058d1aaadc48f29e0b4c9383e53efc3d5083dcb2aeef7bc9f0e27907a3181cd9c6431f697359028e894f2f6ddd466323b71ea989cdad1fb16c9c635de4c3a5ec57254e4da2cd125f1495328b0ba8bf267b5cea372c42b0c37996f684c5298983fa8b3a8479824ae60af2d2fa340a256ccc7703c3ef0bda4192b8e43a2ff87f9cd5ce27c63917761ccb84ec8ba92086e39282869d5488a37d3025f745e560ec39ea0fc2e2d108d6e85d3818883e214cfd6a75b04941ce128f024430d98dbc6da343d5080f4fe10583b77909a90286bf9851cfe3e54b916795c6e52d40cee9516ee3aea9f1ac0c0757f11fab97855c4758a71386adb14f433e8921d8085c9c2f8fe80bbba13e8e48f8b4a1d0046200ac55b4a3954471ffb5116ab8f0104a66ac81a242209d3a1e84081a16c48afd6f1c4a10662def9ee2ac127676c3efbf2d0f340704d68788580fbaf368a572e46dd3f1b406b748bdb0828e0c1207cfa18123a7bdeab75bea056e1b48f1d72745c836144b02fc39d219d4cec2e28cf4b9d5ffdaaf03dcceabc026ad39514aae8e5f7c692b4f2acecbfcbe8ff088eae5a2e7ca1b53f7ad56843c45c4fdf18ef9b38e5cb71eb8ff3d18e0a2e321c43bb77708d70d27719b0fff38238b80425faff3350e73596c6412b6c2fe2cc93a60ac0a7886ff00687e3cc8b2dd258f64c0cfa9c4d0490a9869b64b11e4a019d12f0c65a0172e84b8349d6571f7beb7d7cf3eae4caae405670fd85d3939caccef807a7597293fdb87b44cb4f8d288c3762ce32dde6966a165164ce654c609e9f6aa4d8cc1309469c36196c61df83cd459361d61b070dcf00e35bdc37e7cb09654be13b761eae97edeb18381a05e9dda9f95ed0e9dbe842b8aad664b55df6f0dc2098a3f6291fc676a6c6f92d4a86e1de2405a4b1cf9b6f9489daa7bbb7193499cbf3f72344bc38e798cdd8bde4bc3253313f69e521e35684e3ec999450fbf6be47644234d124732494d78cf63c6bdd5f4ce7fc19c6593843b457a0bc979b634747c7fa872c1e43171329d2a2cefb9b1a5b609cc915c298196f5c2c56c200d4b76aaa62085feca58dd8b3abf220a41e832696d2da2ad819434f1766b77f0f9f2e8a14ceb1befeec91d665fb962cce143d69892f1353f7affbf6d0fde2c8ea97de0c6ebdc7f4d5d155b66b258fdacc729958e3fa9c419e7b7e06112e6194c815ebc5192a9913068e8abbf744c0c6731627659201453b79f8d1413338346c1b946cabfe053ab1f60c65c27d774cf5df975d25cf6e94bbcb262954a0b524ef71ee4e1d1ff874a5100bbcfd025f27b6674fbff1f939d56260fca45b23a9e1e6c47e52cf2b577c1f9cc201f9a18df076048b1331bcc0c59615d4a3e831f92a422899052f97855b16704a760f9e14a3276b3178f12fadf14dbfd236c3ffe89e8bcd042ac9b58f186acb0112eed8a0f0b312dfeca706e348d4d0d83481aa41b62052c1623e9d06604bfc4f32f34e0ae8ef3814c4298a471e99f395b2d201d12a78f862ba482a30b88344fd37dfc35b2bb420e0e3ea060a0bcc847e57f11a1c43d9dc6985891e3efc0e29e9ffc8dc694ddc804592deaffdf447545dff8741cad75d73410f2e0dec73d9393274150c82c55df853f63bdddcebd11c0c5dca90e3c3ad947e0201fd9c829e01675c43c10195a7bcb781aff43bff827510ef17d93947f3c0cc9ba02c705783fa4de8bd943eaecac46d77b0a014336462546cd75e57ebe666e1acabd4b3eae45c8c7b6ae15f43b12407be0bd44855f68505d350b75acbbc5c05fc6be853f1ae85a66b049cbccc5abd203569329ab0fcc14fe4fe886df0eca9d12750e93ab46d48f46c0c0da07e22feb20d4a3ab6cdb98440038a940ba284537f5b8b2411743ddd0ba8dca5a49f251413bd1be4f3457a1b5d6d940b1a1e2b89d84b8e4d0f69f87111560b9d0d3ce8f85f901b5cf968d4286d39172e93e95d7bafd0a6ac61bcf334e6346483d7f7a671b0ab985e213f6b8934294413ef4bb0f5d76064f9a5d0c1a272c2c8ef1fbd8f202dd6e5fc99dd201a806e6e7122955dbda87c9ad98d4e0611ffcbe65b9a00ba09e7322da272abd17bcc8e1bf5c9aaca5e311976b6dac52970c716ea4fab4dca7ec3067c1a686eb50b86e11c1f054eb59f7224dd0349ee65024202d6afdf11330c1bf6f5a4bdb551aa29028ead7da391d80ff061c0afb94cbfc348868c78e3f577bd02e411aed1ca42ebdc9e0538e2a6bc04e1a4cf95cd3d04fa50a29e38330db5cb708b39165e330f13cfa7c4432f6d2a3edc72abfd5e107c2e4c4634fbcd310a767f527196e43ad0a692014d532e8fa95a9d2d22bc4565235b618722178321713fd95beecbfaaf89e6b93636ad4fef092cf8d5c817a58369c013eca03ea36c91d8c1676e0471553ff964dde533f99af9a6b7f523f8a8070a19494ad8bffe15a34f862c98ced4a36310870db133f773fc18164019154be504f0e19b9ebb26a31d546cf652a1ace235cd91a7cd1359e24880c503189d07701dabdaa21db4ad0b6c2122191903cb6375f159dc0ff7d2d1ffa8bc2265fc41b09e93e796cd5b4767ff50c09075f3131ca12b9ba7dd775f49d62468d697fb932d56be55befd48e907ad7a0fb6ec248c5343d84a07fc6af58f12b13659de2ac4e4da7a176b64919eed8d60a80f0d5bfa1f5f612dd4b324e8770232c7698d25032c2f3db2a0a1cb762c41b6a5d8e4ef76caa527e5f593c49bd6a0cdcbfd6c6208d7bb31c25fdad5d36403c648ddc80e92c1e1d6551f07bf6a2d45dc660f77d8fce266960401ea221bf1f98ac214ef8bcdd074433177dec11c79c474f6338e54c2098997740ae4a8da6924a7b175625980d4192d35f58ae96b1c7a7eb9659b22624e54f89681c68ba379101f65c19df6bd21f08bd73bc5b3126bb3e9bbfca66709dd6341d7b5760fb1dcb932d65e9511cebc7c2caedc607825a69818c7766b3b1c83e3b815ea522b42dd0cdca0833f06b09fb437da75c44bfe897ad25813ffdb8a8e9545aefae60e9d02aa09a7db17947b6f0edd09c5e9072377fc7dc169bec7a8b9e2a8e7b94d961a60340416d8185ef046180cdbb7d883713230235a746eb22c7ac4f5c9842ec6d250a111580414cb9618eb8ad987a30a43fda2df39f3db261f0eef2d1d891bd5f075a3c52ed8a55b13cd88f997515518b1c44c97b8e4d035f0f12bd5cb538f62e38eb99ecfe4ff88044bef42cdaab83498e3961d7c798c07ddea942d19d5342e56fcf43ce5286a0d77a247b8d67bb4bf259d20c71589ba45fdc83b39d6affac3c9b6ba391554cb7b0b6dedea4e89e96e83aef5d072f073e0f6d2ad5ec84d98871b43fa040e1918171d5251755fe3fdab0d8b5dd2e0b8204776ce077ddaf82a72566aaa9ceb7116cb3eff7fef22bdf1b9df9daa672c0cd758441a02f574d620316f22c8bd0e365cd1e34ae57e4fc530ace0f0849ddbaed3ac8c46046ecbd900c28b1fac40d94799fa0570530ffdc5ef2456e502d76b362ed9b0719303f63e1941f7d05e4bee474fd5467f701c01d0ae034cf3a76b2ebbfda988420a3b9a381ccb45f37af16f9cd34700961811cb5e182a38845b849b3c47075fbf7db2a1a8808b989baadefb45881fc9bec0e94d20959e5b9bd95b4b5c0167f0de394cbac19dcfb11e27e2db05158816720b6cb1b571163d8e2bb16ca3a88d84940562f53232c4d8a855a645d44af4b410ffe253523603a395c1b46aaa3c7b66724be8f6266ea0241daac3937eaedd68675adeb89fab3ddd0953669992d920a8a14157a599cda39599cf81c5c11ea515c146b1d2d44f46d7073a90337a727955c702fb68a2f07389edcd24201bb4844b407edfe48f24fe4c05f20553d82223889bb5010ae3d38c2601eea9b383caaa48bf4e9cc8e0463cb9f44e1fb4ac0ef78f282857d54e67c86381f8bd434619eeefa14fe6f373bc8efd7616d465dd4e00c2c58ce196fa25ea7ada96b388b008de204b4a563a44b3c3893a7be4d2d66ba72eb8ebde7368f58613ff600833f1b8143479d8d19d0fda4f94fdb6dfc6ac3b06794148d6bf401755a5f62cfa966b2cacd874d7d30cad66cba86ec5d220d2dcb887808c0097d1a7dcd5b7b41dae2b2263abe6943d44e5c04c4ec3aca6a4a0308db26275f3984369ba640de48e958c90e18e0751518a69427138a11578c21f0efe6a5b6a89d20c49a94b9190cca73c62de664dfdfee7bfaedc40622b5352bd58d70e017b69f6a2dd766aa46023088ad8bffc9db329d1681bb68adc0fc44bb4c273e811b55e82b15d56117ef24274a6771d06fb47b9e71ed36c17f3a634f30f1abff43548aeaab6ef1bffd7547015d489a7851e7cd07cb102eab789b850b34e40955386ab94e786692b21abb1279ed5edae226b427aba6a8ec3319a41573fb47209badb1f420fee257c9af33b9c91531435d76a4fd9007bc837de738c6c5626797b8d38ff67524dc017a8f1a5e69f328b394d25dc28daf31d04dd3ca89357fae5e3017b97b36527c1c662d6da1eb11052e5ffc9a0031e4ab00d63f2917993f781c21352e0f9a731af16bb2d562677a47361356efe004b8677f3e6c7f800000000008796c22fe8bd9912e5d7c88bd3b9446f0f190d7a8434860c3eef209c3ee6b3d2f3aae4f2814da0b00ac83e"]) 19:17:35 executing program 1: pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84800) write$P9_RLOCK(r0, &(0x7f0000000040)={0x8, 0x35, 0x1, 0x3}, 0x8) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/enforce\x00', 0x20100, 0x0) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000340)={0x0, 0x0}) utimes(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000380)={{r2, r3/1000+30000}, {r4, r5/1000+10000}}) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') sendmsg$IPVS_CMD_GET_DAEMON(r1, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000200}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x74, r6, 0x100, 0x70bd28, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x62}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1b, 0x15}}]}, @IPVS_CMD_ATTR_DAEMON={0x30, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x9}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}]}, 0x74}, 0x1, 0x0, 0x0, 0x10}, 0x20000001) syz_genetlink_get_family_id$nbd(&(0x7f0000000080)='nbd\x00') openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) fcntl$addseals(0xffffffffffffffff, 0x409, 0x8) 19:17:35 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:35 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, 0x0, 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:35 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, 0xffffffffffffffff, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:35 executing program 1: r0 = memfd_create(&(0x7f00000005c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x3) fcntl$addseals(r0, 0x409, 0xc) 19:17:35 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:36 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0xffffffff}, 0x0, 0xfffffffffffffffe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0x7ba27d3a) read(r0, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:36 executing program 1: r0 = memfd_create(&(0x7f0000000000)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x10000000003) fcntl$addseals(r0, 0x409, 0x8) 19:17:36 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:36 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:36 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:36 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/cache_stats\x00', 0x0, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) read$FUSE(r2, &(0x7f0000000c00), 0x1000) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0x7ba27d3a) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:36 executing program 1: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x3c047860249ffb36, 0x0) write$P9_RAUTH(r0, &(0x7f0000000040)={0x14, 0x67, 0x1, {0x40, 0x1, 0x1}}, 0x14) r1 = memfd_create(&(0x7f00000005c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x3) fcntl$addseals(r1, 0x409, 0x8) 19:17:36 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:36 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:36 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:36 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:36 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:36 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) write$binfmt_misc(r0, &(0x7f0000000c00)={'syz0', "3d819c46029cde3e1046ab0c343df73d462766924f6caed52793f3433cec0292318fe884c1b7179fe1006e301e69742754dcd63de864df2a714f0d3c6e4b1438e74a90c419f3058a11d0e0b60268cdd8e97103d073302ea6e173b42e36bb8a95620ddb96abbff96726b9fd015f0d847029de9c3c0f8d63df2d692bd1d244ca814c9bf2e4c52a0169dbd73c1150a2bba5e5c8fcf088481c917f0c3ee7b3511fb14a31dcfda90d46cc33d7c7b12204903c5301dcdd59325306adfd2ac33842a7644016646f9c27fcc0327543ba3e064f9e5ae5646e1b354fe3c0f39b8ee936e9cae13ce9037d09715fa95ff320b12253702963c474eb41b08e5fe571140f66331144701ef01bff97966dd7dc9c68e22ad5b0d813b46e7445e66fab9d8269b574c671898a1c914757b4dd483aa8224db1c190383d87c0b2b931a7cad81bd2fba4746998c4f36f247f1034f0b473713aebf4a5342aac8505d8b703ff0aa390f520a6cfff6a45a23671f49417f2deb586b72263ad7cba6790a5bfcf184253dc4025c4adac6d996c907a8726371acb3a6ed9aa42d486ab52518b8108bdbbdf0aec39e6a6fea80b21285e4a49249e4f47980924ecde57a71f3af0bb7ae6ee1d9a021e6e6350f2e90714d2d0fa252ff6b25d64e88a28d3d4e0ba139e47939c5bb63b86336e412cb27bdfc4752f9a656c4e52cda10563de4da453fce11975ca3c47dd323590f7dd7a9266cd3d055d7412e9ad3b2b0093826198e19ff2ca04f870f88907cac2df202def442e9f9af0dd310569ba122a8f7d36a176ba4ab1728cb844ef4f041701cdd7ec274f7f7664e9deff7b8f8a275a788e754c726c5b52aaaa23a0662876417a2d496343e8feae0b3fe0873366ce3692b9b2500c9887885a2fcbb718e8b24c323d727e2f86c03e4961bc51677aa183ea56fd4bbbebd7337488174fa6c1f4d2999f9e57db9c52e873bd47d7c42257aacf1c3b4fcf3fbefd52d40ad22d6b32c875036618a2167477e74d2b1e73484dff8c02766bf4ff3925f7023b7cdfb0837c0d98ffe123ef7684a4edfd71e16cfc6b32b5fb977144826d8118be6e0418d3e261885aeb2030b8e127ec41d71a85376dd536ade66d7b3a2f21ac5591117c4165021f8895a2d1670ebe3776472861b0264d3b633f27ef92357ec668ee339b4f1393fb4012d664aaa4933dda975f7867db76b9189db5af65e879f944328cd3fa454a938e0ce3e04438ee138c4e7517008af6e9a28e4ab3939b3175f4544da4ef595224010905eae0c2307d7c7c78a821efd3f2f02bafd75099591b5d61c5d0136677597b7c5befdc8ca6e6c302434cf51f7f1ea5770fdf9c5c8b03b2677d9422c2ef7153ad446356b1db075bc1f49119ae83dc930bd8712fb7cbc38d51e320f4bb99f892f0f31b3753f13170142721850a285fe98a632bac3163aed93758886aa47654de59e2ba6820bcc9b1c792f1f72a8981c24ba79a16a6ffc2ef60467dd52a56dc4b7fb667a06a25d30aba799ca4153ae2d99c34ea6403697572fc7b96a3ddd9c81b28b45789f7a2cd19369039ff2e60374e3cf3f0da74e1da1b0ccdf0704456081fe6daba0cd9fb63a6805d8d667da7e2752dfeade43da8e69d931937f620b7e52dd02de4a471cd36dfaf6777346d8ff49abb54b65c6d7a756dcb8090aaeec7c01a3fab263c39775997edebec2b8cf4eca6eee9b7428736ca862a2bba8d704dc882e85f0d8da79b6c8be5ce4ccbb57ca1c25f46cbebb1e0a6be74aaa6dd4cecf55bc39299af78198814f5cc85a4de1297444ddcca4eacdc088017d51bf41ea9c7b7c527b5131fefaa869d5aaf323ac1b2a4ae99a1b8baf5c69bdf32c4b96d2eef9a65611b12fdf42ae162a8947d622ccd47407fef8d976c6050ea6bfd19b2ad39c4fc8baa6e09f067e754687701d692d55f8c6c37c40b10603b1d4e631b60b6bb236e6cacd1016122b23692045e457b03ef8d6115ea2e8650f4b7fc9ff2699c307717fe66bca3741e2ec5f5ca5e435c1b2455c0bf1a23383625124ab78bc768cf067120fe5befab540dcc44e86b20a8df5dd0ee100eb632bc8b23c0e632752082f989ce2eef309ac319fc412c448359ef56cc9cf3a9bf1d90c1d98abea51ed97daac749268d1c2f5c23371dcb96b03edc210b9be232099477e9dac5dfeb1b388d149f3db856f5929f0ac463cb3b733d4f3ec6a4c3129f23a21204327c7122ab145fe811f05293c1518890704c733d49c1fb73d790d3ddc1817cc5829c4f175bbfbd3a5bb7437ec9dd75770cf007411197c4282837dcd1b8ca9e3fdcd31b782b712f4247d45881d4c127ce0e458ea5e27907ca088353d1c45082f8b3672eb522c782a5f4027f0f02910a6e53a1b42c4c75ccac0262692618e71ba95c99a7380c7743d8ac4ab7bcf0516cb54c4ae5ecffb60cfa61fa733ccac761dabdb42dc129c7c6378bfbea091ad93de9b02763d95895aff737b26c971737563234374dfc6887c084b0406476f5fc3f2851be2c35127439ff7ea69408929c27a4c7c7ba5d71591bcd31d81caa622b64d5c6f16be008de7bfe56803f8cc019ca367ef13b883bbf379ed4326bae0bae88e150fd32edc36e73a5b4fda2323a80c532374e985f32a5858d0c8709ec66d676484a277b61ae9f0d9a05aa631f8649f44b93000fb108c85debde3c57cc7c3e67f9ef0f0ddd2acf1fc8e3ff8e4d4770a15a93c7b2bc957cde68e61b8047fca5b32a8c31ca5a8269070295829aec70537b766b6c53626610725856706c5a8e003c84205d6f3a0e6c04af107155c81c2c6eba1968ab9ca8232479a633fcd55f7cfdf3de1cfaa9c51854274c7529715a0f913988a390ff0ad0adae5df456e0b545fd4cfc937ba9178ddd8044cb649cad1a0f8adfdc86940519e559fed996405c9f696c8c32e7623dce290add408e4f67ee4f25bcf9678b620168492c46b0da50d9160b62c2749578928cd4917df2883ecc88129ff61b0c6b6e35bdcc421ad18e5eb7e2fdcdffd73b54b021703f919d644fb03c283642b3efc23f4b525ba0f6bf910e5716cf744d00478f02aef0db7b6e8f4299766131b9f18ab831b93593509ed00011a60605fc7e90efb6f9baf942c9786a36c7dc48251940a463b9d90063c9e5cb886672ae65fa2a399b90334224242d3f18583cd69aab3dae4b8468f22a8a43fa7c00a70d8d15afed2dfcfa04c026e175b15a0dd11c7047be4929cc852c02657de5db3ccfdc75d77caf11c71a6ec8d1ef59e5a4cb88205a668acafb8755ee19d05cd5c5c9854b1213475472156007be7a2621baf4112a0306b405c84aa928a4d7004c1fd3bf2112f99ffc98ddc812a60c4a42afbfdd1c39173c15f6f4e7857ef5d9d1cc2c2e80a56db463614aac6db6027ea9b72b70315721e2f98ce9f3c9c825772e94164b926ac096cb92e8601089c78c485258b00c38e56335199fe72af6709397a84ff427652f6d2f5b68ced06402375f3f6537a1031efc3d03a75f183fc1b55d423ef7c427daa90d1df987adbe315e897623b72e571617d7e8ffbe628c262f276519006acb06914b13b63a9a2b9d8d44b363a20af418d4497d410065d90c01e325675486784a54cbc3b8f57f7edbe8522f9f36ede82fd3207d22a96f04550fb755ded9f4240a76fb20c4a3815cd4eac4806171a8708bba7a504774dd05b159431b63b9297f2b53292f39a5b8b9de60a3dd1fdd90cfc157935279930e0ff308ddbe59d66bf9b95b077993a1029509d5b55860324766ff6b8dfaa1a74cd6238fb19119693e5a62ff2288db51e218eee2709520794cfab4eddc7b6d383a26952a4fbde7d042980c77e127a2ddb4b2091089b3b4ba635d23fcaf492cf62c884600055e17a18b52248f3bcea10bafc87ce9eca0f62dba03722d05ae13b819bb15472efdc323febd5ac408b3636e4ea5269c90581f0a8a22fcbfc7df63550a9b3d449349b0e133faaa118e42bf0a79d00fd4dd2c4a81952bdb032dcc2782db4a06425b009599602684bf0762a147d6ae1dad4b8df08a17a3708edfed4b4ee77bd9d491d20d7620969d87b47f106d5652b70c661438d401e8c8551fae5b3c0a369eb99d73b995b40d7ed21faec14264fd69d9aca9467931d18384578fce81bbd3f1de9a7eddab445aae53dda35aa965c6fd4449a5a2446d450e67c76d3104f5ba183a014355418c4699b186b9447fdf4670d7da0e9b040959d5226ed60f285baa8bdbdcb6e13560d111865dfaf69aad2e06efb831cf48f9ad341e1c25c26ad4d53faa7d03eb88987b9a3dbfee0e2442e1485e9a86add05ce4218fdea79b8d65be38bd45df4d4770ba902b1a2fad34b90dd29c84f98152e552f6e71535a2d74a3a866c171b230fa86fd5e9202653d4400ca98fb87fb7c3f0763e5ba8062104d4fcdd4413658d5b551d35bca19528e67a85081e88f574186b396be604f580764763549a31ce69be4c4b3c9419d8a4dbbae61ff0e83ca9a77ee3e09e5041573046ba0d202f8b823a9e3b477fa51b3350de8fbdb65efcf0861bcf1429a3251838ae171f405fad5fccc3989838970112eabdd31abb172121e5104e9d2d04ff4d528fd34f4e9633e406fdc3b5dd9c017812bd657f41333de8289c5f3d9f80ffa24270d0beb881d29a0da35bac56a6f776a482c2b7af409d7d38824c6876b92c27494ad70b971b8156f069685c03b78185503f6ecfc171fa9ab0a493b63f754726dabc000ed8fb9c9b0da40ae132b5b640519fc723720c0d49dd131b9dda9734df6c905654d78d7ca3b6814a3b470f0b756fa9fa996e9d3370187e52dcfc9b05eb3381b7c99c6838d6a812154afa29c400f946573832c67b4ffee9284e6a60405a7f25c1297af17dd50acd02a3e800f2892ddf636858ad1f1599de0fca266df16a1bcbb7644f886c72111db957c9a8b3936f8a65238654988160b48cedb7e6f33d1d205c8cb82fd1b7d5f38f21bcdbc542b150f8acfcf7dcac16d781480c6d6b8333e6ae431abf11e82c834bb21b42dba808096d15075d24160752b1c374c3d8fc6c5e9bfcb9f395df0a7e1cfeee30fdac078fbbafe5a5b785604a3e8bcadac6a9e1faca4aab785230fa81b61a143a6be1d409c3efc609cae494bad828fd5777201526df72a176f896e158ad585dc9a658224dd8b4ee5d3b4cff9ba3da19eeaa99da2de1b8de4dea7ae0d30e7df72c4939a44054544e96e98abcfa08fc6030cb9b4b33cdc34f4eea8af86dbe126f91b4159b8bce51e1f9a941c6800c5e4cef22f65d2abda87cbe3b7a6ab713cb6bbc95d7e4a0d4d6ec44fd84de4a89a05cbf282adbd3df005454bd56ceabf12007908acef7043f4d75f5d87836b9d42d71fe32f6886c5d18db877a174b521f01ee27a0bb61c3a364a116b09804fc987455405b14561f29ae75b4bdf0d9a0ebea5a75d6c2ba3f795714db147bef581c4902ee7d503bdadf0946188abd8323ff1c27cc52d966467a0b7de8607bcd59be569b13dcad52a5c77b7198a4d887f0672fcef5ce1ca2d7de8eb23ef330192ec123118af1efa3fa5970d070b32bb567f7a6919b74fad849fda329d8e89b1e748a4df23f5224f6a44e2c4fea32f72ec6dc3ab216711c3a12573fd05d97c79e140b99a9a37120a6f1e0a5de5d9c5fc211bc536d5764919f58c32b45af2e54f8bc930f6771a7c8589b6a713e251ba596f39583c920bf2170320b11c6d0a4bb40f6fa5c8147eb0af3b92dba3ef3cae246385dbc2e648860d6ecd4b6c6fb9c13f55a1c466edf92bb861927f2ed0d89c1b6be53611c09d4ca9ebc42af020d36"}, 0x1004) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x7ba27d3a) read(r1, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:36 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:36 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:36 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(0xffffffffffffffff, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:36 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:36 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) write$FUSE_OPEN(r2, &(0x7f0000000000)={0x20, 0xffffffffffffffda, 0x8, {0x0, 0x1}}, 0x20) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0x7ba27d3a) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:36 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:36 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:36 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:36 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x10, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:36 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:36 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:37 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000000), 0x0) read(r0, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:37 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000000180)='/I\xfe6o\xa0[\xd9\xc2\fun\xe5\xed\x04\xf0\x9d\x96\b\x00\x00\x00\b', 0x40000000000) fallocate(r1, 0x0, 0x2000424, 0x1) r2 = fcntl$dupfd(r1, 0x406, r1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETVERSION(r1, 0x40087602, &(0x7f00000000c0)=0x554) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0x8) pipe2$9p(&(0x7f0000000040), 0x800) 19:17:37 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x10, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:37 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) ioctl$BLKBSZGET(r1, 0x80081270, &(0x7f0000000100)) r2 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r2) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r4, &(0x7f00000001c0), 0x7ba27d3a) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) setsockopt$inet6_icmp_ICMP_FILTER(r4, 0x1, 0x1, &(0x7f0000000140)={0x6586}, 0x4) 19:17:37 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:37 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$PIO_FONTX(r2, 0x4b6c, &(0x7f00000003c0)="83547ef2c1e49b1b0ef7834c48ff53da200bcbd5b21b6f2cd89362db729ebc01f70d4725f742b445dae5aac04c6241423577be33bf2cc85f724ef34617a659a9fe49afd6de3253d0dd931e838ec188613d04e16f7bbea8fd4c2e6e12f850be90c57c212ccae2926728464d9c7f91fa7399c9abd2f0caaa20bdea4989eff84089542e3ca1131ef45a0695a9dec1305977ca56768085c3bef2fbfc5ec279337a920faeacd90fb7551059d798ef66528094d4101f59627b3060f02d044241d6a3f8615c700a2a2f9b7c") mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff}) write(r1, &(0x7f0000000300)="0600000000000000205e007da6f32fd439db88e2270ebdf270216b2898f5bd510f946944ee6d01684f1c6788d092fc546e972f19e01c3910cb055166042e29defa4fbe795181f3e364905cfae1c26f96d2f3634cab9be5a62e3af3de6fe144b71569f7a1f037b56f33ddbe295af83f78c92617a07d3418e28ef441be79dee9bdb73bc4667eeaa8b5ef1afbf2f22db8bbcae2bc316959587bf6a74d75000051405d4b94", 0xa3) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:37 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) fcntl$getownex(r1, 0x10, &(0x7f0000000040)={0x0, 0x0}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffff800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, r2, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:37 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x10, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:37 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) dup3(r0, r2, 0x80000) pipe(&(0x7f0000000040)={0xffffffffffffffff}) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x400454d1, &(0x7f0000000080)=r3) 19:17:37 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'nr0\x01\x00', 0xfffffffffffffffb}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x80000000000, 0x48, 0x4) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:37 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x10, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:37 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:37 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000080)=0x4ff3585b) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x7ba27d3a) read(r1, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:37 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x10, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:37 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:37 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fsetxattr$security_smack_transmute(r0, &(0x7f0000000000)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000100)='TRUE', 0x4, 0x1) r1 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000000140)=0x0) sched_getscheduler(r5) write(r4, &(0x7f00000001c0), 0x7ba27d3a) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:38 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000140)='/dev/zero\x00', 0x400, 0x0) write$cgroup_type(r2, &(0x7f0000000000)='threaded\x00', 0x9) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffff9c, 0x4c82) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:38 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r2, 0x0) poll(&(0x7f0000000000)=[{r0, 0x202}, {r0, 0x100}, {r1, 0x8}, {r0, 0x8082}, {r2, 0x400}, {r0}, {r1, 0x20}, {r1, 0x10}], 0x8, 0x7) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0x7ba27d3a) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:38 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:38 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) keyctl$join(0x1, &(0x7f0000000040)={'syz', 0x2}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f00000000c0)) 19:17:38 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x10, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:38 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x10001, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:38 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:38 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r4, &(0x7f00000001c0), 0x7ba27d3a) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:38 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40106614, &(0x7f0000000100)={0x0, @aes256}) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$FS_IOC_GETFSMAP(r1, 0xc0c0583b, &(0x7f00000003c0)={0x0, 0x0, 0x1, 0x0, [], [{0x19bc, 0x7fff800, 0x0, 0x3, 0xfff, 0xc51}, {0x265aaa45, 0x0, 0xfffffffffffffe01, 0x3, 0x6, 0x7fffffff}], [[]]}) write(r4, &(0x7f00000001c0), 0x7ba27d3a) ioctl$TIOCGSID(r4, 0x5429, &(0x7f00000000c0)) write$binfmt_script(r2, &(0x7f0000000000)={'#! ', './file0', [{}, {0x20, ':'}, {0x20, '/selinux/avc/cache_stats\x00'}, {}, {0x20, '/selinux/avc/cache_stats\x00'}, {}, {}, {0x20, '/selinux/avc/cache_stats\x00'}, {0x20, '/selinux/avc/cache_stats\x00'}], 0xa, "76f4f3c181584455f5a393a81b7c08e21dd58f"}, 0x8c) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:38 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x400454d1, &(0x7f0000000080)) 19:17:38 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f00000000c0)=0x1000400, 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:38 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:38 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r2, 0x0) read(r0, &(0x7f0000000000)=""/51, 0x33) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0x7ba27d3a) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:38 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vga_arbiter\x00', 0x4, 0x0) ioctl$RTC_WKALM_SET(r1, 0x4028700f, &(0x7f00000000c0)={0x1, 0x0, {0x2d, 0x7, 0x7, 0x3, 0x4, 0x7, 0x0, 0xa8}}) lstat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETGROUP(r1, 0x400454ce, r2) getsockopt$IP_VS_SO_GET_SERVICES(r1, 0x0, 0x482, &(0x7f00000001c0)=""/148, &(0x7f0000000040)=0x94) r3 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r3, 0x0, 0x2000424, 0x1) write(r3, &(0x7f00000009c0)='/', 0x1) ioctl$KDSETMODE(r1, 0x4b3a, 0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r3, r3, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r3, 0x0) prctl$PR_SET_CHILD_SUBREAPER(0x24, 0x1) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:38 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x400454d1, &(0x7f0000000080)) 19:17:38 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:38 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = dup(r0) syz_open_dev$rtc(&(0x7f00000000c0)='/dev/rtc#\x00', 0x3, 0x400000) ioctl$VT_RESIZEX(r2, 0x560a, &(0x7f0000000040)={0x4, 0x6, 0xbc, 0x27, 0x8, 0x8}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:38 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x400454d1, &(0x7f0000000080)) 19:17:38 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x400454d1, &(0x7f0000000080)) 19:17:39 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) setsockopt$IP_VS_SO_SET_EDIT(r2, 0x0, 0x483, &(0x7f0000000000)={0x2f, @local, 0x4e21, 0x0, 'sed\x00', 0x10, 0x1, 0x10}, 0x2c) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r4, &(0x7f00000001c0), 0x7ba27d3a) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:39 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) perf_event_open(0x0, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x7ba27d3a) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) read(r1, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:39 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fsetxattr$security_capability(r0, &(0x7f0000000040)='security.capability\x00', &(0x7f00000000c0)=@v1={0x1000000, [{0x6, 0x1ff}]}, 0xc, 0x1) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) r3 = dup2(r0, r2) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') sendmsg$IPVS_CMD_GET_INFO(r3, &(0x7f0000000300)={&(0x7f0000000140), 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0xcc, r4, 0x400, 0x70bd27, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x44, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @initdev={0xfe, 0x88, [], 0x0, 0x0}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e23}]}, @IPVS_CMD_ATTR_DAEMON={0x5c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @remote}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @initdev={0xac, 0x1e, 0x1, 0x0}}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @empty}]}]}, 0xcc}, 0x1, 0x0, 0x0, 0x24000840}, 0x20008880) write$UHID_DESTROY(r3, &(0x7f0000000340), 0x4) 19:17:39 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, 0x0) 19:17:39 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x400454d1, &(0x7f0000000080)) 19:17:39 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf67, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) r4 = getuid() sendmsg$nl_generic(r0, &(0x7f0000000500)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1500}, 0xc, &(0x7f0000000180)={&(0x7f0000000300)={0x1e0, 0x18, 0x700, 0x70bd29, 0x25dfdbfb, {}, [@nested={0x14, 0x3a, [@typed={0x8, 0x69, @fd=r2}, @typed={0x8, 0xc, @fd=r3}]}, @typed={0x8, 0x5a, @uid=r4}, @nested={0x8, 0x59, [@typed={0x4, 0x3c}]}, @nested={0x1a8, 0x55, [@generic="126a6fe7ba68601d03d80b983e3e365923ecc5287367607a59c3753e576078431904ea9ac1ad0e09ace862e7c74707dbe1ec185a413660e2dc9fee087707822152c53fcec2223da330f05929172936a20d04eb7a05d1ca377e686e33a11b0b6743f1f14fe41650acad750d5006e26a66fcbc1f0121351c60af574b226fe9bbee3382a9383c561ebc71d602b81c82a87e642c60174640a2a7bc62c4c8fe0749284850ce910815", @generic="3505fe432d86556592851dd78258d7598907085598f472a28fb9d5765584db946c7ec93e9129822cc68bf71f3c78a8adf3fdb0c3d763f981dff3bb9458dd4bd03b4dce530654d06da2dc012bb785efd5c875be4974e1d8b45046c2eda519114c087fe2a7a538cd4211593b16ec2a2704c1d65cb0fd5198eb4f6468bee1f2be8f59d6537d389484ebaf162b820710ae7d22981945243bd761e1e4bee8c4743eea664bec11168543b279504eb714ce9f2f436bda6d7650c4a6bc44d848707de2d2ad087a9b8b5d786377601eca19b218b532c124f6f096513d1527b269a2b64b438d9eb829b7155f17bae257d7c3a771547feafea133aa", @typed={0x8, 0x93, @ipv4=@multicast1}]}]}, 0x1e0}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) perf_event_open(&(0x7f0000000100)={0x5, 0x70, 0x4, 0x3f, 0x0, 0x8, 0x0, 0x176946ea00000, 0x8100, 0x8, 0xffff, 0x3, 0x1000, 0x2, 0x6, 0xab4, 0xfffffffffffffff9, 0x7fffffff, 0x7f, 0x200, 0x5, 0x0, 0x7, 0x5, 0x100, 0x1, 0x20, 0x0, 0x5, 0xfffffffffffffff9, 0xfff, 0x2ba724dd, 0x7fff, 0x5, 0x4000000, 0x8, 0x80, 0x80, 0x0, 0x8000000, 0x1, @perf_bp={&(0x7f0000000000), 0x8}, 0x4000, 0x1a12, 0x5, 0x4, 0x3, 0x2000000000000, 0xe5c}, 0x0, 0x2, r2, 0x2) write(0xffffffffffffffff, &(0x7f00000001c0), 0x7ba27df5) read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:39 executing program 0: r0 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000340)={0x0, 0x4, 0x10}, 0xc) fsetxattr$trusted_overlay_opaque(r0, &(0x7f0000000380)='trusted.overlay.opaque\x00', &(0x7f00000003c0)='y\x00', 0x2, 0x3) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$mice(&(0x7f0000000400)='/dev/input/mice\x00', 0x0, 0x40000) ioctl$SNDRV_TIMER_IOCTL_SELECT(r3, 0x40345410, &(0x7f0000000440)={{0xffffffffffffffff, 0x0, 0x20002000, 0x3, 0x401}}) r4 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r4, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r5, 0x40505412, &(0x7f0000000480)={0x6, 0x80000001, 0x3f, 0x0, 0xf}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, r5, 0x0, 0x1, &(0x7f0000000140)='\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000300)={r6, r5, 0x0, 0x8, &(0x7f0000000100)='vmnet1.\x00', r7}, 0x30) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff}) write(r5, &(0x7f0000000040), 0x0) read(r8, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:39 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x400454d1, &(0x7f0000000080)) 19:17:39 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) ioctl$SIOCSIFHWADDR(r0, 0x8924, &(0x7f0000000040)={'veth1_to_hsr\x00', @random="460a9af07ff8"}) pipe(&(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000c00)=[{&(0x7f0000000800)=@abs={0x0, 0x0, 0x4e24}, 0x6e, &(0x7f0000000980)=[{&(0x7f0000000880)="d26892dbb6867934171758ef3fff1108f6c0b2efcffde238081d43ce5803f159439140abadfea4c1684eb92a577aa9eb227fe84795724052ff472743ad4d5940cbf0f11fd0225d81ffe60dd4", 0x4c}, {&(0x7f0000000900)="5cc99d258a8e94cdd527ff3289a60f04103f35433195506c1940d6e05bd44fde6a95069db7a99371c0f7aac8aeadc97ad168933ab3989de0465ba94c265f7197e654b042c8f9c1b6fe2de8bfaf4a4c94d2de6b667f02d24947d8e7d75e779afe337e9eb889f36928cd60ca684c083a3bfc1ad0704e0dfedbcc", 0x79}, {&(0x7f0000000a00)="1916a1c5a0b421c09a9aea154f4a52654e3d08f212fcef36f975831ce22df0264b986e6fd69049378e1a171e07867768ae6fe04e01c127f27702f0b7c54107045f9353d1cdc2c4d978cf1791db53d85625de5907d4b521367cf4086957bc0b6301d75bea1702afa5d2fa4ca9ce078806c3886721ef1031178c2eab944077e0e7f67161b9afdcb8350acdd683d82608f5d4d491f38c9ebb6b799c91d40cb1187f1b4759eff4507f91f7818f9649b2a183eec691f11c3987585917784be08e3c83babb96f81df97427", 0xc8}, {&(0x7f0000000b00)="b93c3077d360f69cafe2fbd9d4df83f15ef7fa44feeaf86451f573f3f82c38d7c65d2bb008206b1d7324ce54f906ff9147db0415dec0a8430353c0b175d8d3785cefa493a6ce1cdd2afa470b9e2915b5eb3089b4534510956d46df1025c9871741afe8d2374dcc40f4c9b3ff11b988ecd991a3efea4056138b14a71876a4939b62fecb8a8b1b30328d17589dc7f551bc2dd137d295f1229d3ee24f38d6937a84f97c5d15c773", 0xa6}], 0x4, &(0x7f0000000bc0), 0x0, 0x40}], 0x1, 0x0) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) ftruncate(r1, 0x81) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:39 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, 0x0) 19:17:39 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, 0x0) 19:17:39 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0xfffffffffffffffd, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:39 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$TCSETAW(r2, 0x5407, &(0x7f0000000000)={0x9, 0x8, 0x5, 0x80000001, 0x15, 0x7, 0x7f, 0x7fffffff, 0x8}) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r4, &(0x7f00000001c0), 0x7ba27d3a) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r6, 0x107, 0x5, &(0x7f0000000080)=@req={0x10000, 0xea5f, 0x100000000, 0x80}, 0x10) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='[proc\x00', r5}, 0x10) setsockopt$inet_tcp_buf(r7, 0x6, 0x7c957d371538e228, &(0x7f0000000180), 0x0) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f0000ad7000)={0x1, &(0x7f0000acbff8)=[{0x6, 0x0, 0x0, 0x6}]}, 0x10) bind$inet6(r5, &(0x7f0000807fe4)={0xa, 0x4e22}, 0x1c) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, 0x0) ptrace$setregset(0x4205, 0x0, 0x0, 0x0) memfd_create(&(0x7f0000000140)='[proc\x00', 0x7) setsockopt$inet6_int(r5, 0x29, 0x4, &(0x7f0000000000)=0xd9fe, 0x4) sendto$inet6(r5, 0x0, 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) r8 = dup2(r5, r5) ioctl$TIOCMSET(r4, 0x5418, &(0x7f0000000180)=0xdbbe) ioctl$KDGKBSENT(0xffffffffffffffff, 0x4b48, 0x0) sendto$inet6(r5, &(0x7f0000ad6fad)='\x00', 0x1, 0x0, 0x0, 0x0) poll(&(0x7f0000000040)=[{r8}], 0x1, 0xe0) dup2(r6, r5) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:39 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x181000, 0x42) ioctl$LOOP_CLR_FD(r0, 0x4c01) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setgid(r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0x7ba27d3a) read(r2, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:39 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, 0x0) 19:17:39 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='cdg\x00', 0x4) r2 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r2, 0x0, 0x2000424, 0x1) write(r2, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r2, r2, &(0x7f0000001000), 0xfec) socket$inet6_tcp(0xa, 0x1, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:39 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, 0x0) 19:17:39 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = memfd_create(&(0x7f0000000140)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0xffffffffffffffff) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'veth0\x00', 0xd6ab786d372c940}) 19:17:40 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2a1a, 0xfffffffffffffffd, 0x8000, 0x7, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0xa77, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10010, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) write$binfmt_elf32(r2, &(0x7f0000000c00)=ANY=[@ANYBLOB="7f454c4607030009bd2500000000000002000600780900006401000038000000a0030000000000000000200002000200040003000000000051e5746404000000000800000800000003000000000000000000010000800000967858b02aadef45575c5ad149087729f6b757c8406063f4ff823fdf6a506e5170ed013961c0a898028ad8e159be45094f09e5ce0bbe6ab7c08a725b4b0885a730e4368a9f77d318f4b0b1ba32f170ebcdbb057081d2875c9bf4683834bd7abd10e6ead876acba1743ffa8075e77f7e23f36924d978ca66a3cbbc215d5a29932667b307c9b69986f98ba2693789329dd86a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002bd1f675a2b947eb4cea58950000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0xae3) pipe(&(0x7f0000000bc0)={0xffffffffffffffff}) write(r0, &(0x7f0000000300), 0xfffffffffffffd89) ioctl(r0, 0x0, &(0x7f0000000100)="961bcc891577789c7d74dd5874b80a8fcf49d03416c1f6ddf38858c09e7bfd2ac40d6b6cd939daf632ee9e719b5f80cc73890508373fceb28d27b159c99708203e4d128ec06e651f32af2bcbe607ec257eec9ecde3fa44c953962e41255bf7b38769de1ecc39675017884cbf11be91676045ea19a0ff9c40583cd6eafa7dcba3fd541f7144df4155b176d46f7c492fb2dacab73d85393418ff5c6310d90f650de8779ce8b09ac5359a40c97d317671330fbb283b") fsetxattr$trusted_overlay_origin(r3, &(0x7f0000000000)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x2, 0x3) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:40 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fsetxattr$security_smack_transmute(r0, &(0x7f0000000000)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000100)='TRUE', 0x4, 0x1) r1 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000000140)=0x0) sched_getscheduler(r5) write(r4, &(0x7f00000001c0), 0x7ba27d3a) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:40 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, 0x0) 19:17:40 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000500)='/dev/null\x00', 0x8000, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x0, 0x51, 0x2a, &(0x7f0000000540)="cebadb2bbc2d5a7674c6916538f06df1696295d57c50e555641aacd1030ef9e8a9138a14c656074beacbccbc6867eebbb7f7fdb529a27442669ba3226f2c18cce5afde901574d6cfb30dd6dc1eec8bc171", &(0x7f00000005c0)=""/42, 0xfffffffffffffff8}, 0x28) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r2 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) fallocate(r2, 0x0, 0x2000424, 0x1) write(r2, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r2, r2, &(0x7f0000001000), 0xfec) r4 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) r5 = mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2000000, 0x10, 0xffffffffffffff9c, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000200)={0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0x70, 0x0, &(0x7f0000000240)=[@reply_sg={0x40486312, {{0x2, 0x0, 0x1, 0x0, 0x10, 0x0, 0x0, 0x58, 0x28, &(0x7f0000000140)=[@flat={0x776a2a85, 0xa, r5, 0x1}, @fd={0x66642a85, 0x0, r2, 0x0, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f00000000c0), 0x1, 0x0, 0x34}], &(0x7f00000001c0)=[0x20, 0x0, 0x40, 0x8a55d80f712f858f, 0x78]}, 0x79}}, @increfs_done={0x40106308, r6, 0x3}, @clear_death={0x400c630f, 0x2, 0x1}], 0xcd, 0x0, &(0x7f00000002c0)="155e4ec11812201dc5fc9734ec9afff4485d789d764814fee9f2c410bcaea61d13eea3a8b6fad26e6165c19183c5221be651e17c0a87802281400de00d6a8eb42ff0ef2f6c51afa2ef96bf587f68578a48c2ae5d16335c02e39ada3faa73c8ff622e8ac99fe09bcd5bef41c6607388966a8cbd503acce4367fe5d0575af13afcff5d0cfc2462c07ee7f0194dd7424c17cc97952c77e23168675b904bf650ba6258464ff9a4d02ea0d6b35fd8f8cf2b104a5c20d6bda9acc4f3f2cfee2ae69f5d5d1f4a10fc29abb9d7f8680d17"}) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000004c0)={r2, &(0x7f0000000400)="243d5c339caf0170937ca82fcaec860f9bebfcf4ffc925be795516af2106bc18b7decaa25d2006bb33404cdc220f2f86a8d8af4fceb94ce605b7af49e8df27117ebf25876d844f67", &(0x7f0000000480)="79553afaa4cc6e12860f73906242eb7602e36072917ae5317a97fc", 0x3}, 0x20) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:40 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r3, &(0x7f00000003c0)="07d00945ff1aead35a3352904fbf3c8b42ae2affff000084ecb2091d411a0738a131f389f2ffffffffffff8aa6253ea8013eed8271f006efc3aa2000b097cbfb870c51aab842c6625cf805c76b0399af52d508559fbd44197d01e421db003f402dbdae7eb6c3d64e9307bbf463eb1cf437b2175bec42b2e1edf9357f94eb6ee609b108707b563a1611d8d056ee18964c455cd4c5ff252886afc4de772c750d339f4db19797f6f526f0a1d89a82557043939c315535da07a5b474ff6b83874a0aac618ae7989b85254f21ac6df385226b365ec828baee1e77fef2e7fa7d7e9b90d341aa06555c405fe05ee318cda2b9a026c7a4c202fa099bb5034d2c5df844a3f43f51bd095419463ca2f57d648c24863058c01d7696f56f4f2c8a764a348454767828a2d0e02bacf0cc6325680cf27cf9de42176726f4db9a340ae9b966dc3300000000", 0x144) read(r2, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:40 executing program 4: bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000400)='lo.em1eth1cgroup\x00', 0xffffffffffffffff}, 0x30) ptrace(0x4207, r0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') io_setup(0x1, &(0x7f0000000000)=0x0) io_cancel(r6, &(0x7f0000000300)={0x0, 0x0, 0x0, 0xf, 0x6, r1, &(0x7f0000000100)="3b4ca922d02c885d412b905cbd4233e85d5dbf81a149b8ffa0697b94c9068d7b8e06488dc7ba972776885de865e3806373bdbfb8a994cf3e697bef33a3a0336790825bed7d2e7148186c68b0b2ed92c5e5780e30f9e17ea7e410a3d7271300d3ae893b4e0d9b39a71b009ba18192daf1a5584e0609840ca718c907be2c43384613739406893b39695b1ca0e90989410f8935ca5257fc94bb494f6f28d1ac7b32209f6737327b8e2386456301e691e234a941fb143c66fd483d671bffe8e36a203b233ccaf61fdb7c", 0xc8, 0x65e, 0x0, 0x1, r4}, &(0x7f0000000340)) write(r5, &(0x7f00000001c0), 0x7ba27d3a) read(r4, &(0x7f0000000200)=""/250, 0x29e4ba6b) setsockopt$IP_VS_SO_SET_DEL(r4, 0x0, 0x484, &(0x7f00000003c0)={0x0, @multicast2, 0x4e23, 0x1, 'wrr\x00', 0xc, 0x80000000, 0xe}, 0x2c) 19:17:40 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:40 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0x7ba27d3a) read(r0, &(0x7f0000000200)=""/250, 0x29e4ba6b) write$FUSE_NOTIFY_STORE(r1, &(0x7f0000000000)={0x29, 0x4, 0x0, {0x1, 0x2, 0x1, 0x0, [0x0]}}, 0x29) 19:17:40 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:40 executing program 1: r0 = geteuid() syz_mount_image$f2fs(&(0x7f0000000240)='f2fs\x00', &(0x7f0000000280)='./file0\x00', 0x7, 0x4, &(0x7f00000005c0)=[{&(0x7f00000002c0)="b67f6af254450d15634283719e66fea6b7608644c1c79a243ec8d2eca279bcb5915e0cf112275c8a44eecd4f59aec192eed6d311732ca92c3f9b16e91b329c037bbcd62506ca6c302340ba164d3b84823f0b56045c9412188fa8eab24b16f69e71f41ef44ac9251d1295e9d84759cbd9374a1d96deaae7634e65cc920a01bf1a0c7afa75db7b42c611ed175771aaf3b749a51e4fba4b3b7df1c62113e8550f7b3fe9935d6987d4f2faf6e7a323a5f132d98faa886cd1c2c140731cce91a66609c392909437c0d58fd983449837", 0xcd, 0x4}, {&(0x7f00000003c0)="25dc5e6d862baeb90f9e2d87159921423539a88d06013f818e7018f4d8cd261459817437da83612694abbfb3b54292649c23682bce3b05a67fca8d9de5fea3a84e87e1bc16d3d60019cd30ea2cc7fc7240b5c6644afc422803519ac272aa15eabcb4847c9000220d9c36d0d1c2757fabc1c3fa637825a1cd99651b7b2a8c3a954a8e37f0808b8e", 0x87, 0x10001}, {&(0x7f0000000480)="17e2a386a9f2ead6294df95611036f0425c5612258a12ae41e965240df335ffa7ef2d7625c728467fb22e27cfce9234b4395566e833f478ecc373c58f03a1310b91ce110fa42ac76780302e17e4de27c077c12e9b950fd328eef71ad9b407d653f63ce78ebe3e75e352c498979efaa5d79e69f66a54e5a144c458b2da5cdff51f804ec89c13e24c2022a6b8e850876ebc6ee67ba3e2a3f141c66586da261dbecdaf75f27d5c124ed3fc62c042d7de1be0db51abb08ff182aac0f5b47ca14de300d173ddfcb", 0xc5, 0x7fff}, {&(0x7f0000000580)="a0154410121ce0d899e352ce43c88a29e44c4ef8655d24e09d65bf3804da44f51d49e3", 0x23, 0x8}], 0x800000, &(0x7f0000000640)={[{@resuid={'resuid', 0x3d, r0}}, {@disable_roll_forward='disable_roll_forward'}, {@alloc_mode_reuse='alloc_mode=reuse'}, {@disable_roll_forward='disable_roll_forward'}, {@fsync_mode_posix='fsync_mode=posix'}, {@nouser_xattr='nouser_xattr'}, {@jqfmt_vfsold='jqfmt=vfsold'}, {@noheap='noheap'}, {@user_xattr='user_xattr'}], [{@obj_user={'obj_user', 0x3d, '\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f'}}]}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) prctl$PR_SET_MM(0x23, 0x0, &(0x7f0000000000/0x2000)=nil) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x0, 0x0, @remote, 0x2}, 0x1c) sendmmsg(r2, &(0x7f0000002180)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000001ac0)=@ax25={{0x3, @rose}, [@netrom, @null, @remote, @bcast, @rose, @netrom, @bcast, @netrom]}, 0x80, 0x0}}], 0x2, 0x0) r3 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r3, 0x0, 0x2000424, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r4, 0x0, 0x41, &(0x7f0000000180)={'mangle\x00', 0x5, [{}, {}, {}, {}, {}]}, 0x78) write(r3, &(0x7f00000009c0)='/', 0x1) fsetxattr(r3, &(0x7f00000000c0)=@known='system.sockprotoname\x00', &(0x7f0000000140)='/dev/net/tun\x00', 0xd, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(&(0x7f0000000200)='./file0\x00', 0x450040, 0x10) sendfile(r3, r3, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r3, 0x0) time(&(0x7f0000000040)) ioctl$TUNSETSTEERINGEBPF(r1, 0x400454d1, &(0x7f0000000080)) 19:17:40 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1021.534808] F2FS-fs (loop1): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 1021.542769] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 1021.603591] F2FS-fs (loop1): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 1021.641417] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock 19:17:40 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0xc694, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1021.671474] F2FS-fs (loop1): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 1021.702259] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 1021.727983] F2FS-fs (loop1): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 1021.750596] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock 19:17:41 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) write(r0, &(0x7f0000000000)="aa4aaa679acc8d74592bd07d3f3ec17a173e417bd5bd2a5489b348dc46c90dc05dda585d3ca9a508477346131ee6", 0x2e) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0x7ba27d3a) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:41 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0x7ba27d3a) read(r0, &(0x7f0000000200)=""/250, 0x29e4ba6b) write$FUSE_NOTIFY_STORE(r1, &(0x7f0000000000)={0x29, 0x4, 0x0, {0x1, 0x2, 0x1, 0x0, [0x0]}}, 0x29) 19:17:41 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0) 19:17:41 executing program 1: memfd_create(&(0x7f0000000040)='cgroupvboxnet0\x84:\x00', 0x2) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) prctl$PR_CAPBSET_READ(0x17, 0x14) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x2000000000000001, 0x2000424, 0x3) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00') sendmsg$TIPC_CMD_GET_REMOTE_MNG(r2, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, r3, 0x20, 0x70bd2c, 0x25dfdbfd, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x24004800}, 0x80) 19:17:41 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) write(r3, &(0x7f00000001c0), 0x7ba27d3a) read(r2, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:41 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair(0x11, 0xa, 0x7a, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getpeername$inet(r0, &(0x7f0000000040)={0x2, 0x0, @multicast2}, &(0x7f0000000080)=0x10) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$UI_DEV_CREATE(r1, 0x5501) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0x7ba27d3a) read(r2, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:41 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r0, &(0x7f0000001000), 0xfef) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:41 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) pwrite64(r1, &(0x7f0000000040), 0x0, 0x0) pipe(&(0x7f0000000040)) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x101000, 0x100) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)=r2) 19:17:41 executing program 1: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$ASHMEM_GET_NAME(r0, 0x81007702, &(0x7f0000000140)=""/69) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r2 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r2, 0x0, 0x2000424, 0x1) write(r2, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r2, r2, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x400454d1, &(0x7f0000000080)) 19:17:41 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x3, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:41 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r2, 0x0, 0x2000424, 0x1) write(r1, &(0x7f0000000200)="553c956a4afac5039edb1e00ffe28ce985746c0f3b6a98ccb7b40880aa152dd8bbd7de5e8674d58b11cd9cd964dd2357df47bb8e25d46bed2b4bf4ec1b126416ff531b44f5e24a54f34bec0da454d3cfd72863e0006ee3ca2b4272e93cad9474b4c5a38046dfa8140a11cd84d1eecd89edb180aa0f4f9e7f115fc1f7e335cae768c0fab22ce514e806005d174b6d44928fabca93f92ab91100516be31e8b8f6553bca3b4975b543639b1739258185e2097afbc73e7b1e5a11782d05aaeae69c3aee4618c6b654f4d6dece2d9aec46b6e44312569f03f016f82c0fcaf16a590ddc800", 0xe2) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0x2000, 0x0) ioctl$TIOCGSOFTCAR(r4, 0x5419, &(0x7f0000000140)) sendfile(r2, r2, &(0x7f0000001000), 0xfec) write$selinux_load(r3, &(0x7f0000000080)={0xf97cff8c, 0x8, 'SE Linux', "3b09cbd15bcf8572e3cde0cc0868473fde2c5c1ee845dcd50fecc96d9b433c68d84814fef4ba9af96b4d3bf9ca3812c1dedf8bc4aa0d84d8308ef1a09116a8046cfde19e6b0a241c452cc573da157b522060f5033ce7a9d8b7b51f59ac"}, 0x6d) readv(r2, &(0x7f0000000400)=[{&(0x7f0000000500)=""/214, 0xd6}, {&(0x7f0000000440)=""/149, 0x95}], 0x2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) 19:17:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) dup(r0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) 19:17:41 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x800006, 0x13, r0, 0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000800)={{{@in6=@remote, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in=@multicast2}}, &(0x7f0000000900)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000a00)={{{@in=@initdev, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@mcast1}}, &(0x7f0000000940)=0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000b00)={{{@in=@multicast1, @in6=@mcast2, 0x4e22, 0x0, 0x4e23, 0x3, 0x2, 0x80, 0x80, 0x3c, r3, r4}, {0x4, 0x0, 0xbca, 0x8, 0x7ff, 0x3ff, 0x2, 0xce28}, {0x3, 0xff, 0xffffffff, 0x100000000}, 0x7, 0x6e6bbe, 0x0, 0x0, 0x3, 0x3}, {{@in=@multicast1, 0x4d3, 0x33}, 0x2, @in6=@dev={0xfe, 0x80, [], 0x12}, 0x0, 0x3, 0x2, 0x8001, 0x6, 0x100, 0x5}}, 0xe8) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:41 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) r2 = accept4(0xffffffffffffffff, &(0x7f0000000140)=@can, &(0x7f0000000040)=0x80, 0x80800) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_LINK_STATS(r2, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x84000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x30, r3, 0x1, 0x70bd27, 0x25dfdbfe, {{}, 0x0, 0xb, 0x0, {0x14, 0x14, 'broadcast-link\x00'}}, [""]}, 0x30}, 0x1, 0x0, 0x0, 0x40}, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) write$binfmt_misc(r2, &(0x7f00000002c0)={'syz1', "b1dc814a7e8864a15233931306f780ade0244468a79e6614299bb53a77d6382a7dd2b8884442806a14fa50b127b616b1028d11bdaa54ab2b227dd8ac474a08a7d71d793a68e4fa9b68ee0f41a9e1dda39ea6e0d242"}, 0x59) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1022.824575] binder: 5235:5238 Release 1 refcount change on invalid ref 0 ret -22 19:17:41 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) open(&(0x7f0000000040)='./file0\x00', 0x80, 0x0) [ 1022.867018] binder: BINDER_SET_CONTEXT_MGR already set 19:17:41 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1022.867312] binder_alloc: binder_alloc_mmap_handler: 5235 20001000-20004000 already mapped failed -16 [ 1022.918439] binder_alloc: 5235: binder_alloc_buf, no vma [ 1022.924058] binder: 5235:5252 Release 1 refcount change on invalid ref 0 ret -22 [ 1022.925066] binder: release 5235:5238 transaction 1403 out, still active [ 1022.925071] binder: unexpected work type, 4, not freed [ 1022.925073] binder: undelivered TRANSACTION_COMPLETE [ 1022.936791] binder: 5235:5243 ioctl 40046207 0 returned -16 [ 1022.936860] binder: send failed reply for transaction 1403, target dead [ 1023.018755] binder: 5235:5238 transaction failed 29189/-3, size 24-8 line 3255 [ 1023.051604] binder: undelivered TRANSACTION_ERROR: 29189 19:17:41 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(r2, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r4, &(0x7f00000001c0), 0x7ba27d3a) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:42 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000b00)='/selinux/commit_pending_bools\x00', 0x1, 0x0) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000b40)={0x0, @multicast1, @initdev}, &(0x7f0000000b80)=0xc) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000980)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$RTC_AIE_ON(r3, 0x7001) r4 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getresuid(&(0x7f0000000140)=0x0, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$netlink(r4, &(0x7f0000000900)={&(0x7f00000000c0)=@kern={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000008c0)=[{&(0x7f0000000200)=ANY=[@ANYBLOB="bc0300002200220d28bd7000ffdbdf2524011a0024001e0073656c696e75787365637572697479766d6e6574316370757365745c00000000211bc28cbc08000a0006000000c5eceb33edf559239dfd1a2ba43b8ace8483797f6042ca2c9186c5f8d52fea8dd76f62ec7078f28bb333c91c28d975c2e0d4fe6cc88da9b83997099e1eb2030186657c015855ada0a5eb8a03dbbba10f53ebc7fedf6455310915285c42c490954e5452cb9f31c3f35764262cd87d6294fe3db338ca3911ad7168bf44f6de82c79e1c20637157df181e753c54913e3d167a00712c0fdd8cdb2c17eea04bb13e0c4c15fbe21d002715c45b9c3ffdd31866915f07a38e92f802c5662d9fe018fbdc32c0870e30485ba3ce3c17994ff6dc326cd47e6f003900", @ANYRES32=r5, @ANYBLOB="3d45fbb63fc39426204c04f792aa7aeaa0f2fb2d5603d3b561ccf70b793437bbacf6b90a9210c7f106c990b19c8618bd7929e15e0a8c31f6d34ccffb728ab140a9699de9f30bbecbc0c2de5833fe111d6503a29e9b2307985d66311c435bc5a8237d25130152e6f418fa03ad2fd371a218249d50be438c6a886af7b2cb04011e00f8005400ae9ccdcab678f1ee183a792a00d85314401929011be1011adfd1e5d8165a9994574845a59d18e5c92687a97f425377000d13394189dbe1418b908daa9704932fde314fca636f6e09754d893d57082861662c261cf6ed8c350e7fc1d0c75ac8b1816805dc67cc0373447a6673055f64eaf937d36f2826b189eef22f761e749401ee6e428545bb38aeb76897f2048facd4fe735817505ff65e2cbaa55496943f6d523b13f907cd7cbc9de6ac2b8296a91933d128c01441e3f2870194a574cd66b8b9a09a2dff0e2265b5cf3d940f450288688a8657f58eb78acf1a5d8769e4ad4ca9967bd14736e2269434f4cb47d102b275c0210008001c00", @ANYRES32=r1, @ANYBLOB="30001600080061000400000024004e0076626f786e6574307070703176626f786e6574312d73656c666367726f757000d8208aadd657bfb50cfe4ac6710cc3ec8eb2f44fd1a175865bcefb51b33bab9dcc605465a8b3935dbaa0a342a11c671a9c139a5beee8b6fb1462bf7551f162af21736b8f2acea29f61bd119e64ce30ca401ce6f4f4dd4b137419ea4a7446cdc968f7130c652f1c29fbcbdba5c4ebcfce0488f563b8845e6a1bc5eee88726c69f7eed2dd02b7d1a9a598f1577fb9c9cc0bdf7c5468f5cb3d519317d34c04e4c131af860492835024130df6c5d3bb9c185c20404521933609db7deba5e6cd811c793c31b4cb24471b361bd01f1170349b277693697d5470d9312462eef"], 0x3bc}, {&(0x7f00000005c0)={0x2fc, 0x3e, 0x700, 0x70bd2d, 0x25dfdbfd, "", [@nested={0x210, 0x80, [@generic="b0c78ea4a206ca8ae70312626499442993b1fc6c8d33c628516935f79bc5082b2c9ab606da7f668006a79dd3caa55e831e82fa6df8737248824a525ca765126ad62bd5a81dead17d46a2ac74f753273faf7155d1aa918cf9717bf1a668b4aee4b5d63eb68151636e577e8f27f2f79bb27805dd8349c52a134d0feb84cbcb4f532a3ae3f853a1d68be10493906384a0224e26aeaf273c6403f1", @generic="73027a7b86fbcb828f534db8e1d73fa33883ae9ab020b27da958e9ad72cdf0f2f2b3653a54cd647a7046cf49ee8ae633e6c20659e63c3978fddb0ba2aec54db2e05cef2eb53f9f87b1bac94ae1e93484d3f41140e4130d5b327734514dcf8a23df8b5a0b2203181a57c2ae6e5bf1eefc0f5635e814a772733840aac0b3392644b636b14f89d3d8", @typed={0xec, 0x41, @binary="1450be2ebbcc578422fa690fc9b4f287debb51a6ef67398e4d33b12dfef8b8abe146af4c5f56f442913352a1f63b695feb2c3e244a207b32027fcc49ecf71bef59828137931b2a04f6cb121e336a931403cc141877df37aee10e6172abf91dbcb2034bad4f887d6f782a42c2a52ec753d1ec8e4394a41c19b01765cdafd2e8494845eff2df8ef4826ae2dca21a48fc6f7e69b4a8a7e062dd47188e92dedb79d92cd9d2ba924b9cc3e9e3471afcaae15ea319a334ffbe8c38be78c8f7cae6a0ab3c42cf38ffd1d9efcb8b11c8a0e20eaed3c5a71811ae4caa94ef05ae44824c646bd3b6c633670a06"}]}, @generic="aff0ee27597f9a8b10a80b0e88b753c57f5534d6c88b394147fe5c57e7f0bb7e508065c398725291931e853af8070387cec9dc89326362a1b49d560492cec66f9e5336fe515ba8d454ef66217e299446b505907f92f39c28aab27de7a4846bb5c4e4b200461cf43988121281aa0b9e69e5e8d9c9173385c78110eb5180302b61be19100c8793ddd8f4cb3a5afbb61ad7b7baf9560702424260ed2630168a2b090b366380cdfe1f84a57330f263dae871049512e4afe7834638f26d0b", @typed={0xc, 0x16, @u64=0x1ff}, @typed={0x8, 0x3f, @u32=0x100}, @typed={0xc, 0x1, @u64=0x3}]}, 0x2fc}], 0x2, 0x0, 0x0, 0x4008011}, 0x40000) clone(0x2902001ff7, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigtimedwait(&(0x7f0000000040), 0x0, 0x0, 0x8) r6 = getpid() rt_tgsigqueueinfo(r6, r6, 0x16, &(0x7f0000000100)) ptrace(0x10, r6) ptrace$getregs(0xe, r6, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) ioctl$IOC_PR_RELEASE(r1, 0x401070ca, &(0x7f0000000bc0)={0x84, 0x1ff, 0x1}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$GIO_FONTX(r4, 0x4b6b, &(0x7f0000000a00)=""/248) ioctl$TIOCLINUX4(r4, 0x541c, &(0x7f0000000080)) ioctl$TUNSETSTEERINGEBPF(r4, 0x400454d1, &(0x7f0000000940)) 19:17:42 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/mls\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000640)={'team0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000680)={'veth0_to_hsr\x00', r3}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:42 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) r2 = creat(&(0x7f0000000040)='./file0\x00', 0x4) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r2, 0xc0145401, &(0x7f00000000c0)={0x3, 0x0, 0xff, 0x2, 0x2}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x800) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) 19:17:42 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDELRT(r0, 0x890c, &(0x7f0000000040)={0x0, {0x2, 0x4e22, @rand_addr=0x6}, {0x2, 0x4e24, @empty}, {0x2, 0x4e23, @multicast2}, 0xc0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000000)='teql0\x00', 0xd61, 0x8, 0x4}) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x7ba27d3a) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000100)='team\x00') accept$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000180)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f00000003c0)={{{@in=@broadcast, @in6=@ipv4={[], [], @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@remote}}, &(0x7f0000000300)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000680)={{{@in=@multicast1, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}}}, &(0x7f0000000540)=0xe8) getpeername$packet(r0, &(0x7f0000000580)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000005c0)=0x14) accept$packet(r1, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000800)=0x14) getsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000880)={@remote, 0x0}, &(0x7f00000008c0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000900)={{{@in6=@loopback, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@multicast1}}, &(0x7f0000000a00)=0xe8) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000a40)={'team_slave_0\x00', 0x0}) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000024c0)={{{@in=@broadcast, @in6=@ipv4={[], [], @local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@empty}}, &(0x7f00000025c0)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000002600)={{{@in=@multicast2, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@broadcast}}, &(0x7f0000002700)=0xe8) getsockname$packet(r1, &(0x7f0000002740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000002780)=0x14) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000002840)={{{@in, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@empty}}, &(0x7f0000002940)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000002980)={{{@in=@dev, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@broadcast}}, &(0x7f0000002a80)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000002ac0)={{{@in=@empty, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@loopback}}, &(0x7f0000002bc0)=0xe8) accept$packet(r0, &(0x7f0000002c00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000002c40)=0x14) getsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000002d40)={@dev, @loopback, 0x0}, &(0x7f0000002d80)=0xc) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000002dc0)={{{@in=@dev, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@local}}, &(0x7f0000002ec0)=0xe8) getsockname$packet(r0, &(0x7f0000002f40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000002f80)=0x14) accept4$packet(r1, &(0x7f0000002fc0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000003000)=0x14, 0x80800) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000003100)={{{@in6, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@multicast2}}, &(0x7f0000003200)=0xe8) getsockname$packet(r2, &(0x7f0000003300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000003340)=0x14) accept$packet(r0, &(0x7f0000003380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000033c0)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000003400)={'team0\x00', 0x0}) accept$packet(r2, &(0x7f0000003440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000003480)=0x14) sendmsg$TEAM_CMD_PORT_LIST_GET(r1, &(0x7f0000003cc0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000003c80)={&(0x7f00000034c0)={0x7b4, r3, 0x210, 0x70bd2c, 0x25dfdbfb, {}, [{{0x8, 0x1, r4}, {0x100, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x7fff}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x8}}, {0x8, 0x6, r5}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x4}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}]}}, {{0x8, 0x1, r6}, {0x178, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8}}}, {0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x14, 0x4, 'activebackup\x00'}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x8001}}, {0x8, 0x6, r7}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8}}, {0x8, 0x6, r8}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x7fffffff}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r9}}}]}}, {{0x8, 0x1, r10}, {0xc0, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffffff7}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r11}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}]}}, {{0x8, 0x1, r12}, {0x3c, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x400}}}]}}, {{0x8, 0x1, r13}, {0x174, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x8}}, {0x8, 0x6, r14}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r15}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0xca5}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x100000000}}, {0x8, 0x6, r16}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r17}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x9}}}]}}, {{0x8, 0x1, r18}, {0x84, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x8}}, {0x8, 0x6, r19}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r20}}, {0x8}}}]}}, {{0x8, 0x1, r21}, {0xf8, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0xffffffff}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r22}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r23}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r24}}, {0x8}}}]}}, {{0x8, 0x1, r25}, {0xb8, 0x2, [{0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r26}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x9}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'roundrobin\x00'}}}]}}, {{0x8, 0x1, r27}, {0x3c, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x1}}}]}}]}, 0x7b4}, 0x1, 0x0, 0x0, 0x4}, 0x40000) read(r1, &(0x7f0000000200)=""/250, 0x29e4ba6b) [ 1023.224724] binder: 5280:5282 Release 1 refcount change on invalid ref 0 ret -22 [ 1023.235095] binder_alloc: binder_alloc_mmap_handler: 5280 20001000-20004000 already mapped failed -16 [ 1023.259206] binder: BINDER_SET_CONTEXT_MGR already set [ 1023.265166] binder: 5280:5282 ioctl 40046207 0 returned -16 19:17:42 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fgetxattr(r1, &(0x7f0000000140)=@random={'system.', 'nr0\x01\x00'}, &(0x7f0000000180)=""/254, 0xfe) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'vxcan1\x00', 0x2220}) sendfile(r1, r1, &(0x7f0000001000), 0xfec) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x4000, 0x0) r3 = gettid() ioctl$sock_FIOSETOWN(r2, 0x8901, &(0x7f0000000280)=r3) ioctl$TUNGETVNETHDRSZ(r0, 0x800454d7, &(0x7f00000002c0)) ioctl$UI_DEV_DESTROY(r2, 0x5502) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/enforce\x00', 0x400800, 0x0) write$FUSE_LSEEK(r2, &(0x7f0000000140)={0x18, 0x0, 0x1, {0xa6}}, 0x18) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) open$dir(0x0, 0x0, 0x0) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) setsockopt$inet6_tcp_int(r3, 0x6, 0xa, &(0x7f0000000000)=0x81, 0x4) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) sendto$inet6(r3, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) ioctl$sock_inet_SIOCSIFBRDADDR(r4, 0x891a, &(0x7f0000000180)={'hsr0\x00', {0x2, 0x4e20, @broadcast}}) setsockopt$inet6_opts(r3, 0x29, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB], 0x8) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x7fff) sendfile(r4, r5, &(0x7f0000d83ff8), 0x8000fffffffe) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$EVIOCGBITKEY(r5, 0x80404521, &(0x7f0000000080)=""/16) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="000000dfcc00a9bf"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) write$FUSE_IOCTL(r5, &(0x7f0000000280)={0x20, 0xfffffffffffffffe, 0x4, {0x1, 0x4, 0x1, 0x167}}, 0x20) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) [ 1023.271833] binder_alloc: 5280: binder_alloc_buf, no vma [ 1023.271854] binder: 5280:5287 transaction failed 29189/-3, size 24-8 line 3255 [ 1023.272148] binder: undelivered TRANSACTION_ERROR: 29189 [ 1023.272198] binder: send failed reply for transaction 1408 to 5280:5282 [ 1023.272262] binder: undelivered TRANSACTION_COMPLETE [ 1023.272270] binder: undelivered TRANSACTION_ERROR: 29189 19:17:42 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f0000000240)="4a92edb92da469fd3fdec30f879f80ab33ab569bb535b86d540ceec4c6480dd3a5194b8bf1101a9395fc4f760b8c2e34c291950a512c6223d3d1bd6d7d955c257ede18b5090b89602fdfc93a25613c67602f654856680a5e6116d2b98ab1a1a60330c0b4f84252cba5e7df1c35c790efafef6a8c601e2b67f9c25bf73783f8112fddf84fe5b9d10ce5a587c3d580db972aa63284ff7755f03311ef72639f3cb4b727218bee118bf6bf167475240dd9d4e21ad7ea364f85ab4827701a238581bc1397d311704e2e54a009ff179c65e2ad1cccf8ad50532ffc4f86492d643c9b", 0xdf) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:42 executing program 5: r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$BLKBSZGET(r0, 0x80081270, &(0x7f0000000300)) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r2 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r2, 0x0, 0x2000424, 0x1) write(r2, &(0x7f00000009c0)='/', 0x1) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='bpf\x00', 0x2080000, &(0x7f0000000380)=ANY=[@ANYBLOB="6d6f64653d30303030303030303030303030303030303030303037372c6d30303030303030303030303030303030303030303034322c6d7a64653d30303030303030303030303030303030303030303030302c6d6f64653d30303030303030303030303030303030303030303030332c6d6f64653d3030303030303030303030303030303030303030304631e39f9831302c6d6f64653d30303030303030303030303030303030303030303030312c61707072616973655f747970653d696d617369672c636f6e746578743d726f6f742c0000000000"]) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r2, r2, &(0x7f0000001000), 0xfec) fcntl$F_SET_RW_HINT(r3, 0x40c, &(0x7f0000000280)=0x3) ioctl$KDGETKEYCODE(r0, 0x4b4c, &(0x7f0000000340)={0x2, 0x3}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000240)='/dev/zero\x00', 0x14400, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x400454d1, &(0x7f0000000080)) [ 1023.459271] binder: 5297:5307 Release 1 refcount change on invalid ref 0 ret -22 19:17:42 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f00000000c0)={0x0, r0, 0x8, 0x8, 0x0, 0x39}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) ioctl$PIO_UNIMAPCLR(r0, 0x4b68, &(0x7f0000000040)={0x8, 0x12, 0xc91}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:42 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(r2, &(0x7f0000000000)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r4, &(0x7f00000001c0), 0x7ba27d3a) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) prctl$PR_GET_FPEXC(0xb, &(0x7f0000000000)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) [ 1023.617603] binder: send failed reply for transaction 1413 to 5297:5307 [ 1023.625499] binder: undelivered TRANSACTION_COMPLETE [ 1023.665956] binder: 5325:5327 Release 1 refcount change on invalid ref 0 ret -22 [ 1023.670137] binder_alloc: binder_alloc_mmap_handler: 5325 20001000-20004000 already mapped failed -16 [ 1023.670242] binder: BINDER_SET_CONTEXT_MGR already set [ 1023.670251] binder: 5325:5328 ioctl 40046207 0 returned -16 [ 1023.670340] binder_alloc: 5325: binder_alloc_buf, no vma [ 1023.670358] binder: 5325:5327 transaction failed 29189/-3, size 24-8 line 3255 [ 1023.674375] binder: 5325:5328 Release 1 refcount change on invalid ref 0 ret -22 [ 1023.741796] binder: undelivered TRANSACTION_ERROR: 29189 [ 1023.748099] binder: undelivered TRANSACTION_ERROR: 29189 [ 1023.754065] binder: release 5325:5327 transaction 1417 out, still active [ 1023.761366] binder: unexpected work type, 4, not freed [ 1023.767077] binder: undelivered TRANSACTION_COMPLETE [ 1023.772496] binder: send failed reply for transaction 1417, target dead 19:17:42 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r2 = openat$cgroup(0xffffffffffffff9c, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0) openat$cgroup(r2, &(0x7f00000000c0)='syz0\x00', 0x200002, 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) r3 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0)='TIPCv2\x00') sendmsg$TIPC_NL_MON_GET(r3, &(0x7f0000000280)={&(0x7f0000000180), 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x2c, r4, 0x20, 0x70bd2a, 0x25dfdbfe, {}, [@TIPC_NLA_NODE={0x18, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x81}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_NODE_UP={0x4}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x11}, 0x804) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:42 executing program 0: r0 = accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000000040)) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f00000000c0)={0x0, @speck128, 0x2, "f2f1540b9ea4b6fd"}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r2 = memfd_create(&(0x7f0000000240)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r2, 0x0, 0x2000424, 0x1) write(r2, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r2, r2, &(0x7f0000001000), 0xfec) ioctl$FS_IOC_SETFSLABEL(r1, 0x41009432, &(0x7f0000000140)="33ea71535ccbe849fc33bf66f3c518c5d41981acea2aa26ed14358eb06ee7da824c87fbf78934280aae68b0c06bc13fb678e9be88d6da3bb4d1d160635ee826dcad87de8e11687d741334d92ddf3d2cd0caea762cbdee4f422b3543229305d7f0e4ed2254888dc1c23a36ab3f1af2546ae1b5f01613b0f9165e2bee4656144571546c31256ccd5987825c34d8acea1f58a1813a394ee2977ca5a68727bface6b61c786215730ebc9ac6afd4512468ae3780093e1bab170d925fb01a84ae9cdd99b8661215dff0f2afb061c380dc5c0df08c2427404d30cf44728cd845285a7f8e9077a9be5236da53a6e5a57592f178aad302d68535af861de7ea57186c4a3c6") fcntl$setsig(r1, 0xa, 0x26) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x400454d1, &(0x7f0000000080)) 19:17:42 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f00000001c0)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000040)) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x4000) ioctl$GIO_FONT(r2, 0x4b60, &(0x7f0000000040)=""/128) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) 19:17:42 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xc, 0xffffffffffffffff, 0x2) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSTATFS(r1, &(0x7f0000000000)={0x43, 0x9, 0x1, {0x4b, 0x9, 0x0, 0x1, 0x4, 0x1, 0x6, 0x3, 0x40}}, 0x43) write(r1, &(0x7f0000000140)="67ef352ef8295cec7e54b1431eb99eee466286da8483ea4e01191033fcb790ea5fc936c9a227dcd1ff4f7a4e82eb71b4", 0x30) read(r0, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:42 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x90, 0x41300) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r4, &(0x7f00000001c0), 0x7ba27d3a) ioctl$sock_ifreq(r4, 0x891e, &(0x7f0000000140)={'bcsf0\x00', @ifru_data=&(0x7f0000000100)="5087b5c448d4da408efed63e911e94aeca1cef2c9838f66d580d8009f2878f25"}) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:42 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'bcsf0\x00', 0x8020}) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/mls\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000180)={0x5, 0x4, 0x1, 0x8, 0x14, 0x9, 0x9, 0x28, 0x6, 0x1, 0x819, 0x7}) write(r1, &(0x7f0000000040)="5316aa622129ece1bcd58974ad46e5fdfd940f13129c1f052447df11acf4bed319d2", 0x22) 19:17:42 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x4, 0x120010, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1024.077652] binder: 5338:5344 Release 1 refcount change on invalid ref 0 ret -22 19:17:43 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpu.stat\x00', 0x0, 0x0) ioctl$UI_SET_PROPBIT(r1, 0x4004556e, 0x10) recvmsg(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000140)=""/201, 0xc9}, {&(0x7f0000000240)=""/219, 0xdb}, {&(0x7f0000002000)=""/4096, 0x1000}, {&(0x7f0000000340)=""/150, 0x96}, {&(0x7f00000000c0)=""/24, 0x18}, {&(0x7f0000000400)=""/151, 0x97}, {&(0x7f00000004c0)=""/107, 0x6b}], 0x7, &(0x7f00000005c0)=""/118, 0x76}, 0x2040) r2 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r2, 0x0, 0x2000424, 0x1) write(r2, &(0x7f00000009c0)='/', 0x1) lsetxattr$trusted_overlay_opaque(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0)='trusted.overlay.opaque\x00', &(0x7f0000000800)='y\x00', 0x2, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r2, r2, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000000, 0x11, r0, 0x0) preadv(r1, &(0x7f0000000740)=[{&(0x7f0000000680)=""/167, 0xa7}], 0x1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:43 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1024.136490] binder: BINDER_SET_CONTEXT_MGR already set [ 1024.143296] binder: 5338:5344 ioctl 40046207 0 returned -16 [ 1024.143333] binder_alloc: 5338: binder_alloc_buf, no vma 19:17:43 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) poll(&(0x7f0000000140)=[{r2, 0xa010}, {r0, 0x2}, {r0, 0x400}, {r1, 0x8480}, {r1, 0x2000}, {r2, 0x1200}, {r2, 0x4030}, {r2, 0x44}, {r1, 0x80}, {r2, 0x4}], 0xa, 0x3) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) r3 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000040)='/dev/keychord\x00', 0x101000, 0x0) sendto$unix(r3, &(0x7f0000002000)="285020c369e089616445e9999a22c8aaad199f129c6e921f1b2df8efcbfa29c4cca9b615e1e611b0af96eb91b08f454541b3adc6e208fb024e674fe84bb34c48221628d00948eba911e749352d748161e0baaa0eee6b3c09eccde19af242e9a9e2ef8e53960f46b6452da9b161d2f1b7ee3e220975803ad8f7c796941e99c90c4ebba35da43055a5904e58a70d4c50a872908258abfa2ef253c703d10a4cb4e3302f712da3ce81280c466c2d2d8cdd8456fb53ca62407659db2787cb1fa998b3da4c6e2d3ec419a107451b519dd6095f5eae328fb537d9718c9170baf181618a39356a5dfa99e9026a599dcd7a499a08a12ee367bfcd2517bc3914e596fa6c57b8fbaeb2fd29a1160875f41736884b93d0fd85a2351cd612ddc86fb218e22bcdb7d25cee14f9e006be8d55f32c8726d6c1fd201a6bbe75634d4c5abc136c6e4bd15e4b6bd25b2d4442e9aaa3d792e530e8ba4a1b18307db9da3462d8c973045e0eb66fddab2013dfd1e8a776c58122dfc6dab9d854af5491903d8f0510185ef2450ced3f7cf6165c20be5569c39cfb67d69fa31874ce4ba3ca010a1a0496b4a9805b4ea36db858147e61cc7026ec3cc44fd9cd462c137a85d3315da87deaca0b09297731265bb74ffc5faff2a13bb120a6bbdbe3012bf4146acb8d4ad285ae2fad44d58733603aee0537a49ce8ab6d31d48bdabc164bc36ddccfb1387619aef7dcfa94e3a175e91155fed828583049dc2d9398c2583a0ef0376c3ff9f3c9adb4960070600479117ef220397b1b90f33ab914041096bd6bf604321c61e77881f14700c47ca9ee6333df97f44c049df1a4045858f6a3c39b42228dcfb76846d50e80087eb3fca291e1fec3cdfcfb911eb178adc80c4c3e402f0cc9d87371ee45ef897df09bbf666003287cce3f94555da0a6f2d3d04877f965c46fa6a11c0fe41d7efe6fad6160775d8b1436378f86f894632b6a3c0fa9c144e160fcbfb310951eb4dd2c645672cabfb27ce2bf7a6fa1b9492b33edb26034ae1792f4cd8b6b4800dc49197f1357d08463c3729b96222d21c02f9d818162538db60908afe99d8f9e6046b97d8a9773cfb348fddfc4539e04f330c5f72317cfc438ddcaf8d2f0e324289cc1d78672dc163652bddccffd280b63c9902698ddeb9e1062db2afd7d1a2d702471feaa80c0d64fa2ff96ab828123202b68844acf051f6df37d8a4671f5a9a0b20b551f45daa3b816a50640b3daa50b05abb3d0d3b46fa96d75e6df275fd584d49bdc062c45febd62bd05fb97c506eca9975b5935caad508239e1ac03a12ffef15ea52b75bc3b4e6e127e330240cdd8c81a88dede195191eeedffab93e4064bd308165d2388932d89d6c140d6f05cf96eb68113ab045bfd4281f2d7d962e7c5366bafe4c9bd546d6dfbb76a87d21e9f80628d4d5ffb9a866dde77314accad7d0ed30a3ada76d1ef82792f9b2561de772d8ce591051d470011f17ac98f5ea72e6b61eb53db67cb24e7d06b33841189df037fc3027b8747e1c49d8f617e2cd54f3950c486d2ccf0d5b5ffc3d66aaeefb94be0884a6ded9ca501da76af597a5e1eb50f09fa33e05b1e461cd5ba904d233c387464902e351110f70f98cfed6870a67b66b02ce151a78fe2e99076d36118e988e5329a71224930d9c4a57d7c890d07b126404abc69aa4544ce3d7f9da8a58756e80268c7b8dec91e267ac40910c0d6567c172a70c018155febe890c9455db313df54549d52955d05fd48b086c579d9e90976e774ae2cd7cc811647347908da9806b427dd2e82c4130e18c64fa5501d0e2dc3eec5bc86afbca56dfd29df30d8e84ae3b3fc1f5832eb412d40314316bca492e3575bc5d0c3e3d06cea6b48a8d36159134c87897e5d18b55cd77c84edd3f883931ad2ffea0a545f33b28ea0ec05edbad226da6082fade64e86065090e3572c86b1fbd3da1e5a2e09fca4e5e6d8ee3ac3321c9f81839e83eefc69eb476bffe10fbd66c456c63ced4df96f8f9cb3937a2ff8d178062096b0de60d9100d23d5b8790b25a4772eb30706f27fea0aa387035710f50dbd69dc2cf15af7447485792ac0747426a70f56f24662e9eaf1bc6810a4ceadee06a858a45ca0ff09fc9324ef0e581999b10f71b0bf8df758db223714562acb122feae11ae2e1ae86378fa383e3229e4197df0d691421a061c7d1937970ca208174d759cbc5001e2302a03e1fea7063c904de209ac8203308d3d847325a68f5bb7c21245d5a7464c520edf3f113edc09dcf6eb59cf1fe3a99a246d3586d1f2156d8557e8cb907e7f3c1efbd8f7f4ad9dab4f04740e000dc244803cc25759703d053eb2d61daa2e29f58dd9efcfff0e89941d0009547173d72793793ec112765db42730005e355ec2cd49048afb29d259085617092ee351bc81b91d1de3d1fea0f7ec73c6a720c9a15cbe5f477a2fa4f0abfa1dba9889a5fd978481ccf63c357d547b680508f454970f55972d31362e3c86704d6f1bbc9d7108895217818a57a4e3cce9bcc08874688395634ab28f1e155b68437d4e2dcbc28eebcee23ba6f9e1c3e39b1751564b2bc7f2d4954ec17d62202cad60854d1a4640e33de335534559d1ed53df515c08c9aa67278dea0d1a3d888e8e945c1ddcbf552ca7e6f3391b0b8ba00afa71966e88fab7329bf97596ae9c1d42fd56c9ba5daf140645bbabf1ccf6de3b46a14e3251d80024cea6afb5360dc9218343071677d1c9ee32031b879707f236b5652beef8c4fb8cfdd2dbe57647be7b8f3410c4feafd336bf5d210332dc02347cf18f495acab72ce689038f3b41dc8e5365716e280feba20c7a9cf99d08e4e25baa5e285973578291c7cda97ae9b7493ce49eec4d62488c3a2cbf4eae9e8fdb5a55294e9e4446e4d9a833e59e16cefd592be8871513bc0599bbc2e0faecf92b1292fea2130be57d7ae982e96452b853c07e80f4fa478e74dee239a05dcda6b7f22a953db90f72322ec9b7ede069c9095ed730d2967bced96cf096bf3c3c379f3cc2760640384f65e5181c1d35887c779c3c8c9d8b0613efcaa89b7dadfc11b9fe4d57acea87b3f505edc2e8811ad8e7e7c8a47fbf8f5d744a74350b6cf81f0ef72a89546985b1080070e025648ef34c05d448d5881c323013cec4f153fb9fa74720b28f001daaab2eb40abfaf82e076437dff518ddb07798440fa40957af4b3abfe949b64b5e8db710b89258dbb08ed37cd1e354feded9643a43d2a5da119b8a7724261ba9666d38863fe195604b699093ea6e5cf586164c7aba6d3dc8a8a94a579f589e4d3720480c960b28bf409b4c39c37fb3a978cb174b71fff3ddfbabd5bb4d3170350debba615107526cd1a15d2aec8064543618ab3b8205bd0ad5386cae64c99562bdf188bfc0fab1ba580b4ee6a8d39942b0631a08c12fee0192494c9f288b7657ddaa93e8b25fe9ed9a9723f4b689eedcec5972b59321bba6f6db83844d16d2927b6eb5e578f7394fb87b36b150749a9962d97fc3a8cebb00499eebd9c43d1d0404fcd2a8864738e703e9cfd11db103f1523f067d9a5d7b58dbd271792af512a8effd52034f6304d5e9b77f7b3140b6c2da41bde8c93212c80f1bd5263bb16fa4a7aea681f89b4721b1da9edb73641108dcd2630aa6630f55939338b988700b0868448edcb3be115b919ddfa16e71d99cf757e7f1cc2febb70d7645f22c4916e91191e7941609ae9f528f6a2f9a120794cdd19e76563be14b6a8746bfcfc664b8c273b32e79ebf729faaacb1b26e61ac123178d44edc0a9815d09347ed0ca1447aa9811b23757650996ce41249e783fef3f1b98b772b83cb45909c9cd48822ae5f01f360e34713858378cb90691767e9f70022dcf516ccb0cb9bc476e11b4881f8fb12b01957c2732d7c352b4a3aced8e4301975c506116fa02a3cea55bec698f20b29dd2ac126f18e74a5f0bc116fe087034a4a554062296d6c93a280077d911e36a58bbeb1f7af20ccf7929b3944332c7b8db82d10dcb011c365c9a047375ebb39fbda3b6915b3d6cf7cb08aea15dbb7000888e70cd05c096cc5db8eb24bd381aae68a084150b9c45e0e317d57147e5b285dc2b76bbd3c02aecf68e55a5cb7e020657ce57fbac3ca4fb2b311e2ccbeacf0efe7d8ba7b49fc344f25a73c52351f16b142340168ffa1c9932f7ee84638d12c1e383a23b3550b56c799e561ebd3ddae97ce9bed5251e55b634a65dbce6510eab5ac813f18c1d80a42b2dd026d92c9108c1feba0327130808a2f041bb074882a9c9ec21738db97c14528b3029f4bb38d6ea49bc4a5eb1912698753f3ab955d8a368210467b955f46aceac12a3b96967361a1dac8d45eb121d7a8a9cab013beb532df18a962fc490f8a93d56d098482f9a6161ca09f4ceeaec076a4b0874c82aba1d57f121fa371fde70f60dc15a3db8d203d7e185a2ef7816379f09a1f79779c89731d296ed0aa82b172ed94525ff946907c4c6bddd95aab9b879f276bea85065010e3167413fdfdda4b3b12925343f5ddba23bacf3463da2e660dc5d522aa9d95cd0433bcd8d60529b6f41057d852efa65f99d50ca87e02f9c13b06da38b0f695fd325a0108f95ac66047cb265a8d4b1c9c4a40b1b76c85bbf5203faf80c442e4dafbf5384741c3c7773ba55f2b1d0a45c0143868d1487cd38f103600923d6c19e6d01e90ea7bb5af3e1075a10b9651ea1aca24cbff0d2ad6160229143396b94f56b8a678a0f97697b9c3f24ca90fd1654b37da1d90787e3ad4cda345edb59b6f6b1c2e103f772a9916356b487a58ac89cb97a504ad1716eea420cfbd9ca625d8767de142c79b8b23e4806d2c3daf1c28482514d98f9da1144dab31c77edb87febd8d291bef9cbf753ccfd786262380e08b79f9ca4ae379ae653650ee4a534b7ec5c7f316d9a129b6bd18599857cc91289d0f54ec8037e537a70e088fb300afb15dcb57110f564d6ade1b97bebb5816737b7cec1ecb58ac0ed842138ad34a7c33f557c68aaeecbcab63317374ce96758419db64f4da11d5f3466082dd30573b437fe4c78d73280f15b9f0fb0ade40d53bb5d3236f7645df00141adedab1f54bfd6b59e2e5a40950dcb41970bcdd4323d83bf7ea17a92083a59bd47466d5d3ac7027636fb6b552bea7eed66ceff87b23400b30c2192a51e0b2ec09e000a6048e2f9a12133b63f4c401afce5b66531008c7b23f5140f3e97333cdaf3181eaf2e2fc40f28811229e2735e9bab4b54a78819d1b5e2c760a9e5d351aec572308d1c555609e999c3b48cb880e414bf4c9d87488fdde21220e5a05a2a65737d20ff3560445c67e259602e857243b606888f9902bfec8a9306bbbf2d50a05878143c2a8265692f0001bc932f849ead566cdc9283756b027faee881a22b82806951f6c2c43884c983dcbe03a8be756b75a2f20fd9bdc55f0700b7521d050bfcb34bbd5d5d26d10d42b69d00b3f48df413867fd12e748ac0a995129c545fdf3c8f0801f28fdd4303032596ce8fbe040349f83df186d8560cb40fe31264db724d7fe2c64950a1129c0ac95df001fc261abec96f7efa9f9bedd12498ecbda03d9e28efc0d5f5f8059b7f13969802df7bffbda90bc582e331a0f1889a1d8fc038dffa26ae5e8edba496e6bed3437746a8535d17bb55a91ed05a346b351366fa9defee89aefb1ea06de20e9bd997ee923138375822c1b9e2a5a9f0dc2381635025503df430ff74eb927e499cd2a312ea5e18bada5c3a334a0505c3be39578982e99d820ba1947edfe4ac6009b173fd83b12c05d62b094", 0x1000, 0x0, &(0x7f00000001c0)=@file={0x0, './file0\x00'}, 0x6e) 19:17:43 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r0, 0x29, 0x41, &(0x7f0000000040)=ANY=[@ANYBLOB="6e617400000400000000000000000000000000000000000000b0d40a40da22a366feeece00000000000000dc5f9f67fbdddb36eabb02000008000000000000000000000000000000"], 0x48) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x400, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x7ba27d3a) read(r1, &(0x7f0000000200)=""/250, 0x29e4ba6b) [ 1024.143351] binder: 5338:5357 transaction failed 29189/-3, size 24-8 line 3255 [ 1024.143653] binder: undelivered TRANSACTION_ERROR: 29189 [ 1024.143753] binder: send failed reply for transaction 1422 to 5338:5344 19:17:43 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1024.143800] binder: undelivered TRANSACTION_COMPLETE 19:17:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 19:17:43 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) r2 = accept(0xffffffffffffff9c, 0x0, &(0x7f00000000c0)) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000180)='nbd\x00') sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="070000005f3b22929f8f4f3e9f750a28b5fc9e4ead55729bfada785a6ef595f937cafd2616a3ad275e2d05ee9feb003fdce9d6d5c081f60390a9d9bb2f328d5e163c673dcd5bf10d3e", @ANYRES16=r3, @ANYBLOB="02012abd7000fcdbdf25020000000c00020000000000000000000c00080001000000000000000c00030009000000000000000c0006000300000000000000"], 0x44}, 0x1, 0x0, 0x0, 0x85}, 0x4000015) creat(&(0x7f00000002c0)='./file0\x00', 0x4) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) sendfile(r1, r1, &(0x7f0000000040), 0x3) [ 1024.143805] binder: undelivered TRANSACTION_ERROR: 29189 19:17:43 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000040)) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:43 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0x2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)=r2) [ 1024.318304] binder: 5390:5393 unknown command 0 [ 1024.337224] binder: 5390:5393 ioctl c0306201 200001c0 returned -22 [ 1024.359498] binder_alloc: binder_alloc_mmap_handler: 5390 20001000-20004000 already mapped failed -16 [ 1024.381735] binder: BINDER_SET_CONTEXT_MGR already set [ 1024.391322] binder: 5390:5393 ioctl 40046207 0 returned -16 [ 1024.402212] binder_alloc: 5390: binder_alloc_buf, no vma [ 1024.402233] binder: 5390:5402 transaction failed 29189/-3, size 24-8 line 3255 [ 1024.402635] binder: undelivered TRANSACTION_ERROR: 29189 [ 1024.402681] binder: send failed reply for transaction 1427 to 5390:5393 [ 1024.402714] binder: undelivered TRANSACTION_COMPLETE [ 1024.402721] binder: undelivered TRANSACTION_ERROR: 29189 19:17:43 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x1010, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r3, &(0x7f00000001c0), 0x7ba27d3a) read(r2, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:43 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = accept$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000140), &(0x7f0000000180)=0xc) r3 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r3, 0x0, 0x2000424, 0x1) write(r3, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r3, r3, &(0x7f0000001000), 0xfec) r4 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/policy\x00', 0x0, 0x0) r5 = syz_genetlink_get_family_id$team(&(0x7f0000000240)='team\x00') sendmsg$TEAM_CMD_OPTIONS_SET(r4, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x10004001}, 0xc, &(0x7f0000000280)={&(0x7f0000001040)={0x820, r5, 0x20, 0x70bd2d, 0x25dfdbfe, {}, [{{0x8, 0x1, r2}, {0x1a4, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x7f}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r2}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x1}}}, {0x3c, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0xc, 0x4, 'random\x00'}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'broadcast\x00'}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x1ad3}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r2}}}]}}, {{0x8, 0x1, r2}, {0xb4, 0x2, [{0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0xe109}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x2}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8}}}]}}, {{0x8, 0x1, r2}, {0xac, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0xba2}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x3de}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x208}}}]}}, {{0x8, 0x1, r2}, {0x128, 0x2, [{0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0xda8}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r2}}}, {0x3c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0xc, 0x4, [{0x1, 0x8, 0xfffffffffffffffa, 0x80}]}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x5}}}]}}, {{0x8, 0x1, r2}, {0x180, 0x2, [{0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r2}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r2}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x3}}, {0x8, 0x6, r2}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r2}}}]}}, {{0x8, 0x1, r2}, {0x40, 0x2, [{0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}, {{0x8, 0x1, r2}, {0x1e8, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x101}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0xa80}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r2}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r2}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x100000001}}, {0x8, 0x6, r2}}}, {0x74, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x44, 0x4, [{0xffff, 0x3, 0x100000000, 0x3a}, {0x1, 0xd1d0, 0x46, 0x6}, {0x8, 0xd733, 0x8, 0x5}, {0x2, 0x8000, 0x57, 0x180000000}, {0x81, 0x6, 0x10000, 0x3}, {0x800, 0x57a, 0x6, 0x3}, {0x824, 0x1, 0x2, 0x3}, {0x99, 0x3, 0x2, 0x20}]}}}, {0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x14, 0x4, 'activebackup\x00'}}}]}}]}, 0x820}, 0x1, 0x0, 0x0, 0x8000}, 0x4080) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r3, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:43 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) prctl$PR_GET_FP_MODE(0x2e) 19:17:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x1, 0x400) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000080)={0x5, &(0x7f0000000040)=[{0x3, 0x1ff, 0x8, 0x5}, {0xb193, 0x4828, 0x20, 0x1ff}, {0xfff, 0x3, 0x9, 0x1}, {0x89, 0x1, 0x1f, 0x4}, {0x0, 0x1, 0x1ff, 0x1}]}, 0x10) fcntl$F_SET_RW_HINT(r1, 0x40c, &(0x7f00000000c0)=0x4) 19:17:43 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r0, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1024.643934] binder: 5418:5423 Release 1 refcount change on invalid ref 0 ret -22 [ 1024.656035] binder_alloc: binder_alloc_mmap_handler: 5418 20001000-20004000 already mapped failed -16 [ 1024.681554] binder: BINDER_SET_CONTEXT_MGR already set [ 1024.687848] binder: 5418:5423 ioctl 40046207 0 returned -16 19:17:43 executing program 5: pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000140)={{{@in6, @in=@initdev}}, {{@in=@remote}, 0x0, @in6=@empty}}, &(0x7f00000000c0)=0xe8) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0xffffffffffffffff}) r3 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r3, 0x0, 0x2000424, 0x1) socket$inet_udp(0x2, 0x2, 0x0) write(r3, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r3, r3, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r3, 0x0) ioctl$TUNSETSTEERINGEBPF(r2, 0x400454d1, &(0x7f0000000080)) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r1, 0xc0505405, &(0x7f0000000240)={{0x1, 0x2, 0x401, 0x3, 0x2}, 0xa907, 0x478, 0xcd}) [ 1024.694271] binder_alloc: 5418: binder_alloc_buf, no vma [ 1024.694290] binder: 5418:5428 transaction failed 29189/-3, size 24-8 line 3255 [ 1024.702808] binder: 5418:5432 Release 1 refcount change on invalid ref 0 ret -22 [ 1024.709180] binder: undelivered TRANSACTION_ERROR: 29189 [ 1024.709227] binder: send failed reply for transaction 1432 to 5418:5423 [ 1024.709263] binder: undelivered TRANSACTION_COMPLETE [ 1024.709269] binder: undelivered TRANSACTION_ERROR: 29189 19:17:44 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0x7ba27d3a) read(r0, &(0x7f0000000200)=""/250, 0x29e4ba6b) read$eventfd(r1, &(0x7f0000000000), 0x8) 19:17:44 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0) write$P9_RSTAT(r2, &(0x7f0000000140)={0xc5, 0x7d, 0x1, {0x0, 0xbe, 0x1, 0x7, {0x1, 0x2, 0x5}, 0x9100000, 0x7, 0x1, 0x2, 0xd, '/dev/net/tun\x00', 0x0, '', 0x3f, '\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x3f, '\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f'}}, 0xc5) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x440000000000, 0x1c985b5f45a623fe, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) 19:17:44 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x800, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$TIOCSWINSZ(r2, 0x5414, &(0x7f00000000c0)={0x9, 0x1, 0xfffffffff8dab421, 0x2}) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:44 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r0) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r4, &(0x7f00000001c0), 0x7ba27d3a) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:44 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f00000002c0)={0x2, 0x8, 0x38d, 0x6, 0x5}) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) ioctl$TIOCGWINSZ(r1, 0x5413, &(0x7f00000000c0)) r2 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r2, 0x0, 0x2000424, 0x1) write(r2, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r2, r2, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) memfd_create(&(0x7f0000000140)='/dev/net/tun\x00', 0x2) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_NAME_TABLE(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x30, r3, 0x200, 0x70bd2b, 0x25dfdbff, {{}, 0x0, 0x5, 0x0, {0x14, 0x19, {0x20, 0x7, 0x1f, 0x10001}}}, ["", "", "", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x4000040}, 0x10) [ 1025.176671] binder_alloc: 5448: binder_alloc_buf, no vma [ 1025.190493] binder: 5448:5452 transaction failed 29189/-3, size 24-8 line 3255 [ 1025.204837] binder: 5448:5452 Release 1 refcount change on invalid ref 0 ret -22 19:17:44 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1025.231503] binder: BINDER_SET_CONTEXT_MGR already set [ 1025.237071] binder: 5448:5452 ioctl 40046207 0 returned -16 19:17:44 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x4040, 0x2) openat(r2, &(0x7f00000000c0)='./file0\x00', 0x8000, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1025.237096] binder_alloc: 5448: binder_alloc_buf, no vma [ 1025.237116] binder: 5448:5459 transaction failed 29189/-3, size 24-8 line 3255 [ 1025.243160] binder: undelivered TRANSACTION_ERROR: 29189 19:17:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) write(r1, &(0x7f0000000540)="f0cce55c88699c5c603f7bde78a23cc329c9c951e76d265261a2226c25fc46313a1be2fc23a56b37cf4f9878b638e1e8df98235278c2c965f6e97e512037902d5796f2bff0a02cd341cdcd327468a86bf89f8e87f1ff542875746221187c086724c924a5ab09295fb2204a0479611d807886467a3a9a5f4d5a27c9dacc42d687d09091b6790d3fa5a930a7efe625215c11048edd22f733c02bd331e4df4c4e86ebe83c3548a8a463b39cd4b9f4e3be9fb3ad08790b50e7896da7947882bdc5ae04659484d1a2b9b3a60f3499291cddd519e9f40e64a6b5be05ea6894ead3d81100551d7037c4eaab022f4fcfa36e9be526e54677306129f7143b54903dc66ee824ef88f1288feb7c2345d571e326722d5f859ded1d09920210555a2e3bea6474be9f48b28d3bac6b3c39f8fc0aa0e838dae844c3e9e3bc62ffee5e63fed60dd1ed46a5e5026ca902a4a5dfa85928948dbdcbb436f0ea8759941a04405d6f49ce24edf0624d1889149288bc0b725ca29c4828fc9a949d6a9b749e4ac0b9c13b5ddb596ca9f3dd6dd7149654c09ef7bb4553931f7c136730cefc3cf24e5f44224b38b20e3cfbe70e2888fc08188a36e8dcaedb84a68a728649afa7eafe4274e841e824fa5a17b5b7c342caf946e1eee48430c191e709ab07608c6517d67bc87f3ad60d21a6a78cd50295e814ac6ea395448036f7b89d6a312f7115f053b14177896086cec2d28506a6f93c9477adfbf3b8ae34381c1e0ad1ad074c256b2d656cc92969f165b91f9a14f3d00462dc9a08ab8038c9ea1f7e5fbc559a7ad9c1e61d375412e0d0e60d9dde19f8a28832be3dfa0a0660fd0ed12ad96679d4905ce578845aa2283ca08d47e7990ff97ce399337297ee3ed8d0746bebb7b4f5e208b88edcb72a251f3f00d439eb0d1600f99ba91bf5fface56cbc4364c193e775f82e2513db46520f1d403a729bca6f66b608af1beac739ff3c4f0f839ceb1d2095929e0ca6d28130b0b4d13869f9ac63605ff461c72f9f34f4770211eb0ba5c588b876b415c1770bf54851b1913355fefc9d24913e64ea449edb4d00d6c7cdf3f8bc29812cbd6c406041cde5cc46cfe4376fe02b3768ffd913ba0f744d8db5173572aaf71e42b80abfd8bd78bc3ce64e870b3b86b21e78560b6edea0ff5c65ef35b5ab08019ea801ae092961eba56a1d475ccc441c9b8910310f04b11a6e89e04ea0a761ea92f7898cf94e4e1f3ceab7b6ce13d80af8904645328f573cf43e3467470df112e0a0cb137cdfa724afb10082f0f068c5fcee0e02fb62d427497015d6066d97619be4af5215bfe809a03b409d8cbce2de907c42faa49ace8c9f0accd600d6d408db2a8718c563a10c59f68f7d372ee635a26c16cd1a4f46d6b4ba66259bbdd0ba34d89312624e17a83fcb43bd44fec947353e8b7225174eee8382b5431fe85d434ca0e52bac03d6fddee0582ae199d85db163f6b2e78a7c8db645115820b1c95032c3168ecb7e513e47d3970519f7dbb8af2ac2b5c7394addd413611707451193d3c520e3e17173891308d392cbfa2b3ff956456bdf399a77dbf81b5fbfe62ccaea5e5c9638b6fdeeaee537db4259559622ae16935da7559b44a7181d23973d41fb5d4965e047832841561ace6ff28e29dccac049733835429f8973e6a028457aa5ccd41c9fda7ccccad2a3d41401779ec298f2817cee2561dd3197261611178407cc1dcf428b33de851cee660a726dc247b3fafb83b11b56023bfe480b13e6115ac1ab17a2543a53edb5b301ceb7b3d06719445055c610aa90b5c372e257da109a445bcbad97b3185dea39bdf33bd3247d4cdc343a30a0c11aff75eac8ee3faadee114aa841ff476391aa5714d8178f8f066b88e91dc695de30d5c4f7bcd0c9c30ba1f0b0678ca7e32d30ffe3c9884767e1763fb31e2473b56070190bc4c26e8ab3ab78738c505e047bf308b40ea1e95cac47116a6ac048ba3c61aaa853977974f2d6def51d5649181932f2459a94a5cba5269b8438046df8d308bd07a77f42dd2dd79c972d424daacbdd0d0b3e545e004b6fee42051f4ea56ab20447b76eb0a964b24eccfca0e624c94e8663aee1b0f154d12505f9ac8281cb9833574fb844d6312c777db2ad6cb0803beef3873d9e3ff69c4a77a777c84c4038bba6f66184eb5166b5a0f3dcfb0e6d152502ec4366a8ddc3fff657b24522229c13993c744ae4e0464a298dc3df9b7aa7cac19af23e117f5af2ffacaf6a8319f3f412e1e3badd183791adca885a92827caa14e451541dbbb2d442254674e01e7162fe799dcd017634210ff07df261baf32e22a94a9d84ca2ec9e12b552bc265918503c093a5058e1533c95f7eb4b5f3acb33a161f226c111e234289cb339a5e2aa366a6a3d1d22da364a2ab7095ae861c357caa6b7ed83184859020d4cffd3c81c90b6e0b0303e604d369a1e40a3d08d86629dd00c0eb8acdf82942466520965b20bfd782f176c5eb2f397e3c2097e3788f22802256017235b3ab0106c75547be95f177eee7eb0d4856481f644475667d7a0bbe604dbe6a897e849359fade27ef8686245493d36aaac818b995aaa6f1190cbac008a8b6249ffe753b4324035b5f288c000c07ea3c20c5284351ee35de5a10ef8e1eea3c616d3cfe0ec53165eec9aacf82855af863787dadcd56cc4393aa4096ababd591cf3987d419fc8fa26919afbd1693f88b9614c71bd062c8cd6cbca66d1b5022ab7106fe519ff55ce58bb8a4701aefd22e1e11ce9adf31ae60cb4e1e7cfeee1bb3585d6672d71f26062eaf27fa3f18f62273ba0811e07ee93bf03535d7bd5757af5b077f3e39ea9e369ea370c9c14675c3b269b3058f9b6e7e6388a0bb447d5ea6ad517f573dec3503a0a07036a1c2ff73e91ecce0ed4ea1933254b9d445c5ef235aeb8a5b676e19af277ac5216a7f09a270b9467b35797ec42cae433567d555e8a49fb0c1c53c17664f24604c6304ded9d29c0db122a7f3b43f4a42bfb99e3c0e7686a87c900b9e3e7e99f10751130a4ba3270e20db09d39e8b13dc9702f92e38cc637ec5600288feefa7338d1af690c5d809630597e997fa4a23db3aaf44b567e6990473cb4af5e2b160df9850d62d4ad302b4b8d9fa87df6225dd88d17f0d9de0f253f3d15411bce23e4c880abbef81e7896d56e0c980e0f94cc1d144dc9dc0514d9b23670c314ecd7539067b625ce5b48ec0debceea081e351ed96d8e3b296d1e5bc4cc0b325cca916ff476f265f7c4a02041ad7d39abb2fd61d2a92109b31086eaefdb5ad3bee14fb5027df48d9d5382e553c4f71ab12779d9492323b5a947068e298c19a9a052f4d6e2ab8695c1bd3d3c92efde5c3faeece46e07ec916511f96371eb7e9fd3b62d53bca9e91893946ccdeb7d0d480f4abe895bf67aec174c511bb917ad5d80b8e0199f0eba6dc98d3848c286b0ab97a07ec51f385b3acb565d67eae48cbece35972bfdb36b72ef198abc147c5a970d43cd2505da74b029ea81000c38e1b5076a90ce5500e3c6771065e90214aad97a56732c4e823e05dbecb6f5d7753607be9faa909e8753d6833d518597b962fc9ae0b73e244569e1dcdfca2d050c409d42c4a97d1f876bb11d0a8a0709b7e7f13f10ab783ee357ad9a7c9b074db39fde9b95a57d05c3398431eeb00708f7caee92c135ad31d7f26e824dca75c8f26ddb849b5f86765e8a7ff1d0e336e622430190d9dcff8b298070ff97d532b071b22f9649b6f04e8a37e3cff6fec77245d698d2f802ca981908dc4e424d1284625ea83a86f611a002e7141322e0b9ce10af9aa04b9c13701c6418f8128845641548270f89e7838c508649d8f516387a1463c701c3dac22697972b5a5783128615353d7ff6e3dd9a160b186a5c5b630dbdd61a9db8a7593f8592c6523d48523f033d3ac774caabfefeec4a635c82e74f560eb6ab61dd5d3a92d2a954ecce98c24b68c128b1edb0c331a83d8f0d0a15bba4b4be936521810a3678458f2c30c9451ef803c062f473f8eaa14fcc131370765a4baeee3062c291528d158946c8633e79bbdeda6a14c614e7fcc0caca39d86196dc76f9baba38f40499b4ec0f2ca703f1559fcb2148d1757d8f77359fb716df2daa5ee294ab88997094ebf456e1eda3cd19947922ae04478da6a52fd027a0d67b7c0fcfb4604034c3b8915c19b10a45e8ba50ec94217ebff6b225d6354f1b34437288d5fb6e558a79e2ec5ad2598824f8b4377e2f16966b10b02bbfc6256f8f935d45883e803ed414032264bc77157bbb1b56d27dd14668f9f25c548b850ad8f0aed5db463aeae45939b8a0c1c46dccdc14ddec428cdb11a505c2c2dfa9e3151ce37504f5d7f28b37e1d128100d164e9c5abc2823337782edfdef56f51633deeff87359338f43f636f07d3b8309eae6ad61094e98c00149e5291053dbcb601ca17656be92a8380c7ec8d9a094f83fe4a1331f3aa337d9c060b6b7bf7717365feae395b0779a87b4cd2a2af4d1a704c97f0c45f48711b04cd3f4c6d9a45de9e46ebbac55afd0dfdc3afc28f3fa46ef93445601ab2f3ad69ebf42aa613f50972d88e94b29c994aca84067b1bcab68ff8ce77209d28becbde0c25cb1e3589acbcdfb91873080f9aeaf73ecfe6d0dd9a9d1ee3c98cc7f4f2041bc291745457546262a55bba16f914263cc12ea6edcd0e91f2117bd5ec2c9c73a6aa211adb7fa3e8130a416a0c605b272a9d15f1946f12ff84b5a626ce7d37109964f4b2e83731bd324b7f774d07d73fc15b4502c9e4756361b2abfe823df8d42e38153d9be6a5940f4630d6a2cf6fb931c8e7dfd21748dac85629e07ac426b6ab4bc57e6aaaab4e4995fc6845c24421038a546e4f0405c5458eda4f7a4eb9371561cf63d08411d5e152efb76574aa303d9e97e0ca2079c639f4c96176a75e4c6d9fbc6f32cd2a78670ba50bb65672fdb38742fb98ee754898227b56d729a092937b89d5174c1472d3645559d7d14862d75ad5108c4463d99e7900baade85403c55191cce94adaf244efe0c4c2dbf84e4fa4d8631f64fbb2ee17a414fc3ee513816f2e81fbdf8052c91a9ecb9cd1754401d57fde307401e3736672245b75c70c322d491253fb581c35590e2a0ed26a7860db8b308a599efd6ee7b8a754617e56def7108dbb2a82046e5f00506230dc3e77b9b22159d2b373555d25050f60707a198de515da60589aa90fb6694de9ecda34b86e467f4c1f8513e5588eab8d3a7300e27fc3bfa231f4c4ccb46d787e8e1c961d4577a47f228cac01e7c93365893882cea3c59d803243dd9f50b28bfa381628fb29b5aec6cb649b98ff5f3f23f288f92ef34a6d1c4473e6d17d72c07f94fd65462ad6ef8788bc7397c3adcaf2d6059223b87f566ae2aab5594e6ba7abe617a387d0c16158441f47b4fa93b87045e4426a4afc6828d7c43172ca40be36f9691a0c7af9488bd85ec9f9a7b78a58af8169dcf3a567dd30d1ac8bd98a33f660be4b020419efee8876fffed5d62f00e6864b024fdf87decbf192caa1dfa07887bb27fdadfe5ac9bc8415ea34fc7cfea482e8a8c49da0fdcac67da6c721655a97ab072f8f8984ed6fdd404f3684e6850a864f297b468db10951d0936c958682bd0bce45e549a83515a3b760cb36ab6152bc54bb5ad16e5a0331c2ecd89a88932ebaf17aae85ecd66afa99f78fdb76b2b0d361ee6994504a0504fa98013511734506035d8d324e72d189f2c110f7c179a6ba5f34ba0b5b016d7a1f534f3912652313a42a14829fd0211caf8ecab50305f853b75fe71", 0x1000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) read(r1, &(0x7f0000000000)=""/26, 0x1a) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) [ 1025.243204] binder: undelivered TRANSACTION_ERROR: 29189 19:17:44 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) fsetxattr$security_smack_entry(r0, &(0x7f0000000040)='security.SMACK64EXEC\x00', &(0x7f00000000c0)='/dev/net/tun\x00', 0xd, 0x2) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1025.400914] binder: 5478:5483 Release 1 refcount change on invalid ref 0 ret -22 19:17:44 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) r2 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x4000) ioctl$LOOP_SET_CAPACITY(r2, 0x4c07) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:44 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000000140)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x1) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x200000, 0x0) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r2, 0x54a3) ioctl$KDMKTONE(r2, 0x4b30, 0x5) getresuid(&(0x7f00000000c0), &(0x7f0000000180)=0x0, &(0x7f00000001c0)) stat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r2, r3, r4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1025.462108] binder_alloc: binder_alloc_mmap_handler: 5478 20001000-20004000 already mapped failed -16 [ 1025.499563] binder: BINDER_SET_CONTEXT_MGR already set [ 1025.505132] binder: 5478:5483 ioctl 40046207 0 returned -16 [ 1025.515694] binder_alloc: 5478: binder_alloc_buf, no vma [ 1025.515716] binder: 5478:5489 transaction failed 29189/-3, size 24-8 line 3255 [ 1025.522116] binder: undelivered TRANSACTION_ERROR: 29189 [ 1025.522176] binder: send failed reply for transaction 1440 to 5478:5483 [ 1025.522216] binder: undelivered TRANSACTION_COMPLETE [ 1025.522223] binder: undelivered TRANSACTION_ERROR: 29189 19:17:44 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) fstatfs(r0, &(0x7f0000000000)=""/194) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x7ba27d3a) read(r1, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:44 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = fcntl$dupfd(r0, 0x406, r0) fstat(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$P9_RGETATTR(r1, &(0x7f0000000240)={0xa0, 0x19, 0x1, {0x1000, {0x0, 0x2, 0x6}, 0x8, r2, r3, 0x6, 0x4, 0x8, 0x0, 0x3943, 0x800, 0x400, 0x6, 0x7, 0x1, 0x200, 0x3f, 0x3, 0x1, 0x8000}}, 0xa0) keyctl$set_reqkey_keyring(0xe, 0x5) r4 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r0, 0xfffffffffffffffc, 0x2000427, 0x1) write(r4, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r4, r4, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r4, 0x0) fsetxattr$trusted_overlay_nlink(r4, &(0x7f0000000040)='trusted.overlay.nlink\x00', &(0x7f00000000c0)={'U-'}, 0x28, 0x2) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:44 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'erspan0\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r0, 0x60, 0x20, 0x1) write(r0, &(0x7f00000009c0)='/', 0x1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = dup(r0) epoll_ctl$EPOLL_CTL_DEL(r3, 0x2, r0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f0000000040)=0x0) ptrace$pokeuser(0x6, r4, 0x3, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x12, r2, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) [ 1025.839013] binder: 5504:5507 Release 1 refcount change on invalid ref 0 ret -22 [ 1025.873111] binder_alloc: binder_alloc_mmap_handler: 5504 20001000-20004000 already mapped failed -16 [ 1025.907632] binder: BINDER_SET_CONTEXT_MGR already set [ 1025.907643] binder_alloc: 5504: binder_alloc_buf, no vma [ 1025.907662] binder: 5504:5511 transaction failed 29189/-3, size 24-8 line 3255 19:17:44 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r4, &(0x7f00000001c0), 0x7ba27d3a) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:44 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x1000, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:44 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) open$dir(&(0x7f0000000040)='./file0\x00', 0x84040, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1025.914453] binder: 5504:5516 Release 1 refcount change on invalid ref 0 ret -22 [ 1025.969155] binder: 5504:5507 ioctl 40046207 0 returned -16 [ 1025.969257] binder: undelivered TRANSACTION_ERROR: 29189 [ 1025.969323] binder: send failed reply for transaction 1445 to 5504:5507 19:17:44 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) getsockopt$netlink(r2, 0x10e, 0x9, &(0x7f0000000040)=""/44, &(0x7f00000000c0)=0x2c) ioctl$PERF_EVENT_IOC_QUERY_BPF(r2, 0xc008240a, &(0x7f0000000140)={0x9, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:44 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = creat(&(0x7f0000000040)='\x00', 0x0) setsockopt$inet_udp_encap(r2, 0x11, 0x64, &(0x7f00000000c0)=0x3, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$tun(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="00000007694f3dc103a000e1fe8000000000000000000000000000aa000000000000000000000000000000016206012300000000ff010000000000000000000000000001fe8000000000000000000000000000bbff010000000000000000000000000001ff03000000000000c2040000002e050201ffc910fe8000000000000000000000000000bb0000000085009078000000001f00800b56d922103df7f4f192e0f92e2913527b9c0269d35ffbfece9c4bdc3e70d3b41b61aeacfdfd776cb6141b6c59d3264cc28719fec920b6b958032f23018446ca54e1666146f35aa22d435b168c6f60303066dc63574024fe4765353dab4cb9e00be777055934cee4bfb40e580b931d16562da48c2ece9e074a7ebb183ca15dccaa2c5bcc490e43ff1b04318e2351cb25c9e791a0f28aae763383c29e6d32602a6fe7aa95f7e25e5e3904d0d2249f1f1dfc6929b74e4971abf26a643a3e54c146f666a9e084e22c20ec730e5e0c98a648ab3f7c50918e3feaded9aab4744a64c2d2be9b270eb08e47956e08a414b56e5662089b350d5dd3df6158a045afcc686ae27e5eb576af2610c822f6c4d24c3dbbc851d5bbd60fdd9c05edc3810b582accb91c192082c8a12666e20ec80728c32e4eaf120369f7032f6ac1617f01bfe23ff81156ce7ccc973bd916a30d092181e1165cc5d2ac38644fb5442a9e9151ac0db62ccc46b519474e72006a400c811f1ad414c16b93607f60eb8cb3ce80cb25499a7e2eba002fb960b44e115e8140875c270e1192cb03fb201a51fe290a559f536e7975a5f8b5537cc1bb0cc4ce021a77db1cc59a8d504369c39bd1d3605dc9ebe09a77cca83f3dd1a0d8dcb6d19d2a2d573e3efc207c7dca24ec26574d1e60f963c5144e648ae001b1a0ea65cf5707c4e594a1bfe634d5fc9f8914a2ac6faf4798f11dd2b91f01af1aa428f57a468705a0040c86572c6e10c1c229a573e17eb1d202fb5607263183ef6e0bd154668929532f1d5943d1571b76449e76f5b07420f23f7fe2cf47333d43e9020908f01e2df29b36a66053c6fd61412816fe08c12823869f6c02dbce6870c98af6c5da234af7051660c64dd3a72923f968a4b10a9d1a3060203d17a552828088ed91d2015b4ec7cc5b941afaa7e0768ab7097925e51b40608243e09c4714ac42340e95fe5c6990792e7543242a0999d0501ec500c0f504ee801ab606635f5e4831c87f170b5f796f0a5c8e82ad26a6b6735f2882252a282043007301b552214162e0efad09131d1ea0796fd7fe06f92489974295efbd833152db6885642c31c52d999d2fc03a5b41f4862c2ea2ba5b9cc77f7c9f68edc6410a47ba7637"], 0x3cc) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x2) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$KDGKBDIACR(r2, 0x4b4a, &(0x7f0000000040)=""/166) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) 19:17:44 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x101c00, 0x0) ioctl$TUNSETFILTEREBPF(r0, 0x800454e1, &(0x7f00000000c0)=r2) write(r1, &(0x7f0000000180)='/', 0x1) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PIO_UNIMAPCLR(r3, 0x4b68, &(0x7f0000000140)={0x1, 0xd4d4, 0x2}) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1025.969377] binder: undelivered TRANSACTION_COMPLETE [ 1025.969384] binder: undelivered TRANSACTION_ERROR: 29189 19:17:44 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f0000000880)=@nat={'nat\x00', 0x19, 0x4, 0x718, [0x20000140, 0x0, 0x0, 0x20000170, 0x200002b8], 0x0, &(0x7f0000000040), &(0x7f0000000140)=[{0x0, '\x00', 0x0, 0xfffffffffffffffc}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x9, 0x1, 0x0, 'veth1_to_bridge\x00', 'sit0\x00', 'veth0_to_bridge\x00', 'gretap0\x00', @remote, [0xff, 0x0, 0xff, 0x0, 0xff], @remote, [0x0, 0xff, 0x4189f4909eeb9685, 0xff, 0xff, 0xff], 0x70, 0xe0, 0x118}, [@common=@dnat={'dnat\x00', 0x10, {{@remote, 0xfffffffffffffffd}}}, @arpreply={'arpreply\x00', 0x10, {{@dev={[], 0x28}, 0xfffffffffffffffd}}}]}, @arpreply={'arpreply\x00', 0x10, {{@random="2b57e0bd96dc", 0xfffffffffffffffc}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x3, 0x1, 0x6007, 'ip6tnl0\x00', 'tunl0\x00', 'bond_slave_1\x00', 'ipddp0\x00', @broadcast, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], @broadcast, [0x0, 0x0, 0xff, 0xff, 0xff], 0xf0, 0x158, 0x190, [@statistic={'statistic\x00', 0x18, {{0x1, 0x0, 0x80000000, 0x5, 0x7fff, 0x400}}}, @connbytes={'connbytes\x00', 0x18, {{0x7, 0xfffffffffffffffe, 0x0, 0x2}}}]}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x8, {{0x800000000000}}}, @snat={'snat\x00', 0x10, {{@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0x10, {{@random="8ff56107e4f3", 0xfffffffffffffffe}}}}]}, {0x0, '\x00', 0x2, 0x0, 0x2, [{{{0xb, 0x8, 0x88f7, 'caif0\x00', 'erspan0\x00', 'bcsf0\x00', 'bcsh0\x00', @remote, [0xff, 0xff, 0x0, 0xff, 0x0, 0xff], @local, [0x0, 0xff, 0xff, 0xff, 0xff, 0xff], 0x70, 0x1a0, 0x1d8}, [@common=@SECMARK={'SECMARK\x00', 0x108, {{0x1, 0xfffffffffffffff8, 'system_u:object_r:ppp_device_t:s0\x00'}}}]}, @arpreply={'arpreply\x00', 0x10, {{@empty, 0xfffffffffffffffe}}}}, {{{0x0, 0x3a, 0xa00, 'gretap0\x00', 'erspan0\x00', 'ip6tnl0\x00', 'vxcan1\x00', @dev={[], 0x20}, [0xff, 0x0, 0x0, 0x0, 0xff], @empty, [0x0, 0x0, 0xff, 0x0, 0xff], 0x130, 0x1a0, 0x1d8, [@rateest={'rateest\x00', 0x48, {{'veth0\x00', 'tunl0\x00', 0x8, 0x1, 0x1, 0x80, 0x2, 0xea2, 0x8000, 0x9}}}, @nfacct={'nfacct\x00', 0x28, {{'syz0\x00', 0xa90e}}}]}, [@common=@mark={'mark\x00', 0x10, {{0xfffffff0, 0xfffffffffffffffe}}}, @arpreply={'arpreply\x00', 0x10, {{@empty, 0xfffffffffffffffe}}}]}, @arpreply={'arpreply\x00', 0x10, {{@link_local, 0xfffffffffffffffc}}}}]}]}, 0x790) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1026.089560] binder: 5534:5541 Release 1 refcount change on invalid ref 0 ret -22 [ 1026.145840] binder_alloc: binder_alloc_mmap_handler: 5534 20001000-20004000 already mapped failed -16 [ 1026.174826] binder: BINDER_SET_CONTEXT_MGR already set [ 1026.180660] binder: 5534:5541 ioctl 40046207 0 returned -16 [ 1026.195412] binder_alloc: 5534: binder_alloc_buf, no vma [ 1026.195434] binder: 5534:5548 transaction failed 29189/-3, size 24-8 line 3255 [ 1026.195758] binder: undelivered TRANSACTION_ERROR: 29189 [ 1026.195803] binder: send failed reply for transaction 1450 to 5534:5541 [ 1026.195860] binder: undelivered TRANSACTION_COMPLETE [ 1026.195866] binder: undelivered TRANSACTION_ERROR: 29189 19:17:45 executing program 3: perf_event_open(&(0x7f000001d000)={0x7, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc182}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x210040, 0x1cd) ioctl$TUNGETVNETHDRSZ(r0, 0x800454d7, &(0x7f0000000080)) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x7ba27d3a) read(r1, &(0x7f0000000200)=""/250, 0x29e4ba6b) openat$cgroup(r2, &(0x7f0000000000)='syz1\x00', 0x200002, 0x0) 19:17:45 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:45 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(r1, 0x40086607, &(0x7f0000000040)=0x2) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:45 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) 19:17:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x8000, 0x0) ioctl$TUNSETSNDBUF(r2, 0x400454d4, &(0x7f0000000040)=0x3f) open$dir(&(0x7f0000000080)='./file0\x00', 0x3, 0x4) 19:17:45 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) openat$cgroup_type(r2, &(0x7f0000000300)='cgroup.type\x00', 0x2, 0x0) clone(0x80000000, &(0x7f0000000000)="75e29e5bda976faba8912617cd6666a94ed8adc5fc1d0accfa4c16c5f29dfc68cb1a922f522e8ae3899147", &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)="717ec62142a7492fe96f302b6482edebb5215d8f596a0d07d0a3054ee6021aa8b0cdfad69a7b5fbf2a478c6eb66a379c55be7f12a8e6fbbb62d663878872d110284d2a377e5992b9362f5df6e1d1f186fd77dc192822bb8f4d52688c4804115187e91bf9dddf84401550f485be7a074043927121b0adab3a1f") mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r4, &(0x7f00000001c0), 0x7ba27d3a) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:45 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r2 = dup3(r1, r0, 0x80000) r3 = accept(r2, &(0x7f0000000140)=@un=@abs, &(0x7f0000000300)=0xffffff2d) getpeername$packet(0xffffffffffffff9c, &(0x7f0000000240)={0x11, 0x0, 0x0}, &(0x7f0000000280)=0x14) setsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f00000002c0)={r4, @multicast1, @broadcast}, 0xc) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1026.463057] binder: 5557:5565 Release 1 refcount change on invalid ref 0 ret -22 19:17:45 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) timerfd_gettime(r0, &(0x7f0000000040)) 19:17:45 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r0, 0x4, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1026.509323] binder_alloc: binder_alloc_mmap_handler: 5557 20001000-20004000 already mapped failed -16 19:17:45 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) ioctl$PIO_FONT(r3, 0x4b61, &(0x7f00000000c0)="f1878f608df70a50fc1663d1f48950d240dbc33d314f1b48bb2feb35e6ef933b8c57851fb6dcfd44e53ccfe16706e489a8b862cabf") sendfile(r1, r2, &(0x7f0000001000), 0xfec) ioctl$TIOCNXCL(r2, 0x540d) ioctl$BLKRAGET(r3, 0x1263, &(0x7f0000000140)) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1026.543845] binder: BINDER_SET_CONTEXT_MGR already set [ 1026.543855] binder: 5557:5565 ioctl 40046207 0 returned -16 [ 1026.605357] binder_alloc: 5557: binder_alloc_buf, no vma [ 1026.633036] binder: 5557:5590 transaction failed 29189/-3, size 24-8 line 3255 [ 1026.654038] binder: 5557:5565 Release 1 refcount change on invalid ref 0 ret -22 [ 1026.673287] binder: send failed reply for transaction 1455 to 5557:5565 19:17:45 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r0, &(0x7f0000000240)='\x00', 0xfffffffffffffd05) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) r3 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) write$P9_RSTATFS(r3, &(0x7f00000001c0)={0x43, 0x9, 0x2, {0xb54, 0x1, 0xb4, 0x3, 0x80000000, 0x4, 0x1, 0x1, 0x101}}, 0x43) r4 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000140)={0x0, 0x70, 0x9, 0x9, 0x2, 0x7, 0x0, 0x6, 0x10000, 0x8, 0x15c4, 0x1, 0x7fffffff, 0xc00000000000000, 0x0, 0x1ff, 0x0, 0x8, 0x1, 0x9d, 0x4, 0x8, 0x1, 0x5, 0x1, 0x4, 0x3, 0x43b, 0x1bd3, 0x5, 0x1000, 0x798000000, 0x553a, 0x3, 0xffff, 0x40, 0x8, 0x2d6800000, 0x0, 0x1, 0x4, @perf_config_ext={0x3c1b, 0x3}, 0x200, 0x153, 0x509, 0x7, 0x100000000, 0xfffffffffffffffc, 0x200}, r4, 0xd, r2, 0xf) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1026.673324] binder: undelivered TRANSACTION_COMPLETE 19:17:45 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f00000000c0)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x4) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) ppoll(&(0x7f00000002c0)=[{r1}, {r2, 0x4}, {r2, 0xe209}, {r2, 0x400}], 0x4, &(0x7f0000000300)={0x77359400}, &(0x7f0000000340)={0x4}, 0x8) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) r3 = add_key(&(0x7f0000000180)='encrypted\x00', &(0x7f00000001c0)={'syz', 0x1}, &(0x7f0000000200)="ddb6e6c1fc31b93e763e3a7efedc0b1d25763b8b35e4e5e5061c8130e20d6d56b2d352d4353c43e1df18dfaa332ea4d98fa49a90b7bed7811d14f06e86797d1ad9a9ddb760f2239f60dd2b1220e8b0219272da4b218e37c2c6bf774e5703c0b1287b8279b7dda97cfa6d92cbcb5c0550aac1c10fcb6b7e6a7691a0009859dab73d", 0x81, 0xfffffffffffffffe) add_key(&(0x7f0000000040)='user\x00', &(0x7f0000000140)={'syz', 0x2}, 0x0, 0x0, r3) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1026.673331] binder: undelivered TRANSACTION_ERROR: 29189 [ 1026.834784] binder: undelivered TRANSACTION_ERROR: 29189 19:17:46 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = dup2(r1, r1) ioctl$UI_SET_SNDBIT(r2, 0x4004556a, 0x7) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:46 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) r2 = openat$cgroup_ro(r0, &(0x7f0000000040)='cpuacct.usage_user\x00', 0x0, 0x0) write$P9_RRENAMEAT(r2, &(0x7f00000000c0)={0x7, 0x4b, 0x2}, 0x7) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socket$nl_generic(0x10, 0x3, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) 19:17:46 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'n\x00', 0x5}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) fsetxattr$trusted_overlay_nlink(r0, &(0x7f0000000000)='trusted.overlay.nlink\x00', &(0x7f0000000040)={'L-', 0x2}, 0x28, 0x2) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:46 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000c00)=@mangle={'mangle\x00', 0x1f, 0x6, 0x510, 0x0, 0x3b0, 0x2c0, 0x2c0, 0x2c0, 0x478, 0x478, 0x478, 0x478, 0x478, 0x6, &(0x7f0000000100), {[{{@ip={@initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, 0xff, 0xffffffff, 'bond_slave_0\x00', 'netdevsim0\x00', {}, {0xff}, 0xff, 0x1}, 0x0, 0xc0, 0xf0, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0xe}}]}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x6, 0x6, @local, 0x4e23}}}, {{@ip={@multicast1, @multicast2, 0x0, 0xffffff00, 'veth1\x00', 'eql\x00', {0xff}, {}, 0x89, 0x2, 0x20}, 0x0, 0x98, 0xc0}, @TTL={0x28, 'TTL\x00', 0x0, {0x3}}}, {{@uncond, 0x0, 0xe8, 0x110, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00'}, @common=@ttl={0x28, 'ttl\x00', 0x0, {0x1, 0x2}}]}, @TTL={0x28, 'TTL\x00', 0x0, {0x0, 0x616}}}, {{@ip={@broadcast, @multicast2, 0xffffffff, 0xffffffff, 'sit0\x00', 'sit0\x00', {}, {}, 0x4, 0x1, 0xd}, 0x0, 0xc0, 0xf0, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x5}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0x7, 0x100000001, 0x1}, {0x100000000, 0x6, 0x1}, 0x0, 0xda2}}}, {{@ip={@loopback, @multicast1, 0xffffffff, 0xff, 'syz_tun\x00', 'ifb0\x00', {}, {0xff}, 0x0, 0x2, 0x40}, 0x0, 0x98, 0xc8}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0xfff, 0x4064, @multicast2, 0x4e24}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x570) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r4, &(0x7f00000001c0), 0x7ba27d3a) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:46 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = dup3(r0, r1, 0x80000) ioctl$IOC_PR_PREEMPT_ABORT(r2, 0x401870cc, &(0x7f0000000000)={0x2, 0x100000001, 0x56f3, 0x4}) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0x7ba27d3a) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r0, 0x6612) 19:17:46 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x52, r0, 0x20000) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:46 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) getresuid(&(0x7f0000000140), &(0x7f0000000180)=0x0, &(0x7f00000001c0)) r2 = getegid() lchown(&(0x7f00000000c0)='./file0\x00', r1, r2) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000200)='NET_DM\x00') r3 = memfd_create(&(0x7f0000000300)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4X\x97*\x80N\x12\x9b\x1f\t\xbd`*\b\xb2\xe5K\x19\xa9\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9cV\xb6\xc5\xce\xbf|\x055q\xf7kg\x86x\x1c\x9f\x84\x195\xde', 0x6) fallocate(r3, 0x0, 0x2000424, 0x1) write(r3, &(0x7f0000000240)='\x00', 0xfffffffffffffee7) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fgetxattr(r0, &(0x7f0000000280)=@random={'btrfs.', '/dev/net/tun\x00'}, &(0x7f00000002c0)=""/47, 0x2f) sendfile(r3, r3, &(0x7f0000001000), 0xfec) ioctl$EXT4_IOC_MOVE_EXT(r3, 0xc028660f, &(0x7f0000000040)={0x0, r4, 0x0, 0x82a, 0xc853}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r3, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1027.307257] binder: 5618:5624 Release 1 refcount change on invalid ref 0 ret -22 [ 1027.333461] binder_alloc: binder_alloc_mmap_handler: 5618 20001000-20004000 already mapped failed -16 19:17:46 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000300)={&(0x7f0000000140), 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="ec000000", @ANYRES16=r2, @ANYBLOB="000125bd7000fbdbdf250e0000000800050001000000080005004d8900004c000200080007000700000008000b000a000000080005000000000014000100e000000200000000000000000000000014000100ac1e0101000000000000000000000000080003000300000048000100080002001900000008000200a7000000080005000200000008000b0074697000080009001e000000080009003000000014000300fe8000000000000000000000000000aa240002000800090008000000080002004e230000080009000900000008000400fffeffff08000500ff00000008000500fffbffff"], 0xec}, 0x1, 0x0, 0x0, 0x4000}, 0x41) fallocate(0xffffffffffffffff, 0x0, 0x2000424, 0x1) openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000340)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write(0xffffffffffffffff, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TCSETAF(r3, 0x5408, &(0x7f00000000c0)={0xfffffffffffffffd, 0xffff, 0x0, 0x1, 0x14, 0xffff, 0xffff, 0x7, 0x1, 0x1}) [ 1027.353007] binder: BINDER_SET_CONTEXT_MGR already set [ 1027.358866] binder: 5618:5624 ioctl 40046207 0 returned -16 [ 1027.365760] binder_alloc: 5618: binder_alloc_buf, no vma [ 1027.365781] binder: 5618:5630 transaction failed 29189/-3, size 24-8 line 3255 [ 1027.379777] binder: 5618:5639 Release 1 refcount change on invalid ref 0 ret -22 [ 1027.386307] binder: undelivered TRANSACTION_ERROR: 29189 [ 1027.386359] binder: send failed reply for transaction 1460 to 5618:5624 19:17:46 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x2, 0x2000424, 0x1) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x0, 0x0) ioctl$TIOCGSOFTCAR(r2, 0x5419, &(0x7f00000000c0)) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:46 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000000040), 0xfec) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x40000, 0x40) ioctl$sock_inet_SIOCSIFNETMASK(r2, 0x891c, &(0x7f0000000140)={'ip6gretap0\x00', {0x2, 0x4e21, @empty}}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x802, 0x0) openat$cgroup_procs(r2, &(0x7f0000000040)='tasks\x00', 0x2, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) [ 1027.386395] binder: undelivered TRANSACTION_COMPLETE [ 1027.386401] binder: undelivered TRANSACTION_ERROR: 29189 [ 1027.504117] binder: 5654:5656 Release 1 refcount change on invalid ref 0 ret -22 [ 1027.539019] binder: BINDER_SET_CONTEXT_MGR already set [ 1027.546515] binder_alloc: 5654: binder_alloc_buf, no vma 19:17:46 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='pids.current\x00', 0x0, 0x0) write$selinux_create(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="73797374656d5f753a6f626a6563745f723a636572745f743a7330202f7573722f6c69622f74656c6570617468792f860ea544d1035da3636f6e74726f6c2d35203030303030303030303030303030303635353337202e2f66696c653000"], 0x5e) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r2 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r2, 0x0, 0x2000424, 0x1) write(r2, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r2, r2, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x400454d1, &(0x7f0000000080)) [ 1027.552518] binder: 5654:5656 ioctl 40046207 0 returned -16 19:17:46 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'veth0_to_hsr\x00', 0x400}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) r3 = dup3(r2, r0, 0x80000) ioctl$TCSETSF(r3, 0x5404, &(0x7f0000000140)={0x6, 0x4, 0x7, 0x4, 0xc, 0xf07, 0x6, 0x4000000000, 0x401, 0xfff, 0x101}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) fsetxattr(r1, &(0x7f0000000040)=@known='system.posix_acl_default\x00', &(0x7f00000000c0)=':/.vmnet0}-cpusetposix_acl_access.ppp0vboxnet0}\x00', 0x30, 0x2) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000001c0)={'vlan0\x00', 0xe001}) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1027.578708] binder: 5654:5662 transaction failed 29189/-3, size 24-8 line 3255 [ 1027.587136] binder: send failed reply for transaction 1465 to 5654:5656 [ 1027.587174] binder: undelivered TRANSACTION_COMPLETE 19:17:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$TUNSETVNETLE(r2, 0x400454dc, &(0x7f0000000040)=0x1) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x4, 0x100010, r0, 0x0) [ 1027.587181] binder: undelivered TRANSACTION_ERROR: 29189 [ 1027.657215] binder: undelivered TRANSACTION_ERROR: 29189 19:17:46 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) pwrite64(r0, &(0x7f0000000040)="f957b91db0f5", 0x6, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1027.705517] binder: 5673:5674 Release 1 refcount change on invalid ref 0 ret -22 [ 1027.719985] binder: BINDER_SET_CONTEXT_MGR already set [ 1027.726318] binder: 5673:5674 ioctl 40046207 0 returned -16 [ 1027.732863] binder_alloc: 5673: binder_alloc_buf, no vma [ 1027.732886] binder: 5673:5675 transaction failed 29189/-3, size 24-8 line 3255 [ 1027.733185] binder: 5673:5675 Release 1 refcount change on invalid ref 0 ret -22 [ 1027.735981] binder: undelivered TRANSACTION_ERROR: 29189 [ 1027.736031] binder: send failed reply for transaction 1470 to 5673:5674 [ 1027.736066] binder: undelivered TRANSACTION_COMPLETE [ 1027.736073] binder: undelivered TRANSACTION_ERROR: 29189 19:17:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x101000, 0x0) ioctl$EVIOCGBITKEY(r2, 0x80404521, &(0x7f00000000c0)=""/93) r3 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x490042) inotify_init() r4 = getpgrp(0x0) write$FUSE_LK(r3, &(0x7f0000000040)={0x28, 0xfffffffffffffffe, 0xbae, {{0x1, 0x9, 0x0, r4}}}, 0x28) setsockopt$packet_buf(r3, 0x107, 0x1, &(0x7f0000000540)="119ce29724386dd1e726ec85daa94be43dadc767c189908ee2358bfadadf0ae3045a8da388251747c18e80b9190660fcd881c47c32cd3979dd507eea615853fc825a629e67f466c302a6d83ac934c0deee232848dba067a0f1907eaa1dbec6a21d1fd53f9840c2498464dd7488db1a9e1d46c0e4132eb68eb398eb0019990dd1e5a20be6f6e37b43e2c1c0a88833a948da27ee83b0f4619473292a42467c86015764612b15330d54752dff9dc1f0726b299e9b1bfcc56e8ad3f7f47b48bddccc971fa341f0721ddda0ad90beb0822761aa87dbf50e65491b525cd66af2080ddec887ddcbdf62bebc809700e8e0fb87565dfef7efaf4454f5d6319f2c7c4b5a11e35c1a93419527c0103b7c9bb739d0ac5c2773838d582bfef7395727c77bf174e240be9260ad34e1be41bbc670d85044ccc1653e51533026ea786f16716f659daaaf98c4e7ff66501fcae94d339f72765252441ed15b2c5e4f2e5e46feb80cbf7ba98f1df3af08dec97032e0a9eaad9ceecb2cabada47b4d6bf9564025bf310ee656616178812796770c5a7ca58193aaaf976a65d1413f982307ed252d10a3fa62083bd152ada78c073996c8c74a9bbd4f27feb491fdc763ca8505b5b96791cc6df4851fb490727ffb2290b4a835f6e30f3cb7e36d6c85f4551aaa371e1e4d73a2c65d63e48d83cacbe32f5af85b109c4220981d71e56f9a12b9665aa5e44a155d5bf08694e1b01f1a9596feb4ae5f2859e9d67ffeb57fbf2509a0491503ffb75434080b43002155e8b214b54c477512a10480a95364c2a0d47003d0b48131aeea6cc7297ef6112e76b6bfe19d5e6b949f9fc41cdc2bf80761148ed77e2a4b831234e969573e2d14843cb338ef499d496c421151a7833deb14546b0cbfb3ceb2f77b6eb4d1c4eb3cdcebb2704686bb0a8fabd3932eb1fa04e6f6f6bbd5f87e15051236d2593705423ffb41b65aedee921d8b511671ba4d981c86e4b4868eecb8dc246696f553464cc7a7f98d90d305ae132ed8984d6a1f2518e622a94db507dc851b22adc6e9af68b516c2326ac866279a904a0d584622f6f3f62675d77e5d6701a34bae507f3ae5c71156274b175074b4f876ec4c036c84170e10dfbb907bf748fc2ac6f21c931f6cb6c750cc3c64a93f2f2917718d1b73b2be1c06bd5a253e997ecf5f0c11204337d559e4cc3bd78eace15b776ed2ebe85f15e23c2cf76f4ef1b93306b203eb0843ddaf46114ed7a8ab86b876c1833d244ddb647bb3e1be7f8a2bd571ffdb64fc2ccf1adbe510f89b745cbac00702ebd5b54b0224dfac2466b92870ba92950119cfd0432a5b476fd1684a30072e869555709d41406f66ad693cada844c67a9916094e678d9f342adb8308d0133a70a0b1451ee71f4cc1e2ec05748f5019750196317263c72be160b774f080f3ef0581d36fa23cf0430ec2c930d6619dbaffd229308abeedbf723bac8eff57dcab18e2046accc7108fdce4bd6839182a7dbe8267a6a8c3b915b2738b33ffdf98327810e93a17ede66e1aaf07709c920da4f457e757e1191462cef6675e329c41457bab33fc9d2fffc9175135ea9d68f0581ef2057df61496ea8c1fc838c83931bb32c21012e327c44910062bddb492fb77e3d825d66291b0c229f460830ad428d5c17c396d30a0cf5d16bfe2073b8539b61930618b752c9f824a40c3057d454ce68b9d632e5ea8c154a7cb820651b388465b9a1a9124d631890cb019ac4dff50c80365ad6b745b27416de62157f2bda1d826ad7d9df88e2ea608cc7198d808be02147ae78c272d38c0a9f766c9aac2d92af548c0ceb15996de31a0e05482ecd3570797eeb0143f457cac2a17d1f5964c30f164aaac645a57e4958bf8eb41d266959ce49a4dc952116f1c8ff9a655ada581e2e1c6fffc4a57afd4424a97bba9eb54c7eb4bde7d57f192bf35f80aaae0edc07f60734552c57b17198b052d608ab4f3c4a30a148ed5d026658368c5638e2b4e4f512fc7da34f401aeba455a07cb038892568be4f3694e0be7688edf5369e039f604b30fc6156c0a35a56cc463b3f30ba2018f776db15996f199327d3984f84fd193e041dda5b9102c4f7709bec8750b8380e8f6f59f8912488b3a4581bffe2c2dff927d8650413739085a7e11b3c5a3c3fb63c89f1c6ddacb6e859908939b53042d49b7cf528980307b5fb0fab2f05fc04ab85e10f1c8fd8b9bdc8efdc7b34ef11ea03d17a2de79a687ae20a108d1bdd1a3aac89484a619c681906d7b91ecdb9633150cb0907df2cfd304e926499dab02b651693bed8d66719e7220f95863eb26f01bd69d6b1764cd6bc4f762878b05a284cb400c635457fcd6f43f468b0873762b49b2d747ea829af0b668a4fbc1a45e388c47b4c0a20eb1b52be2ed1570f8e07aad6cfe07cb1c014fc7c07b94ae5ce52901503fc6de835c6a8f0a2c530b12fea87f868b049ce5b6bad1fab66a3f2a12e1a6c468a2eeca17572d2b9cba3f58e4a9574a87a661b306a80f4419aa94c0a8676dc21d55ad58f71c1096034a6aded32487d8f53e9eb81b8f7403de547926f0675ba86091a7304bb381b16382f84cf9dadbdd34417bd5aea4482a8d4d8fb6b39e8a15993ee44c60c8dea1de42e1f76a4e41a256c32aaee5371969753a9400557dbf3d3ae95127ea359daeab007492f4c38502c2d2cbbf0652f2f50dcdb06b8314a13015e2e7c38fe53cb98eaeb87d694c312f9a6447e9e2f4c23511ac20a45711791204e8b6071293970c154a7ca485253889910c6f7751fc4ce68bd86937e42b582ac4ef998a52fa5971a068542ebd586e5416baddf80f6198f094e147d0b508bc0d5c5b2a01681e7f3489e1b88f7c42a980f85da49d845cb134f69f42d2ae6f8d4ab3d5b1491b948862aefae38bc45b7633d88a60e2fd63e0734af7560ce0639cf5894ed590524d0cad87d7a44abad1a8394d19a1d380c2bd4079d88e7bcce1d1d17cbe54c460e8eacae98b79bdb6451c1065da761d54ba46ef54a3e6a4f3cd17e0bfc49ef61d6bd121fc108d982d9f358f90c46982a249e697619c6034dcad2195f48bcf565be3e0efbcc01ba18a2451b9d3f45c8e4b3e05dec25f6b89211315c6b3417d0d6b72613ec7fe88b6d76d1d29a382db85db167cbd55b3f67f5ad68e73761f73e115c31d463fefc48f280001f695db5467f616f1bbf92c6ef7b389997ab76a11d9cf03a1de7b9d54bdfcffbb945446dec5f21f8624304a8617c708895e419b6c5652b03f9e496798234d5cdc8c517ff2b398e25504f75d57c8b4c6abb5fab70ebc4c8d6d0dc7560955b460e927f925348b4a2348c217c701b62c609611dc3ce4b82aaded59fab9317224232c5878de715b6d702d04747e4b212423083a6513326d3a65514a3abf82b9c97aa50c1f5d7db985916fb07676377e008948952037f4b43624fb491a59e95a0fb88a56d770607dfba30e6d3d4c77ce401439ebf7b740bc5729dfe320a357d6d863b66b89def0634585dcd7785bfedd3497ab5812f5aac5bb78c528beca45ea42dfd9514542df793408b92b14f05b47a3ca3017d87d9fe34c33cf806ab1aad744e5b934defe54f3ce9139b38b9b41accf7511c07d0b4ef0588a2c9c6facef0b3dff911b6bb112bd539f97ca77b29f7c4ea587a07ceb0a44adf254f66c4b8c1521221ac16fd7af1e1ee57e02ee0e26bf5d716d468324279da9ca58d1a4d0567df9d5e08e6e80d96915dbe2e4f93d8ce0e1b26de02e2a278ceff5d2dcff5709107c9a57e0c4c5f530d11ad89b4190cb631d65702f5af4eecf07913ef7871ac1f150a8c395afc20a7577f3647422a8d4b53ce08a06142b34c166e56df7f8b6092e145d259fc56ed595779e19348707484aa3ef43753027d40dcf16a6d9e806f42c7d6a263b1c7c784c0fa10f26c51efe22976475cddc15983a5d14f875ec2f92e56cf583040c350bea21521191dfd63bcceb59ab6c765c0cbf662fd000b113521919ec9fb54258912907d548824f652b4ae2cb73083bde93288170e5d6ba3b41c77c509c1d7cd053005a9fae4d23da43409fbb9dd22c80b17e21bfc3f99f42cc23be1906c28d62e91abd30ee881c2ae81e8683332229dbd72b19547a2b4c9160d93cbe3ebf5f20dec06f45f9c9395720bed628505198d38242be3f279ff14be580c3078d69558e7f38f24f5356be89d1ed52e6ba9fd2937a3423644c5e2e531af9d8683903e48686a13193eae17644d72e521c978ab2f8dc0ffac9e853f309c011c549fb63d3ade1599f3ec71c4f1f84f4b6c50047721130ae710aeb2a7fae780edb21ba4c3d3d9294dd6b8135c264fed2faa5e07abb4cf162140036323537ac132fa2c5344b66c051444206485caff186b1c545b2abec1e4ca1ccfe064c95506e2abb1db84a1a57c7303a9cfac61583e592ad68759a1cb4a0342a2019ffcdb2872558ef7cd080747f105b734f95e1ef9b99d0d983cddb5342a4e9cc5d350b36251d179e9fd33c982acab01ff1deeb0eaf7fc45ebbab69658cb3c33b6615c66c42e0f1eabf2947f1a0273c4116ae180b43f2314d118e7c2c29024b21f7271506cac332752920acfc8f100549469bba34fcac4648672d0c1376970470e939805454c9aafd5c50a828ad2ad36429e4be6cdd7735795658c17ce8ebdd354f361011d49c795baf097c87a7a2d57f0ed25464b4ee6628cf7872fef97a4a637aebcc92132f1f45a6e990e268002e35bd397d8150037317f55b20748f68eb1bee4e50dc6ef0d701622e23392eeeb1f2c4254bb8e8d29f89facee354b5db28b0882a58fbefdb15b174aaa606d5f245bc00ef3a9a9ee0d0c566d8dd40dbafe05b2462e7fb098838861cdc5e045a18ec6b1cc3605618f1901fda7d6664199bb087d92c1fb38aff1be1db8bff6ac02c61105e4159060cfd7ec31640dac61360eb35e1597b3bca5df8f3da737797e95af1d43d220f338d4df7559e04f7d816e48a3095d7fc9371baea06a8880bcd82bb90ceaa40593e2b7c19fc952fd3ebe6ec52735675ca3f2fe4049fcee5d8fa6f383e34f4d808fe63bb57182e4384b1aa0cef34ae62ed4e3c1d28690d56ff13308d642cdabec3fae52fc7aaf79ec5a0dd31e98228c7fa8e4699ffd7eba23c7a13ce30086b0ed3449234f01f73735fd1ab39dadc72739d59930a8decc637617732215d5d72ec282bf595bc906dc19c081bd62978f1379c4eca41a60410cc992e841db529b7d4536eacceceeb3108fbaba62617f3b8b214ce80d40e4969f4d52d955437aa4defb005453868907cf73f9f9eea4c7b102cf3e02b64edfa9497b45ad66ed33acbc24817d49b367cc1b5c6ba3bd2274f0948583550a4ec9628db9c21a3c6037b0e81e5ab123519a5b211ee988045f7f7e470ad9c1f1c67d825dd217312232e68216e800e326032152d4b1101fcbb59365b09dfd2c196308039da4014c1b05635cf6896eafa83669096196975ab34fd4e655a1317c48f2d23fba0c772cbb0961366e733d8067c13552fac1f2565f1047f3f7b1fa8e10b90a028f0fa077480b9e8aec6d75248f9325c6438365af27c84d8493f7f3b5b14da6379fea30409490be7b16eb8ec523d599b60314129977039a47808b0c25f84cf301a55422a9a5819db18036afda11f5d09174d498a09bd04c0d4a6ea9fe05be9dc3b22fe1592e4a64c6b4ac692c1fb2953d371d78f09b6caf79db3bd519f0d21525920ba21d2283e44126a9f7127e1c4c7138f40b6bc534ddda82e3570ab2d17f431b17caec4e25655383d76b9999ddf7e1900a335d4fe590f", 0x1000) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000000000f5ff00000000040000b2c215ed10585da69f06c4400000000000000000000000000018000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) 19:17:47 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)=r2) 19:17:47 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/checkreqprot\x00', 0x20000, 0x0) ioctl$KDGKBMODE(r1, 0x4b44, &(0x7f00000001c0)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r2 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r2, 0x0, 0x2000424, 0x1) write(r2, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) set_robust_list(&(0x7f0000000300)={&(0x7f0000000240)={&(0x7f0000000200)}, 0x7, &(0x7f00000002c0)={&(0x7f0000000280)}}, 0x18) sendfile(r2, r2, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000140)={{0x9, 0x0, 0x2, 0x5}, 'syz0\x00', 0x40}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'ip6tnl0\x00', 0x30}) 19:17:47 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) accept$packet(0xffffffffffffffff, &(0x7f0000000a40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000a80)=0x14) r3 = socket$netlink(0x10, 0x3, 0x15) r4 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000ac0)='/selinux/status\x00', 0x0, 0x0) r5 = creat(&(0x7f0000000b00)='./file0\x00', 0x4) sendmsg$nl_route_sched(r1, &(0x7f0000000c40)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000b40)=@newtclass={0x84, 0x28, 0x0, 0x70bd2d, 0x25dfdbfe, {0x0, r2, {0x0, 0xffeb}, {0xf, 0xf}, {0x19, 0xe}}, [@TCA_RATE={0x8, 0x5, {0x211, 0x7ff}}, @TCA_RATE={0x8, 0x5, {0x3, 0x2}}, @tclass_kind_options=@c_atm={{0x8, 0x1, 'atm\x00'}, {0x48, 0x2, [@TCA_ATM_FD={0x8, 0x1, r3}, @TCA_ATM_EXCESS={0x8, 0x4, {0xfffb, 0xfff3}}, @TCA_ATM_EXCESS={0x8, 0x4, {0xf, 0xf}}, @TCA_ATM_FD={0x8, 0x1, r4}, @TCA_ATM_HDR={0x1c, 0x3, "c0d181ce79ed7c231c1b05a712c131de9571696e14b26747"}, @TCA_ATM_FD={0x8, 0x1, r5}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0xc801}, 0x801) write(r1, &(0x7f00000009c0)='/', 0x1) socket$netlink(0x10, 0x3, 0x7) bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000000040)=0xd70, 0x4) r6 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000000c0)=0x0) r8 = creat(&(0x7f0000000480)='./file0\x00', 0x40) r9 = openat$zero(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/zero\x00', 0x200000, 0x0) io_submit(r7, 0x3, &(0x7f0000000440)=[&(0x7f0000000200)={0x0, 0x0, 0x0, 0x3, 0x0, r6, &(0x7f0000000140)="04829cf35ad004141a8b6375d5a15a943ad31658a65f6cbc5dbebfe2445eea937d041af91f7ffc96d7713fc905a96ae405aefbb655bc6e8307642aafc4756380fa910ed5cc1098c080aa1f8ead68bf8710ad72989541af8dcbdda3fdea8151bbb63a4714b3a7803dfc695ec20d81a6", 0x6f, 0x81, 0x0, 0x1, r8}, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x7, 0x3ff, r6, &(0x7f0000000240)="4892104c9b24c0963b38e8ed21cb2365dc07c2728cd03e940d936f4abaea98013d5370b7c47f0908b695eb04e2a8e628d71823fe8eb046136b3c001e15f9b7c02e5d1b73bb265cf53705a0de16bcb1b19168f784ab20f53c9594ecde116985f402a3762bfbce5bfb88fdcef2bd0dc390275cd0637eae8401d4fa871f009f4a9145a686317358d497517f03098c940a0a3303c357d74afc0dc63c878a5dd4c0339b7cc17e7b312bdbbba5d9532227277eb4cdedcaecae17a213b40404610c85ac44ba14149fa86a0faef5392365e7cd5ebd236d320877d6539f42a7fe559d3e1aa4adfc6fc5", 0xe5, 0x0, 0x0, 0x2, r1}, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x1, 0x80, r6, &(0x7f0000000380)="b2f320102df5136ea86d11d011a412b7cd6b849261", 0x15, 0xb8, 0x0, 0x2, r9}]) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:47 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce\x00', 0x4000, 0x0) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000000)="780b83aa76206fea3828aeada4d1d3e15682ca420823e806bd2320000000000000003d8a5c7d019b63008b4eb878cc275fbb375b787d4a9513702b027a574632efc1723dc52001995e831d1a34f7fb9440f620000000000000", 0x59) read(r0, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:47 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e23, @multicast2}, 0x10) getsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7e0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2b, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) pkey_alloc(0x0, 0x0) setxattr$trusted_overlay_nlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='trusted.overlay.nlink\x00', &(0x7f0000000180)={'L+', 0x12ff}, 0x28, 0x3) pkey_mprotect(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0xffffffffffffffff) syz_genetlink_get_family_id$SEG6(0x0) sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, 0x0, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r6 = getpid() fstat(r2, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r4, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getresuid(&(0x7f0000000980), &(0x7f00000009c0), &(0x7f0000000a00)=0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000a40)={0x0, 0x0, 0x0}, &(0x7f0000000a80)=0xc) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000d40)={{{@in=@initdev, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in=@local}}, &(0x7f0000000e40)=0xe8) r12 = getegid() r13 = getuid() lstat(&(0x7f0000001380)='./file0\x00', &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r2, &(0x7f0000001440)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f00000014c0)='./file0\x00', &(0x7f0000001500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000001580)='./file0\x00', &(0x7f00000015c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r18 = getgid() r19 = getuid() getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000001640)={0x0, 0x0, 0x0}, &(0x7f0000001680)=0xc) sendmmsg$unix(r2, &(0x7f00000017c0)=[{&(0x7f0000000300)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000680)=[{&(0x7f00000003c0)="1d249820019b0068883bc7036428c77597cf8e7cfbd6b368f2c0a2133aa98243690ac87fca78fb633cbef3655342429e50b832c707e4d3aa03437f440b370c95ed14f9838aac4dec48b747905dfab6b7db3d3e783017c3d5fa4cf484606c60f8e37be8f58c5ee93d5a06839930ee2d48965bd2c5c8a6713f333c3e51c2a6fa9727fe13e5b989df51a2dcf6ca21aee68294a5c6f06b9e179b68cadc7e7b4539139e4fece528549869b171625fe2dc880195ab", 0xb2}, {&(0x7f0000000480)="27ad9bcade8fca76b3c148ad8a7d72b67d102177152248070149ccddf0280a275f23741af5dd92964179cdd3064f7bbbb5d038896f410c412421e1b59da251750f29857c0a23a80f4ae8f555b2507d657f11686cbc3feba5ee62f8cba999da1b47e0239c659192e3566786214b5ab24393c9970f9752d3304327a4a41329d043b2caf1e8abff031a45867ce30c7dcc60d0bafc58", 0x94}, {&(0x7f0000000540)="6c1524c0029733f528189d1808a38a4940052b1f9c096067669ded79ac143b8741b0386e58972bcec19d6b1d4d36c97e252c01ca01ece4ef7731016a8f", 0x3d}, {&(0x7f0000000580)="33f21121a4f56762a34c6789916196ea33f2870a185c08e3dda61d04d0c1e3bc70bdbe7e5f3e1ccbbcbcc8a331e9cbec05a1ff12c23226fe7a5501571fe571d9ce2d09ced5", 0x45}], 0x4, 0x0, 0x0, 0x20000084}, {&(0x7f00000006c0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000840)=[{&(0x7f0000000740)="e8690f821f2e46eb65c07a759c32f273b9965fc948be5355f89176bb482ee6ab52239560baaef403069e1f0fc0585ea7097d69af8ca23fb9e4317c7787f31e9424f21bbe56a0967a771468b4436d191fd39a0d9a7e451f02f7d1dceb95f49fd4300521d7e6d5ca3d8598d4b0c524b3cd01f79379df55ce47c841e59bb8349028802653d0a6ef72087ac3ee2b865c3e1906df394e287631c4f3a1792117f646bc00a8db409b1dc167cb528333b4ecd34adc04ad0ed3e47c3f87ff369e78f10ef038af41d9f2f4e5eaaa634857d439faa17c1751c4454328d0b5a1f94833a829a5fa23aab483", 0xe5}], 0x1, &(0x7f0000000ac0)=[@cred={0x20, 0x1, 0x2, r6, r7, r8}, @cred={0x20, 0x1, 0x2, r6, r9, r10}], 0x40, 0x4000080}, {&(0x7f0000000b00)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000000b80)=[{&(0x7f0000000c00)="42083ee7f850ede110484b1bb830fe22ea575c0a4ea6bf6a41e4ad6e7f3c0b04c859ad0f447ff61fb232da4b252e2ba3c5356db3d2658543303f93eb7f75d37b714c1d8ce5628a45da8e9c0f48dec9ef08b1", 0x52}, {&(0x7f0000000c80)="2258ba586998b4a2f15ba811ade954da44b56247e4ae5e00ff14bc8e4734b95f4c3ffaa1008a976a93a00aac094152cc2332f91109476da8bf3ad6e71a282c8d4c87f4603f0e392516f44695c2475a7333a828dcfdeb8252846e20a65623c36da36a2592ea6925344a1ed319a0c201a469f3f99f93dc818bec14836844501116a7715832fe5e432c3217824f", 0x8c}], 0x2, &(0x7f0000000e80)=[@cred={0x20, 0x1, 0x2, r6, r11, r12}, @rights={0x30, 0x1, 0x1, [r0, r3, r5, r2, r1, r0, r4]}, @rights={0x18, 0x1, 0x1, [r5]}, @rights={0x18, 0x1, 0x1, [r2]}, @rights={0x20, 0x1, 0x1, [r4, r4, r1, r2]}], 0xa0, 0x1}, {&(0x7f0000000f40)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000001300)=[{&(0x7f0000000fc0)="902fd816cec03aaf0ef3e8e0b95f2424b3e1be85daae99b41a87c2e2e6254f9e24c98ad35d11f9bb953b74d5f872f305fe54dcc7547754037e4be801b82f511c5db1473d9e88f591f410f32f801f363e58b9fcab033297511faaad9121089e26590f0cc9e19bf3984fdda303db3356c4e6b500809615575acf420ed3f8a776d55cbd7c73d8c2d8ce8960b5305bafb7529c64c78d7ec439", 0x97}, {&(0x7f0000001080)="239b5109c67d78cf8773adcf357d0d24975be8d03f709dea148bdf02c2a29a16d84ce12a1c7d71ad4f4789794f7ca8d66cf01053669403b6fd74ee1439fb552945db79ee6b8355fc9b2dd52b15d3192dc5eb84628c22c5d670de4a602bd0670a4c080baf8251d8e3411fac0d56b43c833f5e99c6c0559b59898626134030cfc126c22bde8d4fc879172b39ac131ef84ac756ce659b231a9516a85f437483016fc911e44051bdf40605f23ee09aadbdd7b580b55b20adc46f5f309178cdabf43cf4a28e", 0xc3}, {&(0x7f0000001180)="fbe6003165637ed74bc0aa37288b9b3e3106184d1badbf269260e7ea7084f2919acecf29ac2362df4e2f811d0d1dbd6b1cf180c3cd4cf581f6665ea0b3ae33257242baea51eb67a3cc11ae", 0x4b}, {&(0x7f0000001200)="54e45192704a7551392877adb773dd73bc54f4052f659cf6aa34fbcc15378f0e5c34ffc0db5d9d5c287d4843c386b1734bdec65ba063766113335ac0ae66256fb424d9299ceca34d21afa84e938df417b436b7008288a05287c1a9aedc0fcac399a5c3b464f945fe1b51ca9f569ac75073e30bf3457894f106b42af51178ac385d1a2275bbb6", 0x86}, {&(0x7f00000012c0)="b85d21ad836141d72f8bbaf87e8342c96e87bf5fc16237f649a7b7a9c4a233b2dc", 0x21}], 0x5, &(0x7f00000016c0)=[@cred={0x20, 0x1, 0x2, r6, r13, r14}, @cred={0x20, 0x1, 0x2, r6, r15, r16}, @rights={0x30, 0x1, 0x1, [r2, r2, r2, r0, r5, r2, r0]}, @cred={0x20, 0x1, 0x2, r6, r17, r18}, @rights={0x18, 0x1, 0x1, [r4, r2]}, @cred={0x20, 0x1, 0x2, r6, r19, r20}], 0xc8, 0x4000800}], 0x4, 0x10) mknod$loop(&(0x7f00000001c0)='./file0\x00', 0x3044, 0x0) sendto$inet(r3, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r3, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r22, &(0x7f00000001c0), 0x7ba27d3a) read(r21, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x2010, r0, 0x100000000000000) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) writev(r1, &(0x7f0000000180)=[{&(0x7f0000000540)="8f96596b3c6c20b9ebcf8430b256f84be0ec0dcbfc07a5e58a0e18a2e7eb313b03a78ebf983e94dd8bc253ce8bae5f1d23ed88312763bd0a1be13a07a68e5ea425f857477a82633824bee4aca2a51463b4674a9c14146f70623fb2634c67e757a95f970c3a646b22bfd2013e9e8136f2cb34aeacfdff865114443e9dab55f7c778a5b24b4c43f750a343a37927ed6374348b4fb55cfd072e0c234078c47bab661b77acfdd2df349deb569dd72a19ecbb5c9784079990d368003a206c9f5cadbfdf82ccf121691f6ef8535b55cc6147e91bf6f627391f45352b2ebbe8bcd50af4fe9bcc58347aa813be93ec71511b98105e66812c1ea21d87977315cd5b79a3a73924d20ab47fe5a2a716c1505f1ecd833c98dfb2a08d110d5013aa2152551dfcc7ef6df2770e3cbe8b3c20063a68312832e7173b5bb85afbb6b09f74429ed18e86455c084059c4ef20482c4c09a349b7db800236193c1894b85d9925c063556a9884cfe0860f98d500f9591bd9f79be4a50fbaaa24fef39945ba72c9b16a32cd05321be184037b99a644f15dc31046fc46b721d2f42e4f88f0cc349e809b6e1c5ce3512608a4f7398b705c77d3b7f7303f64b62c392df40f00645441dc3463f8a20e063df4ebce2c03616b619537cce764578a7db481edef9e12a89e7f66b960c533fa6024da3fa23e427b0473c5920fb4d342b6f815d592eff9b5ea86e3ff3f5dc9b147bee09d47da6ae4ed5d642f6e9fd6d8905b548d07f401367c7131460bc74f037e23c86ed5d463a2ead70fa96bd96f1ea263223c53b3bced9cb5fe4b887e6b258ef4f5553a79cfb142a9169c2a9e48e20653ab8419fbaaed0f466591d94e34eb3fa33af503633c8e4c7bb9af3656a550cbe72bf422e4199c40070b339f8c33ce53e9b8db7f5b9889fd77118755bb8d644245410e977be14b97ec21b56bf59efe9b5458667446d578d64394fe2383a67f663b78155a793dd4a9deba0ea18fd671f191a550b4e102a3f3c213262f2c51ba043c7b3ce37142fe17b78dfe458c17a3d7c0abd19132418ccf8ce2dbeeeb14e9565e2b084bc67fbb407f1e2cae8661d114962db2c1e98dd0e004729f5cd6e1d04bd892489e82fbd7844a0b230ff16bc7f9fa7bc2865a505603ddb91b6202bd773c9e68fd99048f4c5fc0e103a807a5c8521d0c35fae7a02d3fb74d0fa9efff974330127decae8f9d0cbc4dbdd54f70529686384e2b2fbcfa4c2d14e8ce722ee68cccb44746170e5de0a299b57625c498c7da24ea7f5e0420d7a939346686a46f2a0b44b3922ffb0dcb9c499f0e9b1796a49b09302fe0a72d543b36d890ecf7d518d76dec1ed1dffa393a99ff97a853870575d34d1554d359aea17a9fb3b04a8195ef843e966e54cb555df4e02b6147323e07b814e32762a0c128fd8945fcade998051033c25d67e00d6afbff37d13d3bf2fb566593bc23f68ff7774f6c133d8d0a428a3cb2253eceac14676a426bdd1ec436a6bf4bffee5d6cbb16f287677be87b7ae86a609902eed569971ae096fc1e9c16dd0b3cdc8094bf2552f1b87c495cc067f39e24f49c8ab422b78c6c72a1475523ce5a5857937cfb71ecbc5cac2701adeb133f422c65396c7e741fb01e75ad0a543b891ba9baf935f04b058ee64467fce916789e3c4ca1d5d6f4c1b2d1ab326420607f2d61e13eb6e138743e577d1eea501f222bdacdb674b9cc1027c5d8367852cd71505b5f2c76f2e9cf553cf91f6f316af5322ff01361b9d4192be77e9d6a4ecb039a2ff8524366e54a9bb9c68a787f16508fc473fa8ce2dd697ee3fb483df06c847a97d63d24a2691e83de50a4766a10b0dfd191ccd5490619df42852e1eb0923f1eb5c93191bf3a96979325e15b3f738a308efe0514f9ba5b7e9e0b53a9274c799da225d27bb8448506f580537cc71f28d2bc98c014de520177194d5ef2ed1ab588b2c57c8f27c213634e43ec20e86c6cdc532e18c60695fbadc87321fb29ad999a93836916259ad7226e95b24b7352d48eabf619b917f4f40c34af9785081f11603e6a8b5822e59eb0b268ef62769d4d2dbcffeefa049f0ec4afa914a4229e4b52e8d41ae488a29a8256ac65032c9a13885eb940ce10a860f51ad5c0fa941bea53364fc8bd9aee3ba0cf56a9a8af025d33953cc3ee8d06f4e6b3506a2682b0453037f2c735c3bb6d5576b81420abdd8a565a920f77bda100c7d666561949b82605b22b3f6e4fe9bac929c41a1ea3ee28ad72801e8f86a066f8dec664e9135456b1922ec02d1182ff582c88a359ba5a0ed60482323d76b77c574330724ed32db3e5f5b327b88c2dbe14b5a758a07d2acddac6807291f692057e406c0823c7a7b86ccab09bd3ddf81c6329b0ef9ce4940d329d8259d2ad407a6d1e8c31c8297f8fb10e3fb63f0b08ac70569170fe78a74406fcc91fae10af521051fabe1331d1f5a4c039fa5fe6c0fbbaecb057ffb862e178b821419959a853b8f804b6b93eb6b5bd4357ee311a1536473981d1aa110db9279fd8249eb15ba00c4c02baca082e2fbf15d4f3a52702444b63d13abb45a4db1ffeee668101d3e3332ead3167ee1c2ee6b6860802608cf73dc0f6d587843eea55f6c68cf9436815a148c62e69e9a78858a6c5c48475d13c20be693ee4ff63e41b248cbba30a7a01e25475c694c53ed5a6ad42a6d4a6953a5ba8e7a6dc5f830c8476c28871bfa50d0099e3c60832bc4882a4f81232cc8d2998a422c7489651d8466bcfc5948d3977bb6e7c5a16e85d32b0586ffd111733466fee7209f9e852514c4acf5394910d7fc5bdb4845e192d2ff6cb795846702313a0543d1ba67f9dad49d3d80000f4e26dc42e0dac80ac51fc74fb2138673330cac24eaa502a0c124460b35d1006250e226bf6d006dac9236df8922b3047834f0c53753b653167555becbe03cef74435c6f3f578755d5991f6c3f418d3ef249c5639df93b05d0101a48ca0f75418aac182111281f06aa36e9221a5be8326e77e08e5f8f16ede6b47db1e9469b3528a69b7ef71298fc09445931c0decc27e5e78d0779b6895717250952f38bcb96476a65c11c2fe01ef958689beb0b530d75b796e36c4b4026af65b6abb03c28899d23386085f080bdb9ded036b742bfdd6178c91a44412d51470f73436328aac73c9948a89a061c1dc279c3746ff7288e0c24f21356c16540188e608f6773e0b4fd876a2540d5c61e24e370a78fa6eacdef9114696741da99015ba8499f654f3e5a7ae9ee94f807379a99cc453a0699c1c0ed17f78fc66cf7f820d2969c1b1d941f7d6605e4e334e96025dfa1c26b862b5b840f0b2a34c782ec03b09aee535b22c9878554e3e964dee14b6bfe8e48f286e2ee108bb93e42b01775d9632f9c95c3582888b55e7b3bc760c9b06f1f2880eda54cfb51bc0ace4d5657065920a746ec35242acfe24cccf838da0364bb641be1af06de41d079786852e7fdc7f853caf7340701bb7fcf31eec117fb31080c847fd6a0f5445719eed0b3f810927f82fce0851196fe5190aa79b53469de179d95f520804f03271463d21603321ae0888e44785cf50bb19331e87bed169adee8970d7dd020e4676d4a5f733277e7648bf033a1771cdb413cf3392ee476adc09f3660b19ed1e8c5b58795bcbfae80e23f4fe2d298e973d2d80c4e9adb103f5e31af84a640a76b59c69dace34b0a6cdf526b8569825041fc050cd257fbdb005cf1d9ce65c633aa3f88ec0590158177245f4954d7d504cff8c9abff524e455285d2a11e0858fdc00904ce523cc6887c5f4c17f53101ac2aa94360a3d665c335aabde64925fa87c8b91d42ad085322dd6420a5969db737ff79ef80129f4c0a0813e086396f1495514a96bd28933ed9d487a331ad26722ffc56e005f8250d39d1614baae2d8122900a4eaf7b19ebe875d69e323dd5f96515b2317236d3a7eaf2d163385f3fc1f40515701b9d15e3298c6d6f7723430a630a6e4f82af42e53692f2a145951ac7a91511c7e9e4a489227e9d67b5672fa0a476beed1d35a0f70340e881abd4c07d4bc3035381824dd0b6a87a33ee69d1c0075e8312fd4b29063e29a13ca104b267debc793c6ae0e2df0457a659c3034494fb4c89236b0769f5c5acb7dce111a31efdc949665c1941024e4e17d9376b08b6e6ed2a33dfe2e781c685ae7d5776389301cd66f60c64cb79700b19905d0afc0ab4f7ba21dec33e87441a11656a79884ae42e12dbcaf978868af39a4b9a3de61f7c9e3dc765e2df243ade90d0890e6ea11c3dc07253d6c5f2b565a88b827e01702d20b5d71d3208ba21342b175c4c2e43dd821d4ab7f86552846a770d12aca0afddab02098e07af94973a0d35b6748d525fa97b0c3d8deec3ee5e8b22704ee733368e2f1b6e8437ea2704f777c608703490d7e8042b3e96d418b1497065f2598fce07dc377109411e39639704a3c647d3cf4dd458b7f57f5084b571603fdb1c233493d04870fcce2a4ae0609ac0cf1c31b288a8e29dc7d363ded4cfabda0f3a31b53af6ca2a45c7f206433131d282d0122d9b89930ead179828937ad436ad0f5e97208db6c431e4882975db362d43675f4558ef48e238c4969eb75f05fbb7f7d897e3bbad9abf1e5ddbb350c45c7bc275fb7d2e89ac88ae47acffd35150dc1f8964c6d1f67c913d21260f1086f015ddaaecb8b28a01eeb83be7f8763670c628a1c2d521164be0ed25f306a88071a99ee905f1546edb183b9c32dfb4414f88dbb05224187c6bbfddc261057245d19ecf09c441dcde97886f2060fda229b49c02d54942085a3bfee680c7ea1582cfa4b44d95e377f7d487ec6aaba6d20e27e7d0abdd3e9d5608f9dab6e37656b7f65aa2c539465ab92d1486f0a8e8471602ef6fc1a77075c5173ebed6a4c6557a7f9b8d86f5b98d784d78167d9b8177209aa343d770b1ad86df37b356c1c9cf1bd9e815ed1a105df796a711e9e0d0cf9f3a71d862acce7b5b504b2e8943559441169ed6f4a2e04918c6dbc26cabf28d882f6532a86225b00e6c940a74cd5a7d2ac8886f2056cabdde5b470aad2d3f9f6d91ed1f92a1a7da914d3f75fc55f85ee1b0f8100cd0d5b0eb0fc46778188d5243bd57c81b8742b9b950ba3c767bc2b03d50be2af8ee12976b5230b193270a91f5c3d20efc2a7a19fa11a04391548b14ff76e3dfe058678cbf53a0516aea3ff7282e705491f998ec06ff831b84a4b9dc8982b53a2f54584adae4f7bdc9146f99c705dd8ed9536861c93d65ffadf59f5f0e1f7224ff989075a103ae12d788ed36bb6dd92b5b8ed1f0ff818e964fe132861ae6e27612254509647b5e88380b33290ff7f50c4a81ea59cdf465d15cc9416b8f6e56a28aea55b1192223af0c5e12016f5051d08c2e98ab745e8ecec9b0dc235f0aff776044ebb9bfbc832d3208472fb3d8d7e70640e381820f40d033230976ccb1f84d65eb91efbdc911d614b4b4fe5999a7d1a7f08c834bab2e21422b6951aebe80ccc498b6cc6642fe02e9764f14001a6f478ebec00814fc8f52d7a33791810aa17cfbb5dd041ae8c9db2a8acbc285c59e85a2b5797dd8a041c6447193bf69d2cc5959824d06c81e3b204e6359fa2c125e658c546cd5b69ac1b91ecf87b46a65d4e7531b3046f952ad855fab97c814ab22476d42a0eab1a0e92fdac19e6f06602127c13f06c9c5866ef842f6b440ae02b78d5350c39c125e56146cae62ea1f6a9abb4591dca486e17a567a4411576d7fde184afb601bc957e1fa53d3b48d800aded8c545bc10f8ec740c694b27fdbe024dd7e811f172", 0x1000}, {&(0x7f0000000000)="daeefcd862099ceec502179ddb18292029b003f3a8b03d895bfa3467ed3f08f89b196a48f615f86f9b738839a44a276e9bcd35b8f18113f1292fe948c538fb4c72cf44f379dc89898f9e597c9e645c063d801743a5226f2a341ea2906e52595ec63023e8ac727ed5ab557866658d9d07", 0x70}, {&(0x7f0000001540)="c3d67dc09ae7e19b3b0656825bb19c1014974aea3c56539eecd728e64b55e028607d783c74d111cd342b5899953edaebbf973ff88b02a0d5cf603e51f1541a19b9c69d76b4b220592c0cc948a2f29dfbd23dc2633ce7e1ac9b9e81091b2029db4729effdf8730fadf2a5e1ebe1284b19a42077dfa4deb0da71021e776ab98340096ffb5a3539669736bc928683c4ed9cd142e3a07860fc2e1b56eef77fa8e52125e75affa83846ec716acf7dfb7df3f16e831707e014464fe5800f63b804fa2c6bb74767c8fbca0c33ae02d8f6384baa5918fb818b516d1ba30781bc287f7b1673a752b47090d082dafeada52c3960898d10561bbc8f1faf914d386430737ae52242461a4f7d9be1fbb111bcbf4ae548247195fd8d5e809868a24955854428eb2515b1b932ca1513a700d3b83923f817b9e2871ab96f87efd24f142274c0c9a6ad445ddd7d2db81953a7017f1836c5add822986ad00d356d60f42b0469f156f6f6ff5021c9c83b4e82513842c239efb18fb28ec4e44b8f3ff4ecf88f7140d3e3e2b8cb9927112050c522a208a7447b21b010cf1c81f7796d61fb43017fc5baa1dc80449a2eccb0bfcb2db4450beb57470c4551f4baedc92291f74c49d376c10549dc03f51f2a10a76aaed7f15d0bd7aebaecc1253f8e41871d2b9a77e4608373a7181a495873625f8d3cfef197177b53797c43407972a86d5df228cecedd3d54323e4de077b6c3869dd15630004adec3db373ab5b5c305d48645d97f578c809e3aa5858627bc48c95da19d95c854891c65019e3b49d02391b20b5cdaf5b93b3bbcdc51b14ed711175d24a973e8a4e4b15320c23288d2a61e7fe0450939f708888456e33352b2a97174b77786b606026a8e40e98c781d672725aa388497a2624f2e08ee0396f619c46b4d858ecd4c2c927a21b0569cc7e7efb10374945dc15e34e74e8784cfa150a5792a44e6f31dc18ddf9fe480810f794c5d4c37cf6535c69e70fc424a68c99bbcc873e32e721f8f6525c1bca7d4cf0482a9892642aae04ce11eb546f75fa6267743b0b21e3bd1fc55b58ab993a955a27eb57c337d9a7c39a13bd37cec79c05f19d82c6f244bc2ceacd74a452ef5bd06a906ac340e35fa77497a229e03b180d03883891ecfb7a336d9b6362611d794d7ebd1df5ec515436bfdc3b7b60fcb1952fe8f60b188145643c84b13f70e416e87a3659588d9e6638a06f4993a12af23b4a2d0919d04531e402dfa19547091d24a1213bd0cfccbdef1277f3ffa1c578d310e27f96272a890ba1c32b522a7721ee5eb137f6ff94f97f2dad7d7ff2d8454e13a97b2838cca226f375780b95792050fb19aa42faed74a14b78c2fc0ad49bd5dfb9d968ff90954e65651ffc12796f70990a8c102556e4502711ef05ae4b9f420c9a54b92cd862501fcf2eed2c7eed813877386b132e4f673d8d5f924e7605a156dac6ac13f68f1c345e68cc836da43e3f0112576439a0dc71888da40645806647057de9e921a0da931363c48de92f207ed641d0002303b16ddf2d17f7f853af46527cfd1f5dc9096e57a07f830817486b0f0b72e7f6551aa750799f46ec505f52475bbc68923c426663e2f4ef0d6b4f83ae8a910f491d4bd7bd2809f7b2cda9ca8b3b053d55154fb57291e7a43ec7b1fe31a84d3582be3cb77f88367717f84354310bcf2579e334945fa9a0a87002a72611bddbbbc84d3abf38d3ab30b093c768369112be5b4d9b5a2f876bb39cbb0e583a5d61a279c6ba3145e3f02571dafbb74dd2e4fd0a19bd87d93ce47f6aca0e4d1cd19dfef8fe45ae94b7973a2693f7e8db2b76ca450a5835277b97aa6f6d9a673bae33926742f90344128d730ff7600ac63f453e8622972ecd9458114345c880efa7d20497366eec8e77d33a784b8694a9d163c3cd42c90cb68ab6429d427b9a9e15b4d6b711631d1b9f6f472f0e18d5fdd60db7a4134fe81bf4cc7e92ccbaefcd1aacafb839a0ea088dd32ff70a6ed7bc40679c898c8ad74b1f991770f04c66d8711766918bc51be0fdf2d465d3f79ae43cb0ce8ae6fac178bf092a8df06279bd99995d9bb283a3dde34adbaabb4cd42f2b8e20fdbc400a60de1ab45de544e8941760ef6c4a50034e2f39213c6fcbf0d7c0848c3b75788d5ca81e77575039bcef34d279e679375af5592fccb4b8ddb7c8350a6aa12fe1bb16904d005a778f11832e16544ee645d10813867c46354d4440949dd427a5b85e134024f6d280806a96d6649c22e659b91dd34293a0854262d5a8c4aa76e7563e0b6ba4522809840ddd14e492032470565c58c93c483e9956513a29ab65d355b185e812cceb5d4d29e8553a47687094d875cffb120f0913b05da6f3ce4082ccc45dcd0bcc5f278945199c409a904aea59f45317916b10469ee3d590653f9aea2cbc6070fafbae4f06966724b723959e4b3b07f5f57aed52a9d579f22b99de18e796c2d25836fa4efb5ec03ad73e3993fd326ac5cd71f7afd013a954b604bc0fd29535c377f8ee5e0d991506074a682cf815932f267f9ab46ab8be6a5c5d2b0d96f495f1afdf6bdeff65a3f0d2a7ebdf2a9ec1d10da411dfc5a2a5dc71a1da30756873d71327448d77a1b247079ae1e70e421375a6d1de47ce4d7bc36eb5d06e22e60242bd5daed25f3473a7bda8cc95fae5a295cae61fe25f2943ef399c6b69a7c1f4033899d2a5c4f484dc80fe5ed6a9d4135b22b44b5803693d93c069ffaf527ccdd14e57c789f3683fbb8b04af7f4b3c21078417d5cc33268d501ddd6947a0d4ba95a4d3e6aad4a498ac478692b805bc1ba7900904843cdca42ed8da738dba40078698b225cd1fc47219aa554ac8217569f2d952a5c1fb3bc65cc453b910df1ccb8236cdce5e88512b0fe631d9d7e0c0981a294bf079424a49e380fe3539a5a71ebdad26d21471f4420bf60ed0cedb7a4f71ac5b1c300e1af3c4ee9ef7e63ff8a9762ee2f8fa73ed039548cbf1ed8e94a1950382f3355548263e727d136f43a6509acd070b9b37031fe5b9d7ed3b637c15cef7663b66aa943ede48dd8a87bc8b22b2f0326521757d3fa82e2fe23c71cb5860496de726e6699258f436a6ace9ea091a3da344b5fed9cdd9c6b6b3b8cd25cf5171d3aa2a6f9c2cea32725aed8ab6e0732f8d9be399481b1f53425dbfa409ade6ede37d3d0c1ede34021adc443dedcee882fd563e7c9216eb87596f5bf37a4b1985a1c5e62ac6b8405a3d220f15fe812651f0dbeaeb978c50fd0f4e131522246cfd57046d325de1903f812bf69451318305d78af70fb96f0107269c8064bdad04389a798be9ebe67da5d427c855ae4c97a8969a179ede55caf32822f518aace76f81692c91e2d31b99a04cbc482c468199de1e0f0de6a5e3d88eaaa0b74e6c5870a57cb7643e56d7c42d4d5742ff97db59e53452adc4e95018624bcb5167e5c205702123ad41b59b14a086067a4e5926b879dfb6ed8a8b099f3e61da4ff0d6fafec1bfb13036aad2c9f9714d69ecf687cbf20a6095ed333da82ff0845c32d5cab694f6ffb0ced2744bbbeac0571980cd680c089423180eb5f2260f186285148e1acde555997aa25e74586f8c1c8b15b89715d2bc94e5a72435509ac7d4b4706054e37bd0f1168e7aa3e5656eef7cfc7d940d401e911dafa3916d24921a2bff8d19c1a5bc7c3b3d837db8aa446d06c3435c65e5799406bf590d2e09c594dcfa125fa5e689553553b1a2ebc38f201e43d0534b6751b1a493d27eb63dcbc851ade91658e5b233b284ddf2bbe144fa293a472bdec6c3d6a95f1637b2393b0fe7f7b1a00ba934345c00383907e1afcbdbfe48b13500c9617d7a0a27d4be5fefc467aa5ee7ac340a6fed723170745615b4f982cb6f7a72226235056f47cd27852a49e6fe2ea87509d9db18cb81d76b4d0f5d04cedde70d5783c855574adfb2dc0c9f8464477e77fbbd3e9ef95d91deb70216b7694e19444335583ec9e093fc5e78812cd5d1b879b556b34a4b5afe727342bba3592da1b46572c884aec9c05fae8a5b6a5bcce110df7e00f0c53f326870f71988bcee258c859da9f6f814ad6a7c11b85c9d79c44825008ac4fddf4ffb247cef5f316d649442cdfa628196cdf4e2436412a6c4913b7790bd97cb9175a710dc6ade468f0756aecaa295505b84e78fd4f97dd0d377856195113973792ebf96f4b0723a0aad222119b9b06abc37333a78c36dca1b6291ac359814aa7391068c364600897cf7b91baf52c500dc102ca4810d6a284726deb07939f933bd9f0f271c05a3cc32805539f32af37a174c29d333d26375f000944f0c1fddf5dd505900363358fd43fd6b0186c7dedd5a37e0ce8dfd14782800497aed0721383a2efde855004c1ee0314e67e9945b7a3cdf5aa5480d71384f2d518338e61340998918792e58c47663600529ee34f317d45794ed85853356a144be0728fb1e4e68a0caf591ca4f717035582ecc24bf1497a724af94dd4342ad3e55aad1489e48e604bc71dec0f91fe6e2235827334f04f0238fd2106983a0ec4b8491ec4d204efba0f1ee531856e3b64c0c8b20ef1e677d3ec29b900610172193025774ca5b9b2e4b57527d4816b9316d14353f0717cae83f5a57391f5c596f2f2a6ca08d4581e2210b55dec93848ef0afd880f8f70ab6cf8aff61ecda6ae7667b5b2392b64fb5cc71805d17b849875ba6112ca1646b2b43d401e68e1923faa7807dbeff9f84e51b04c95c80fc884f39a22abb0f376690562b327313cfe7ac7553b27420160dc52a82d6a024ddc4f205d84d54b8e3e5e1f4b662518b3bc0bf5db5cc2688d2d50a8b20f97033cef826fe587f36066c4fee264ff4277bea02029eaebafe117701a130a1a676b383671e361a3c77355f6670846b347cd491bc501f7c2a15917f88e36599486ec992572c578d1213be24634fb651d03a6afb6cfa7fe710c16e5ecfeb778633f8aef387d7bb5d6d052d74cf268222d9bb78feeda4b6de4a4f3d7d3a83f8f4f36c11866eb60c5ddf40e36dea005c9b0e04f5b9a0bc0746b92994802eada2c8ea4a79008b05c9889ce6bea9620328f0190c83f459ffa076696aadec1ba43bbc97664696a0f366493b72eb4f9d55f7e55cea2323710aad24b9be5a9263409158ad02dd40830fb1c8f2e51367c77297b7b613d66c2cc4fb4ad91f429841cae794c9c5870b1000861dce289466a888888819c9418b51882b86074fa829eff2ddf4d5443c3dd81527751d4443d92adfa6eb06374dd70869e35e4dcae87958ff020bfe29f91bf7f260721b1d64c2fcce6ca46190c20efc7b7837ff91d5931afd5c55bafcef5202704002c3e31d6fa84a5db28f81cce32e5bbd160a718f01f33f725940c5cb0afd5bd6ec50bd742dbc4cbcf625fa045b95237e457c9422f84d941f7b804f8a53f5158cc008c82b8b07f299dc71faab7a829445ef0fe99c785c46b8ae17ed8def8770d0e3da69ec2a8a9f99d120395c1c2d93e61d034457336dcf66bd43398da7b261aa75a5a2a5555932cb90ca89dd3837f98b1cfc85ab632d83e41804ddcc1fe3887b1c777a83adb3859ee97b57debb05b780f3dcbdb8295bc39d51e49ac5d9ca9b2a464106871eca462e0077e91413ea4d78d9f94d6a41ae45528d8b3b1512c90e3230a306aece5b5db5746d8955b9cb55a82c9893e049dd77ff5624a56fca25eac3e77e05fe2581313d408d36d6e164911f0b00e55a2f10d8fc0429330523f16475f98d3fd0e582879aa6c61557875b1cd80101f23cfd0121d60554ef8c6b87eca080692ac8963803f5ffa5eb3", 0x1000}, {&(0x7f0000000080)="50c9d916716eb668f88cdc520fe23523df1a2e43d5e5baeee79926980ec7b944e4f1b3307d726ae83948d4d41cfbac239f1c56df6a23143ca6a74b238f32e63b9b863af4a32d402fbfbb5db339a684df17217f3ab3f0d6656740d2488c2261f93fed48725669f51ff32364fc1ee7fae6c00cc76b80d557f43b8ea3c07ce46d477bfe4049b98ea6f5b9ecb034539a723ac166bcf0cb531c4460d1891519731d7b4591b4fe5aee09932f27f39f48465ca417376553d0a98c25600191f6630c1425170db37262fee285f360294b974bf068c163c5f44ce84fec7b3f24b771a1d8dd4b2b3c475a93", 0xe6}], 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) [ 1028.187153] audit: type=1400 audit(1553627867.045:77): avc: denied { create } for pid=5689 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_crypto_socket permissive=1 [ 1028.197776] binder_alloc: 5690: binder_alloc_buf size 103079215104 failed, no address space 19:17:47 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000000040), 0x8000000000fec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) r2 = dup2(r0, r1) ioctl$PPPIOCSMRRU(r2, 0x4004743b, &(0x7f00000000c0)=0xca) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1028.197783] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 1028.197801] binder: 5690:5699 transaction failed 29201/-28, size 0-103079215104 line 3255 [ 1028.197916] binder: 5690:5699 Release 1 refcount change on invalid ref 0 ret -22 19:17:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) fchdir(r0) r1 = syz_open_dev$binder(0x0, 0x0, 0x2) r2 = fcntl$dupfd(r0, 0x0, r1) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000040)={@remote, 0x8001, 0x0, 0x0, 0x8, 0x5}, &(0x7f0000000080)=0x20) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) 19:17:47 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x3, 0x14, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) fallocate(r0, 0x4, 0xbf, 0x1) pselect6(0x40, &(0x7f0000000040)={0x50000000000000, 0x6, 0x1, 0x9, 0x0, 0xff, 0x80000000, 0x1}, &(0x7f00000000c0)={0x1, 0x4, 0x4, 0x9, 0x2, 0xfffffffffffffffc, 0xfff, 0x7fffffff}, &(0x7f0000000140)={0x9, 0x0, 0x8000, 0x6d8c, 0xf8d, 0xbb, 0x80000001, 0x20}, &(0x7f0000000180)={0x0, 0x989680}, &(0x7f0000000200)={&(0x7f00000001c0)={0xeb37}, 0x8}) [ 1028.204467] binder: BINDER_SET_CONTEXT_MGR already set [ 1028.204475] binder: 5690:5702 ioctl 40046207 0 returned -16 [ 1028.204560] binder_alloc: 5690: binder_alloc_buf, no vma 19:17:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) write$P9_RREAD(r2, &(0x7f0000000040)={0xea, 0x75, 0x1, {0xdf, "b6b24d600fc23b9bf80b88efd6596a9f0f21d2afc5954e08d7190aec902f16a7fd2b5b85e01e66d717aba52d0c095c3935276281c6dc718af8a2d4b4540241d66565c6fa7e4b3e5400b5c7ca7c1d1be34ea24465fadfba8dd6efc7f660f79b9966cca51454f2d5089d31bc01555ca6343f497aa08f1122678fca521d82786feb092a1cac3fafcf5e11473aae792b600644f14c0e4e6e7c376a1ee869978b5daedf7a821c86b4b64b5f570f508d13c0568c1c925b81ddfbfabd6e6af7c3ca215a436b53960deaa13bd35418ec0f899222726e3db52ebd5ef33eb5d308e2b284"}}, 0xea) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) 19:17:47 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_bp={0x0}, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/enforce\x00', 0x0, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000000, 0x10, r1, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) write(r2, &(0x7f0000000000), 0xff0c) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) fsetxattr$security_smack_transmute(r0, &(0x7f0000000040)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000080)='TRUE', 0x4, 0x1) [ 1028.204576] binder: 5690:5699 transaction failed 29189/-3, size 0-103079215104 line 3255 19:17:47 executing program 5: getresuid(&(0x7f0000000040), &(0x7f00000000c0), &(0x7f0000000140)) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/mls\x00', 0x0, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f00000001c0)={&(0x7f0000000000/0x4000)=nil, 0x4000}, &(0x7f0000000200)=0x10) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r2 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r2, 0x0, 0x2000424, 0x1) write(r2, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r2, r2, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1028.204610] binder: 5690:5702 Release 1 refcount change on invalid ref 0 ret -22 [ 1028.204970] binder: undelivered TRANSACTION_ERROR: 29189 19:17:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000480)={0x0, 0x0}, &(0x7f00000004c0)=0xc) r3 = getuid() syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000040)='./file0\x00', 0x8001, 0x6, &(0x7f0000000700)=[{&(0x7f0000000080)="cd72e1c97e60bbac12599fe74c3791db43f66a0560559e6faa2ff4f358f4ab32516e8134a60e29cafd97e03ee08e0c79cef58db7312c6bcbe2067d62939c5729ab883911ea93757e5fc52e551a86e6c3fb5984df62e07bc083172d5aa0549e3ec722c24830c50ac6d7aa89445b30162e3355ff11b12db251c2efb6aa2c779e6a0b492619774db554b7953dd378a2932e5968c334e28982d54819772f8b1d3e3613dc72365e4762eb8d5ee8c9e4ad379a05c727d3df4c2f8cd845fdcbf5c2403d2557243da33b8cd46e54f5d566cbe88dd010f259265928aa3674f7fa48b8106f59", 0xe1, 0x3}, {&(0x7f0000000180)="75705aabb4d8c3f61133cab79c5010eda0f01fbe00c57ca2f82bb392faf0a6b480ea176d3c1781992a8a0f587b295e461f6b90", 0x33, 0x7f}, {&(0x7f0000000280)="0d563b377e992d4a26b6a0effc20f2c03d4220e6775144490b666914e4b0c556f53a4b84ce1bbbbf53dd5b02513022a81a67275bb35ed81d1121ade080dd1abd28f32187a03ac97bbaaf16dad9c0", 0x4e}, {&(0x7f0000000380)="e6cb5cf321c565370b6e0afd425dc9f8c01b12300d95044223f4cb468357118decbca0553e7f05b8520b98e8368cc4abad7e3d2a09687c8a13913900db647ecfdc012d2ede8cf228dcb7efc94043cb263f12a3e04ab51645c389e13ef8973308ae9d6f75f5", 0x65, 0x7f9}, {&(0x7f0000000540)="95409f13a78767e0ce6ad102f2d08e4e39b961a6b90347402e7c51b32134dc6d9b7f6aa2db867932ed5883c2e38704670a0c07a9c9bdf57d93e7f97a503ff37fa063d7e46cacd28141c96c5d3b1ce0ce59f0086aff5473ffe33ad5c6c81ff5a412da0ee940b43f53ff85b5763a638640838a43569b69be287532f9a108d51439b552462554a3fdf0d6ebe27b13c663ccb7942d217065e268", 0x98, 0x8}, {&(0x7f0000000600)="1b0d4525aceb009a945ac4c29f36690d3fd07523afae8836418d7b35df5ebb02b6d7bc42d7263c027a5f3d326d7864f70fdbd9071f92c948309f4d5bc2fe0ba13c2859215d5e450dc04727ed691d7c9106badcea3f1a7eb4c05f6cdd002ff34d4ec84581151108233673b895bdcef97e19b10d702a31e6be7abc40a0304a54bc1cad22834653f19e4d07564f30ff50c0b4b3994b60641bc39f89129526fd6f5b72bbffe16d75b24bc58d854120d378e92af4975e1f9c7d1c2b0b0a0dc3c0284f553eb49cbd43c34b8532aef27117d90d95", 0xd1, 0x7fffffff}], 0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="757466383d312c646973636172642c756e695f78653d6d697865642c666f776e6572d7", @ANYRESDEC=r2, @ANYBLOB=',fowner<', @ANYRESDEC=r3, @ANYBLOB=',\x00']) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) [ 1028.205013] binder: undelivered TRANSACTION_ERROR: 29201 [ 1028.269758] binder_alloc: 5704: binder_alloc_buf, no vma [ 1028.269803] binder: 5704:5708 transaction failed 29189/-3, size 24-8 line 3255 19:17:47 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r2, r1, &(0x7f0000001000), 0x4000000000fed) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1028.277929] binder: 5704:5708 Release 1 refcount change on invalid ref 0 ret -22 [ 1028.291757] binder: BINDER_SET_CONTEXT_MGR already set [ 1028.291766] binder: 5704:5708 ioctl 40046207 0 returned -16 [ 1028.292087] binder_alloc: 5704: binder_alloc_buf, no vma [ 1028.292104] binder: 5704:5708 transaction failed 29189/-3, size 24-8 line 3255 [ 1028.292162] binder: 5704:5714 Release 1 refcount change on invalid ref 0 ret -22 [ 1028.292747] binder: undelivered TRANSACTION_ERROR: 29189 [ 1028.292787] binder: undelivered TRANSACTION_ERROR: 29189 [ 1028.349831] binder: 5717:5720 Release 1 refcount change on invalid ref 0 ret -22 [ 1028.368951] binder_alloc: binder_alloc_mmap_handler: 5717 20001000-20004000 already mapped failed -16 [ 1028.369044] binder: BINDER_SET_CONTEXT_MGR already set [ 1028.369053] binder: 5717:5720 ioctl 40046207 0 returned -16 [ 1028.369100] binder_alloc: 5717: binder_alloc_buf, no vma [ 1028.369120] binder: 5717:5723 transaction failed 29189/-3, size 24-8 line 3255 [ 1028.369422] binder: undelivered TRANSACTION_ERROR: 29189 [ 1028.369488] binder: send failed reply for transaction 1481 to 5717:5720 [ 1028.369532] binder: undelivered TRANSACTION_COMPLETE [ 1028.369539] binder: undelivered TRANSACTION_ERROR: 29189 [ 1028.455849] binder: 5728:5731 Release 1 refcount change on invalid ref 0 ret -22 [ 1028.469801] binder_alloc: binder_alloc_mmap_handler: 5728 20001000-20004000 already mapped failed -16 [ 1028.470479] binder: BINDER_SET_CONTEXT_MGR already set [ 1028.470487] binder: 5728:5735 ioctl 40046207 0 returned -16 [ 1028.478273] binder_alloc: 5728: binder_alloc_buf, no vma [ 1028.478293] binder: 5728:5737 transaction failed 29189/-3, size 24-8 line 3255 [ 1028.478381] binder: 5728:5731 Release 1 refcount change on invalid ref 0 ret -22 [ 1028.478922] binder: undelivered TRANSACTION_ERROR: 29189 [ 1028.478964] binder: send failed reply for transaction 1486 to 5728:5731 [ 1028.478997] binder: undelivered TRANSACTION_COMPLETE [ 1028.479004] binder: undelivered TRANSACTION_ERROR: 29189 [ 1028.541008] binder: 5741:5743 Release 1 refcount change on invalid ref 0 ret -22 [ 1028.583640] binder: BINDER_SET_CONTEXT_MGR already set [ 1028.583696] binder: 5741:5748 ioctl 40046207 0 returned -16 [ 1028.584164] binder: 5741:5745 Release 1 refcount change on invalid ref 0 ret -22 [ 1028.584472] binder: send failed reply for transaction 1491 to 5741:5743 [ 1028.584509] binder: undelivered TRANSACTION_COMPLETE [ 1028.584515] binder: undelivered TRANSACTION_ERROR: 29189 19:17:48 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f0000000540)={0x0, 0x0, 0x1, 0x0, [], [{0x8c, 0x7f, 0x1, 0x7ff, 0x3, 0x4}, {0x2, 0x0, 0xadd, 0xfffffffffffff801, 0xc3bd, 0xbcf}], [[]]}) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$RTC_SET_TIME(r2, 0x4024700a, &(0x7f0000000080)={0xe, 0x5, 0x5, 0x7, 0x3, 0x76d, 0x3, 0x0, 0x1}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) accept$packet(r2, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000100)=0x14) ioctl$sock_inet6_SIOCADDRT(r2, 0x890b, &(0x7f0000000140)={@empty, @ipv4={[], [], @remote}, @remote, 0xffffffff00000000, 0xfffffffffffffffd, 0x8, 0x500, 0x3, 0x24, r3}) 19:17:48 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r2 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x100) ioctl$TIOCLINUX6(r2, 0x541c, &(0x7f00000000c0)={0x6, 0xc}) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:48 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r3, &(0x7f00000001c0), 0x7ba27d3a) read(r2, &(0x7f0000000200)=""/250, 0x29e4ba6b) r4 = getpgid(0xffffffffffffffff) perf_event_open(&(0x7f0000000100)={0x3, 0x70, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3ff, 0x400, 0xa, 0x401, 0x6, 0x1f, 0x100, 0xe75, 0x400, 0x9, 0x5, 0x1f, 0x1, 0x3, 0x5, 0xfffffffffffffffe, 0x2, 0x7, 0x10000, 0x5, 0x7994332, 0x4, 0x20, 0x1, 0x6, 0x7ff, 0xc39, 0x2, 0x8, 0x6, 0x3, 0x0, 0x101, 0x3, @perf_bp={&(0x7f0000000000), 0x2}, 0x0, 0xffff, 0x2, 0x7, 0x100000000, 0x4, 0x6}, r4, 0x5, r2, 0x9) 19:17:48 executing program 0: r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_MON_PEER_GET(r0, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000280)={&(0x7f0000000140)={0x118, r1, 0x816, 0x70bd28, 0x25dfdbfd, {}, [@TIPC_NLA_MON={0x34, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xffffffffffff345c}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2e}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xc4}]}, @TIPC_NLA_MEDIA={0xd0, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, [@TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf4b}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7ff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3f}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x408}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0x118}}, 0x800) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/net/tun\x00', 0x80000, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000300)='/proc/self/net/pfkey\x00', 0x2000, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r3 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r3, 0x0, 0x2000424, 0x1) write(r3, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r3, r3, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r3, 0x0) ioctl$TUNSETSTEERINGEBPF(r2, 0x400454d1, &(0x7f0000000080)) 19:17:48 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) fsetxattr$trusted_overlay_origin(r1, &(0x7f0000000040)='trusted.overlay.origin\x00', &(0x7f00000000c0)='y\x00', 0x2, 0x3) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1029.176550] binder: 5764:5767 ioctl c0c0583b 20000540 returned -22 [ 1029.201513] binder: 5764:5767 Release 1 refcount change on invalid ref 0 ret -22 19:17:48 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000000200)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) r2 = request_key(&(0x7f0000000040)='.request_key_auth\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000140)='nr0\x01\x00', 0x0) r3 = request_key(&(0x7f00000001c0)='asymmetric\x00', &(0x7f0000000300)={'syz', 0x3}, &(0x7f0000000240)='nr0\x01\x00', r2) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r2, &(0x7f0000000180)='dns_resolver\x00', &(0x7f0000000280)=@keyring={'key_or_keyring:', r3}) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f00000002c0)=0x2) r4 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000600)='/selinux/mls\x00', 0x0, 0x0) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000680)='TIPC\x00') sendmsg$TIPC_CMD_GET_NETID(r4, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x4020}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x1c, r5, 0x8, 0x70bd26, 0x25dfdbfb, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004}, 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:48 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) write$P9_RCLUNK(r2, &(0x7f00000000c0)={0x7, 0x79, 0x1}, 0x7) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) ioctl$EXT4_IOC_GROUP_EXTEND(r1, 0x40086607, &(0x7f0000000140)=0x5) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)=r2) [ 1029.224720] binder: 5764:5767 ioctl c0c0583b 20000540 returned -22 [ 1029.231699] binder_alloc: binder_alloc_mmap_handler: 5764 20001000-20004000 already mapped failed -16 [ 1029.243117] binder: BINDER_SET_CONTEXT_MGR already set [ 1029.249940] binder: 5764:5784 ioctl 40046207 0 returned -16 [ 1029.282300] binder: 5764:5781 Release 1 refcount change on invalid ref 0 ret -22 [ 1029.282313] binder_alloc: 5764: binder_alloc_buf, no vma [ 1029.282332] binder: 5764:5767 transaction failed 29189/-3, size 24-8 line 3255 19:17:48 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$notify(r0, 0x402, 0x80000000) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f00000001c0)) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffff8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0xc055b92900ccfbf, 0x0) write$P9_RREADLINK(r1, &(0x7f0000000180)=ANY=[@ANYBLOB="100040f13ac55454a49d7a5f4a000017"], 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000440)={'bond_slave_0\x00', 0x0}) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f0000000480)={r2, 0x1, 0x6, @remote}, 0x10) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) prctl$PR_SET_TSC(0x1a, 0x0) ioctl$EVIOCGKEYCODE(r3, 0x80084504, &(0x7f00000000c0)=""/147) write$P9_RLOCK(r3, &(0x7f0000000000)={0x8, 0x35, 0x2, 0x2}, 0x8) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f00000001c0), 0x7ba27d3a) read(r4, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:48 executing program 0: r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$PPPIOCGFLAGS1(r0, 0x8004745a, &(0x7f0000000140)) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r2 = memfd_create(&(0x7f00000000c0)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x1) syz_emit_ethernet(0x33, &(0x7f0000000180)={@random="6fbe4a11e556", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xf}, [], {@arp={0x806, @generic={0x31c, 0x88ff, 0x6, 0x1, 0xa, @local, "b3", @broadcast, "172fc73d3ff7ed0f9f4896f8d09658fd"}}}}, &(0x7f00000001c0)={0x1, 0x3, [0x52e, 0x566, 0xfc4, 0xe79]}) fallocate(r2, 0x0, 0x2000424, 0x1) write(r2, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r2, r2, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x10, r2, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x400454d1, &(0x7f0000000080)) 19:17:48 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) prctl$PR_GET_FPEXC(0xb, &(0x7f0000000040)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) getpid() ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:48 executing program 2: arch_prctl$ARCH_GET_FS(0x1003, &(0x7f0000000000)) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x2001e, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) arch_prctl$ARCH_MAP_VDSO_X32(0x2001, 0x8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x280000, 0x0) ioctl$TIOCLINUX2(r2, 0x541c, &(0x7f0000000380)={0x2, 0x40, 0x10000000000, 0x53, 0x5, 0x4}) sendmsg$nl_route(r2, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)=@mpls_delroute={0x24, 0x19, 0xd00, 0x70bd27, 0x25dfdbfb, {0x1c, 0x20, 0xa0, 0x5, 0xff, 0x3, 0x0, 0x7, 0x3700}, [@RTA_TTL_PROPAGATE={0x8, 0x1a, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x800) getpid() r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r3, 0x40505412, &(0x7f0000000080)={0x3, 0x6, 0x3, 0x0, 0x7}) [ 1029.328064] binder: undelivered TRANSACTION_ERROR: 29189 [ 1029.328093] binder: release 5764:5767 transaction 1495 out, still active [ 1029.328098] binder: unexpected work type, 4, not freed [ 1029.328100] binder: undelivered TRANSACTION_COMPLETE [ 1029.380393] binder: send failed reply for transaction 1495, target dead 19:17:48 executing program 5: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$EVIOCGLED(r0, 0x80404519, &(0x7f0000000140)=""/86) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r2 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r2, 0x0, 0x2000424, 0x1) write(r2, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KDADDIO(r0, 0x4b34, 0x3) sendfile(r2, r2, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x400454d1, &(0x7f0000000080)) 19:17:48 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = syz_open_dev$mice(&(0x7f00000001c0)='/dev/input/mice\x00', 0x0, 0x325103) getsockopt$IPT_SO_GET_REVISION_MATCH(r1, 0x0, 0x42, &(0x7f00000000c0)={'icmp\x00'}, &(0x7f0000000140)=0x1e) r2 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r2, 0x2, 0x0, 0x801) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000200)={0x6, {{0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88) write(r2, &(0x7f00000009c0)='/', 0x1) sendfile(r1, r2, &(0x7f0000000180), 0xfec) ioctl$sock_inet_SIOCGIFPFLAGS(r1, 0x8935, &(0x7f0000000040)={'syzkaller1\x00', 0xfff}) syncfs(r1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:48 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0xfffffffffffffffc, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) poll(&(0x7f0000000040)=[{r0, 0x182}, {r1, 0x414}, {r0, 0x20}, {r1, 0x2}, {r0}], 0x5, 0x7) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f0000000180)='\x00', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/member\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1029.449015] binder_alloc: 5808: binder_alloc_buf, no vma [ 1029.484145] binder: 5808:5809 transaction failed 29189/-3, size 24-8 line 3255 [ 1029.502168] binder: 5808:5820 Release 1 refcount change on invalid ref 0 ret -22 [ 1029.544006] binder: BINDER_SET_CONTEXT_MGR already set [ 1029.553556] binder: 5808:5828 ioctl 40046207 0 returned -16 [ 1029.560298] binder_alloc: 5808: binder_alloc_buf, no vma [ 1029.565949] binder: 5808:5820 Release 1 refcount change on invalid ref 0 ret -22 [ 1029.579766] binder: undelivered TRANSACTION_ERROR: 29189 [ 1029.596687] binder: 5808:5809 transaction failed 29189/-3, size 24-8 line 3255 [ 1029.604987] binder: undelivered TRANSACTION_ERROR: 29189 19:17:48 executing program 4: fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000500)={0x0, 0x0}) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000540)='/dev/keychord\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000480)={0x7, 0x70, 0x8000, 0x0, 0x2, 0x0, 0x0, 0x1, 0x84000, 0x2, 0x5, 0x800, 0x3, 0x8, 0x4, 0x2, 0x6, 0x7, 0x0, 0x0, 0x1, 0xb51c, 0x7d, 0x80000001, 0x8, 0xfffffffffffeffff, 0x3f, 0x8a6, 0x100, 0x8ba, 0xfff, 0xc0, 0x7fffffff, 0x69, 0x8, 0x2, 0x6, 0x100, 0x0, 0x40, 0x1, @perf_bp={&(0x7f0000000440), 0x8}, 0x100, 0x8001, 0x401, 0x8, 0x9, 0x3ff, 0x9}, r0, 0x4, r1, 0x9) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$net_dm(&(0x7f0000000140)='NET_DM\x00') r2 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x40000, &(0x7f0000000840)="881eea9c11aa858ebff50dae42338ed605b163a3ddbb7f5139341e97e9890f4386f0a79a8d830b8c69f9f08220cd6286a18baa4908fdbe3411bcfed5da32740d65b88f63db908bc3defe880aaf1a5d11bcf56ca817bc96224715a24e4774a07d3471c59c1cb7927a857e075c8d1f5bba26bf9171de16ab1da8af0dfb8ffb9790af4f0dbbffe3900f734eefc07a0bf3a9a0204f39bb58948e9f32f8c5798b46e2e74931f678fd6520a932e23533f50e34d1ec45e729ea0e9c8b88483eda121c796d15dd5f807e55b2cfb071e91e1ed0c2d0ad4069e9856b858ba4c398bd39a4643b9dc1e28899dc", &(0x7f0000000180), &(0x7f00000001c0), &(0x7f0000000680)="3dc18fb3176b2f2197907c958fb4bcf3f18d5d60dbe525b30ef68004f1a778fe21539d7f3c162950bfbeebb68cb793d24d8abf1dd974fda8898244736d491744fc5b7e08deca45c59dc73ddf23d4bd1b9a3bed11a8208294b2dd02f9e2f573de8bc1c7e11a64420bf79d27a532b0240e97d37a3f47a5664c486add32e1d05c9a0013d0d11c1225d24994b637090068f561ae36f57ff8316a8f110088") r4 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$VT_RESIZEX(r4, 0x560a, &(0x7f00000005c0)={0x74, 0x9, 0x3, 0x9, 0x9, 0x2}) write$P9_RREADDIR(r4, &(0x7f0000000580)={0xb, 0x29, 0x1, {0x7}}, 0xb) ioctl$TIOCMSET(r4, 0x5418, &(0x7f0000000000)=0x41e7) setsockopt$inet6_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f0000000300)=0x1, 0x4) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r4, 0x29, 0xd3, &(0x7f00000003c0)={{0xa, 0x4e23, 0x43, @local, 0xff}, {0xa, 0x4e24, 0x4, @mcast1, 0x100}, 0x8, [0xffff, 0xfffffffffffff825, 0x8, 0x100000000, 0x7, 0xc4c, 0x43b5658a, 0x3b3]}, 0x5c) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r5, &(0x7f00000001c0), 0x7ba27d3a) read(r5, &(0x7f0000000940)=""/250, 0x29e4bd1a) write$FUSE_POLL(r4, &(0x7f0000000100)={0x18, 0x0, 0x1, {0x7}}, 0x18) 19:17:48 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x8000, 0x0) ioctl$EVIOCGLED(r2, 0x80404519, &(0x7f00000003c0)=""/115) ioctl$EVIOCSREP(r2, 0x40084503, &(0x7f0000000440)=[0x0, 0x2]) getsockopt$IP_VS_SO_GET_SERVICE(r2, 0x0, 0x483, &(0x7f0000000140), &(0x7f00000000c0)=0x68) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) accept$packet(r2, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000200)=0x14) fstat(r3, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast2, @in6=@loopback, 0x4e20, 0x6, 0x4e21, 0x6, 0xa, 0x80, 0x20, 0x33, r4, r5}, {0x0, 0x3, 0x6, 0x0, 0xff, 0x8000, 0xfdf, 0xa95e}, {0x8, 0x401, 0xdfa2}, 0xe0a, 0x6e6bb5, 0x2, 0x0, 0x3}, {{@in=@multicast2, 0x4d6, 0x2b}, 0xa, @in=@remote, 0x3506, 0x2, 0x1, 0x0, 0x7fffffff, 0x7, 0x7}}, 0xe8) 19:17:48 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = dup3(r2, r1, 0x80000) write$P9_RREMOVE(r3, &(0x7f0000000040)={0x7, 0x7b, 0x2}, 0x7) sendfile(r2, r1, &(0x7f0000000140)=0xffffffffffffffff, 0xfeb) setsockopt$inet6_MCAST_LEAVE_GROUP(r1, 0x29, 0x2d, &(0x7f0000000180)={0x3, {{0xa, 0x4e24, 0x8000, @mcast2, 0x100}}}, 0x88) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:48 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x541000, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="066304403eeebac8"], 0x0, 0x0, 0x0}) r2 = accept4(0xffffffffffffffff, &(0x7f0000000000)=@tipc=@name, &(0x7f0000000080)=0x80, 0x800) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00') sendmsg$TIPC_CMD_GET_NODES(r2, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4b85e30ba7b7b074}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r3, 0x0, 0x70bd25, 0x25dfdbfd, {}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x4000000) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x6c, 0x0, &(0x7f0000000480)=[@dead_binder_done, @dead_binder_done={0x40086310, 0x1}, @acquire={0x40046305, 0x1}, @reply_sg={0x40486312, {{0x3, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x30, &(0x7f00000002c0), &(0x7f0000000380)=[0x18, 0x38, 0x28, 0x30, 0x40, 0x38]}, 0x8}}], 0x8a, 0x0, &(0x7f0000000540)="d2a2786ce22000d4dddc8c11abb2f852092c56bfe5ac6496a9cd4720f0907ac1106e6310af4a391af36f7186f3d775f2764fae0c68a5d8190628dc65d2fb440c8f2c2601cb166b25a5804c9cc1808b0b53c2622b8b4af948070ef7fe5c924b010b31c94f8fe6ca9679651d536efefc44ca6f98a19f03cbcc8814e617fb66c4ee1ea66fd2c54b1f750b05"}) [ 1029.803468] binder: 5845:5849 Release 1 refcount change on invalid ref -927273410 ret -22 [ 1029.824571] binder: 5845:5849 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1029.832403] binder: 5845:5849 BC_DEAD_BINDER_DONE 0000000000000001 not found [ 1029.840861] binder: 5845:5849 got reply transaction with no transaction stack [ 1029.881526] binder: 5845:5849 transaction failed 29201/-71, size 0-48 line 3026 [ 1029.892664] binder_alloc: binder_alloc_mmap_handler: 5845 20001000-20004000 already mapped failed -16 [ 1029.906901] binder: BINDER_SET_CONTEXT_MGR already set [ 1029.912349] binder: 5845:5849 ioctl 40046207 0 returned -16 [ 1029.919956] binder_alloc: 5845: binder_alloc_buf, no vma 19:17:48 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) setsockopt$inet6_udp_encap(r2, 0x11, 0x64, &(0x7f0000000280)=0x4, 0x4) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) r3 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/status\x00', 0x0, 0x0) ioctl$IOC_PR_RESERVE(r3, 0x401070c9, &(0x7f0000000200)={0x1, 0x1, 0x1}) ioctl$BLKRESETZONE(r3, 0x40101283, &(0x7f00000001c0)={0xff, 0xbb05}) openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/attr/fscreate\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)=r0) ioctl$EXT4_IOC_MIGRATE(r1, 0x6609) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f00000000c0)={0x0}, &(0x7f0000000140)=0xc) ptrace$pokeuser(0x6, r4, 0x9d, 0x3) 19:17:48 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x4}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x80000000) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:48 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r2 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x101000, 0x0) ioctl$KDSETLED(r2, 0x4b32, 0x5) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'rose0\x00', 0x1000}) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:48 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/rt_cache\x00') ioctl$EVIOCGKEYCODE(r0, 0x80084504, &(0x7f0000000040)=""/113) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x7ba27d3a) ioctl$RTC_VL_READ(r0, 0x80047013, &(0x7f0000000140)) read(r1, &(0x7f0000000200)=""/250, 0x29e4ba6b) personality(0x400000b) fsetxattr(r1, &(0x7f0000000180)=ANY=[@ANYBLOB="7379736dd174656d2e6e65742f72745f6361636865002096db7e56b03f52012c197298fd971e65d6dd1a24"], &(0x7f0000000100)='\x11\x00', 0x2, 0x2) 19:17:48 executing program 2: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/udplite\x00') getpeername$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @local}, &(0x7f0000000100)=0x1c) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_MOD(r3, 0x3, r2, &(0x7f0000000040)={0x4}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) [ 1029.919973] binder: 5845:5858 transaction failed 29189/-3, size 24-8 line 3255 [ 1029.920257] binder: 5845:5858 Release 1 refcount change on invalid ref -927273410 ret -22 [ 1029.922742] binder: undelivered TRANSACTION_ERROR: 29189 [ 1029.922796] binder: send failed reply for transaction 1503 to 5845:5849 [ 1029.922831] binder: undelivered TRANSACTION_COMPLETE [ 1029.922837] binder: undelivered TRANSACTION_ERROR: 29189 19:17:48 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\xa1E\x85\xd0\xfa\x00', 0x2}) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000001c0)={'team_slave_0\x00', &(0x7f0000000180)=@ethtool_rxfh={0x0, 0x2, 0x5, 0x800, 0x81, "fac4c1", 0x7ff, [0x101]}}) r3 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r3, 0x0, 0x2000424, 0x1) write(r3, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r3, r3, &(0x7f0000001000), 0xfec) tee(r3, r2, 0x6, 0x8) ioctl$TUNSETOFFLOAD(r0, 0x400454d0, 0x11) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000000, 0x11, r2, 0x0) r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$sock_inet_SIOCGIFNETMASK(r4, 0x891b, &(0x7f00000000c0)={'bridge0\x00', {0x2, 0x4e23, @multicast1}}) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r4) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:48 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) fallocate(0xffffffffffffffff, 0x0, 0x2000424, 0x1) write(0xffffffffffffffff, &(0x7f00000009c0)='/', 0x1) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000140)={{{@in6=@initdev, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in6=@mcast1}}, &(0x7f0000000240)=0xe8) lsetxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000280)=@v3={0x3000000, [{0x1, 0x100}, {0x8, 0x4}], r1}, 0x18, 0x3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1030.026162] binder: 5870:5873 Release 1 refcount change on invalid ref 0 ret -22 [ 1030.047342] binder: BINDER_SET_CONTEXT_MGR already set [ 1030.057744] binder: 5870:5873 ioctl 40046207 0 returned -16 [ 1030.064232] binder_alloc: 5870: binder_alloc_buf, no vma [ 1030.064251] binder: 5870:5881 transaction failed 29189/-3, size 24-8 line 3255 [ 1030.064641] binder: undelivered TRANSACTION_ERROR: 29189 [ 1030.064688] binder: send failed reply for transaction 1509 to 5870:5873 [ 1030.064721] binder: undelivered TRANSACTION_COMPLETE [ 1030.064727] binder: undelivered TRANSACTION_ERROR: 29189 19:17:49 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r3, &(0x7f00000001c0), 0x7ba27d3a) read(r2, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:49 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000040)='./file0\x00', 0x4) sendfile(r1, r1, &(0x7f0000001000), 0xfec) socket$key(0xf, 0x3, 0x2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000040)=0x0) write$P9_RGETLOCK(r2, &(0x7f0000000080)={0x2b, 0x37, 0x2, {0x2, 0x7e, 0x9, r3, 0xd, '/dev/binder#\x00'}}, 0x2b) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) 19:17:49 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) delete_module(&(0x7f0000000140)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x800) fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000000180)='trusted.overlay.redirect\x00', &(0x7f00000001c0)='./file1\x00', 0x8, 0x3) r3 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$UI_SET_SWBIT(r3, 0x4004556d, 0x6) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) pivot_root(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='./file0\x00') 19:17:49 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f00000001c0)='eth1trusted\x00', r1}, 0x10) accept4(0xffffffffffffffff, &(0x7f0000000140)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @remote}}}, &(0x7f0000000040)=0x80, 0x0) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x4e20, @remote}, 0x10) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r3 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r3, 0x0, 0x2000424, 0x1) write(r3, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r3, r3, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x13, r3, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:49 executing program 3: r0 = fcntl$dupfd(0xffffffffffffff9c, 0x0, 0xffffffffffffffff) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='cdg\x00', 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000040)=0x3, 0x4) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x7ba27d3a) read(r1, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:49 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000040)='/dev/keychord\x00', 0x600040, 0x0) sendmsg$nl_netfilter(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800c00}, 0xc, &(0x7f0000000140)={&(0x7f0000002000)={0x1544, 0xe, 0xd, 0x200, 0x70bd2b, 0x25dfdbff, {0x7, 0x0, 0x7}, [@nested={0x11c4, 0x0, [@typed={0x44, 0x82, @str='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f'}, @generic="acb26d8d5f3c2fa9c615bd6c09f288c62ce9823f930fa3002d7674e89409517365b630aab845ef9d9f03601f95d49ae58de17fee30aacec27dc6c3e1c4fad5505f3b048ebe7adad50a91dd80b80c7265403e1fad7cb82d085019404c4fe35c3ea9cfe10e74f75c7d43c464212177461ce70aad2808e8ec60f0962f23e258407e37dd463502280f8240c5e9cc844b471a9d03abc7f57eae8cbc77942cc884c7682ccb94d4db502df4bfb99b4782f09bfb0d23aa30ad05682989e93796086093ffd4d291b9e86a15ce2d0d7359257e5da3d2ddb6a47875a93de50c96f4d359bb379a85e75e261e851299f5bf60bd74b20ca2c38d92e1e8b1122100ea16ee5eb67018476bf8b72a12a8a5c38d89c958a1bdb167d23e806c426a713f88223fb3d058c2154a4bb398e00aee8e3035a9eb04ae93a92652d5d2edb8c0ed18661046d27927aac681bcefef7c3f0783c09ab963c04c8989eba95a01107ad736cc31615e2b34018d2f6d5dfdd6389c7169454a18637e0803ef9e5c5efd40b8d01f37f8a235fd1747552257fff988e9b24aeecc66a86b4619b8877cceacaac5e17e1c7bd467767c9df6ea1b0e3bdbfa31a21e120931a59f88cb91893782190894381f3555fc1ef8534168027b3fc32254317eee057eed882b36aef7a2bc90c5ef5dce725ad42711aa1101e4654f02cd47a4d0834e5ffceab6529df667028917814117de1eca2180da571e8eb6a64ad453536a80837875395f358f326e7970f485b916c4f101ce9f17fc3df33de37a0c91a48b48a5e82b22ba23e33172229b16788669c78381fa265d14ca4bb40f6029a28015f11b0b51da9b439694e73c9a22b03bc15de90f72b916e827d904c825384340bfba278b14b641203f115d2b4cad85057396be7e19afb3bc358df9fe00a1d766f4d1dd2f177c0578fff11a7dc04bcb7645c31cc5e36fd4d7326251d83e88469a8a8ee115a5952a1aaf17235f541c4680867b50b30086adfcc3ee067b477d29b6b066523d06cc215b2955636cd6f3463789bf6c3c5c33be2d5fbe79e2817a9174a9158df7d7d3d99f90af7122c696f90f2897ec7a2a91bf92a2cbeb26bc255e0431b3d92cedccb1885c87b84090816b5cb3fe80574a06f248a0a4009b86e44daa377368c4de84449072e63023f0100065fe467f406d1381e14268430b175a7635fa1cd3254587b93ffd7c5dd5104b3f91decb613353bdd3536ea83d8c0027ab7993621a9a7745f897546a437507ae5b83f38f12eaa05f02f5b91f1b4cb97ce32ff1774551274002888e2345baeb1907e8acc74a05d9ddfec168ee6e5984430b652fa883684f6c5a7e323373ccaf745478fce9b9161732c59777adee5cfbc6868ccb9fdecebb04754b5922eb4733189d61ae539c50544e2244b3294feb56883e3403ef68d88375eb46a92d6b24a863f8aef07e7d037474cac3bb9feb4c1cf839172132c8911ab35d501bda4d042f515e7e3987aff724400d198ad8c77c63e4b2ea4ab87d6de0763da0404261916176421c1d914790d589964574d73632f137b5d0e94ca67c2b23661fd8a96bcd22999c8e1318e6f4a620ded8ceb422a7a9639eaa116244d66db3f26386dc21ae8085e0c23d8463e8398e41358a924dbd829853e6cb98773e0c5b82e5262b41b76232034cf675f93f788554cdd34232a6e38e991ddac8d39cdf752094564f2b087c347eccc318b8f6226555825736fb9904f3b414322374cecc595304a8d5d83b0981ccf922891ef87e6fc0aad95321ebe80b7f92328c82b3cc5ac72135cda70f3621fe83f71fb54b48584d1ea8fb06a9aceefe833cd29323999f8e7adbdffe3f696378c09372e5c918c7b0203e2255958159080fe58cc5b5c4459c376eee449d6faa1b3caab7f5d9a19ea49c5eb925e30bf3eaeb32aa891e63af2927f4e5f9fcc9ea47de67d5c7d10deab508eac3d027f2819dce41ec44d3c157a83b6086f4b22915c052a992ba8fdd5ffb93078678a892ce2f1735a548426d7e1eb31cbab63dce82fd512c4bd8e5518e3dc44e69375912d967fd68ca9b3fc731c55249311842f1232077e93bfc2659b3c98e3d94dc2b2f27ae112fddb22f3b1afdaaed9bac03475f76a7a3450d152ece4e0c24c42192b8ecb0be7168da453980f74fcd1f0d0c05f0f42b5a7d915c91cb1c2f10a3272b5242872e2c7b8804b8a3d67f521bc7b61d0166fa6cf6e8ab555e360627ca3bfa05f0ef44607241a1cd8d1309432a6989ae1fbab76282dc1a04e6894f61bed99a26aede1e2c1290794e8ce54ecac9decd4704a1da69afaefd932e72e4c6e03216f4030269103067e1846a3bd1e338c7ff795100d756f0e46914ce71331427025896dbff0b0a26ff9a051a003bd56918da1ed4ea4da97c351ecb04c3938b52eda7758352e79ed3c70408b7ad156db9365af3ae677a164fbf415fa60993066bd9c1a690cd32d92d1269d94c164f6b5f425db010eaeb9592c6ecbe7c50883d3a592e9b9b4542401b831a70b0b47438657b84c4bb39a6336ba752cb8d4eca9100c5f19b9e0dcef42d1a71d2b260727f3baca360d00f4a47e571ab6a0e262eb54db5cca9d215991ee0c5b504a963dfdb0005447bd2e912ce7e6abf108e38ed5c641652942db1ec43e536a974cc08bf1d08cd10bc2531d63ee15ed8d19bab8d49d0738abb4587deacfdd2479c21a84dc3c51f9c796dc395dbf6fa7fa8348b7af339cd49588160e6631ba6a8afb105e02159c57202b217a9c20000a039a9b75ff5fa4c24cd09bf1df8329b99cdf52bb879844fb692bd61babc65a4d5eebec097d83de129dc917ca8675b23809908e16a1afb1e02d666e276c493bcefc9d5df1ed6e407d52be0281f91ded5346add306d42f47827b099ec728e1900d5a8ae7503de6fbf8d5d2cb8a171ceaa6f8490df97fbaa43b715bb16f609f05373249b419d075b66dccb0ee23e28f914adc667b813c96250fd2b207ab9de2cf5f38453b587a4fd93be312b905b7aa8c4a34008dd060c6a711b4289590b6ad542c77490fc186344331f5343535e51c6e5167ba81bfda91186908b223ff4d494a928a6d328d018febf258c68b124071d97c80dbc3dcea45dc27c691338c3683f36aa8e3901669efaf4eb20e1d043bc53794f2d1ef88129d3c893286ee329cca6302ec73fd9f298ac9b43b9942672eb2446283f298fa3cfa03d5b7bdc68d3994cc4384f0a3bf6911c53b5ddd671ed9dc42ec20ac911b587efbe26a9162dd19cc6fca1382d71bbc02f9ceeab03808a46561d098d56c3e3bd14cab33cc4a6cef130100a158e23e603d46be948e2eef0241b5a2dc03aebadfc4ab817ecb5fa77d1efe6d32917eff64e2390ec987163bad4624766a438c7eeed1f8158796ad2c3c622fb8f318ed26f07d15b0cb950574d398446147ad4037b540fe794f0628e9a43c3714f25a1d6d14b5fdd3062a1bb5dd59949aed109b303d11d433bf7767b7fa271dca85646aa9a32baaf57a91a007ca99ee8aa7796f81e6f6b0bb01152b70e251a2b4bead8ac42529c5e83d9b04c90279eeecc50708d9db7b74914b17d290268e5a4ef5dcba383dc9de996dcdcc3cbee3ff474e955ea5c4f568f5667f58034ee9d65676cc22806b0d4138c2f693325043760c99663e6ea400fe62eab0dbd3df0ea2b0cc84eed9b219f3ea644b96d0e2914b0a912f7f83de122d742502b59b284e00b2302a058c292041fe4f714d48b55a72351b05a8432eac64a418684e4f2d4d538f014193ba55eadadde84320c43927191801f1126ce194a8970c8cf46613e8cf86bb0bb720bd6bbebb2a3d2a1b794587037b6ddb4a0339b5c0951dc5a9a8acb8dcd018791570164dc756787d1f52867151db0344cb604a4d5f2e002266a51eb665d3b73af5b63a28b5ef464b008d50a31a7f306d55653d92ceaa518a52124d0c694a07840a59c77ddd57d63a1301f00adb1ac9a9947e09f1952a9159f2b0b24ea83adeabb89574342b03738393c8767ec9286644451da78683cfb139200cc356528096f567e97db539fc2d27fa96236126b3557f2bd3c5efaba83ac8c065aee4cffb44ded8a5a35d7b519c218f776b2a216ec1355e0b1502bc9fb25e6705252485b7f2115446286b5f644070f2a48f1dec546d7fdf9ba2860e9a32b01fd73a37ca60e42f72aa38533d153b6bf6b7d98b9b8a59c696f558ed2d7679d4a73a67b2b9a4fa6d303c4c388f47bb5972ffdd1313106c8757e7782bd55e0394b981724f647ac83a3548860b08f4237505fef98ffe1323fee046b4a377bc083fff3cb47595649cad720b5310a8f8c61767abb6e7e989e537c12c3dfb2d54cf8e344a2fca804f75635cc028ff6c36da99148caf4cf611aa5092af462f45302ef475e56b3b3d76b33a696ed39fc41ed48a3b99eba01b698970d0d36e0f0041debd4e88e06256f36d9dbcf5b25f4d79646787b454f6235549eaa3ce1e98b3fab99f60795db1a0fd9151a06b4c4dd5b322f4aeaa7b21bdfbf650c565448b460030244ff1473fea61334731e98f9cfa4a211392b12244d8e9d0780d84c7ac884fcad69434b88bbbc59fe5efb747573caec3c29a01ac9ccdbf4d3d8bec90e040f785fa76b0435c1464b426ed42b25614188ec7dde0aa9a51559d352bc9e11d1795f89988eece703b09ca54bc4bf57fdda4e623a944b3c7f1034fe6b0abc113a5b6ce6fb0045483c7f1f2fab7d779f55195d1dee0cabb81a5938440c3970d882d6c69414e33430520bd4c9016ccd7fc0e9b8b3f81c69885aa6de4189fa701a23a25a9269c88a654ea22fd93ca98413b66e68be1bf4e83cb7d20acf21bb6e75789eec3671849f30d30f2010270280239ac377e4d57e6e816ea1731d67f47e1c01d86ec42f16200ddb254f15e3a332a8e8763283aba63627de33fe06f2b07d92b352512f17941a5f2401dc8b91da0e2330e14615a5e0f6ee9fa8d0aede0f4c9f3e6eefd2ac7bf263254cfd0a183b447e0549168889ef5de3fb071e483b29fc8c0e056c89eaf182864fb35850fdf642d2e2252f1ff41526a6a0a94c0614a153922f657898d5e10f77d6ceb608012fce4505b5110316f9d2777a424895ae220034f53553a8b60630a1ffc6dcdb98949a2168c40e16f4037b3311854ac2ce6db705fb816cb8a7c464c2dfa371b5623e2b7aaaaf03d10d253708feedf5abeb008936e802674b03bdf19140af28409c244b6539e6477d7f3c786f91edb5293b1c6474779db2bf432c312259dad419b4552d7a5eee20127eced121c473bc5c23198422ad0662076b3aad5c97140ddad54dd671694999c9aa5de37c9578a087c772c49a63db7a3c1c3abc10fd78bdeab593d329fa709d3abd542e0e43e4b10a616d84f9df094b5b879e625b890f3b9267d322cc30b116a5b5fd16cf14edbbd9294a700a56dfd29963409ee262f9a8aa018816c65c1ba1a139f0aadc53caa18fc6ca3ed3557e15b86f1a2e93bdc585b769da4762757d22d187c0afd5b759992f9837a66b9bc74da6a4e0ea7fe4ae2a96878dc4b4df49e4a64df200e3d213a1dcbf1f5066d61696ffd2536e73881d1da02962a0de50451f5557ae760bea79f4357a0dfccd3bff7a5b61b36ccb7a65b7b796099c255d3050aadbadb58bc8371b5d14246f511cb8818adb083420c4f34cf905a72d3a9015c47dfc5477642ea2e42e9543c34e0f557f0b4d4a8db68cb589c88948965f5ddac050ba8bbc2ab1719624df33b0d5026935cd50dd62093392fa95ae93156c6f128cf702bdc6418f88152e42e466d51e81e02e3acf5c3ad0f1", @generic="376ea1eb9cf47879592e3e8a33a787ba4d2755354bed4e1d2b54d02850d5baca0b49431c6b069fa7cdfd299adc0ec0e066665667e1070cc20946ff8910a99725db098990cbe642bccb868a2931b53e37da1ff41a58e2b9875d69d6b1891ba20c8d64551ce71aacf8a4cbe8b6d1b3ccc32a969513a3eed65c885075d1c7548dca142e64924a166e5edde77e50c52785254d0e98a7cae8f76e406f942f3aec7d9c3f9e1a01208a8fb01211320db99e37f98ede163c", @generic="3bede5b71456e28052e1a8fc3557d3ff47c6b91fa442dfc5e4eebc0dfc1099047cebad1504868b4a790dae0ec3227cb49c21ff267defee1daf32b5c272d219f832af195d569d62ea7b1856cf1fb74b8b8c1d4cf1b3717840bf78d1d17c66d810b2356a2cb6481d5d1a8e7722c6d385aaa24c3a97b5da5a36274e04294d68c78e3d0a298738d66e7594023297087d87bd09d8d85bec45e9d3e196e55f68636449825aaee983d2dbb6c74da17c0fbbf91baa3239bca15318e26d4b60b9d3319f8ac6273789ae3b88"]}, @typed={0x8, 0x23, @u32=0x2a7}, @nested={0x1f8, 0x88, [@typed={0x3c, 0x37, @binary="ea6f2342a7d017ac9ceca5753097205ce21e859a502a5ac89a996c2e5b5c4eb776b1f8d030098b5c8e4fafe4fcb0b335b2b49134845b"}, @generic="81131a3e4cbb75b13177764d20e39f6ee95ecbc744ad57bdd042c319c9e8f4c5dc6c46d7374f154da91448003acbf82e3f6766259fc399d519d4d8a73c39028955d72fac3cb6939c6e601c9d4c6dfc90ca63798cfba0d68804566d29af6f08c93cbb743bda60ca4b044cb80f4d04b059fad75119e9acc18c6613a94d65919d0a5037d1fb5cdbdda2b098381c2b599604efa3d6c7fd091647fe02620d760de3edb78f7d25dad04757c450d265bdfc68830d62f3ed1b42377fdd0ae71778031bc8cef910951222ad86d6d386fce2b9", @generic="de1c46c544f8935445d5cbc373233a0141c15c4b431900ad063b6c03f71ef2302f80d24a32aa40c627ca9785965570bdb4422e", @generic="129a32e2faace11fc3dd19bae427442ab6", @generic="b03a9e7fde0d035feb51d35d6ace034f7cb701e282a3f2a83f38ff8b023261289ee3bb1edad63b9cbdf99e0a5f8f38781b86021ef04663d4404640337f498465a22897e7093fd9269c09af3cf8872ad35d18cc1e3b7ffe2e4655d292796561a256713880c9b0c9f709647438dfd857c61bc6a65116dc21b337d46d8e120ddd4f813a8873247b1269a94da8ac638296b73c68ad3531f1e0dce5ed680e52804b89a9d332906bb6"]}, @generic="75d84c105839f72c014be5b1ae2d6174f95ca40834bf5758d89980e02aafedd840e1ef2bcd11e628e4a6e16e9bbb15f3fcd50a403737b577f4209e2a7e3c43b646c0c9b59ecdf6368d735bc6f087df221fcd6e5b6e665f5c555bf409c5ccfc45555d2e99d9636e77c7e73b6c848234f70c", @nested={0xf8, 0x54, [@generic="efd24e048def753dfb0292312a3f496e89bb374c702e51bef1c3bdd415fcd1a00360a120fbbbf164f7bfd28585c706d1680aa06b49616d0d3a4a439d460c91faa7c6d665966a1f3b8ead62dd226966bf3016ef96ccfd4951b3b1fe0354c82fa6ee0ccdefed680afd73297a9cef37193e87f59e65492430b1b9f0c067", @generic="71ed651cb646b7b4129f395ad6ad848c8a4307be531d3664b22302865dbe9f5635e87f29be4fd6fe55a16ddc83b26e9d6f830077ebe25728ee2e2f1e5d36c79398fe19e1efc3432dce900a9c72735da3ac8c72295ef87e40a6c086e56f39a83c29bf011cf245cc54442ff5634215e8e427e7e212c18a"]}]}, 0x1544}, 0x1, 0x0, 0x0, 0x8000}, 0x80) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r2 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r2, 0x0, 0x2000424, 0x1) write(r2, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r2, r2, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:49 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1030.635492] binder: 5901:5911 Release 1 refcount change on invalid ref 0 ret -22 [ 1030.665159] binder_alloc: binder_alloc_mmap_handler: 5901 20001000-20004000 already mapped failed -16 19:17:49 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'ip6tnl0\x00', 0x2000}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x105000, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1030.686171] binder: BINDER_SET_CONTEXT_MGR already set [ 1030.698167] binder: 5901:5925 ioctl 40046207 0 returned -16 [ 1030.716930] binder_alloc: 5901: binder_alloc_buf, no vma [ 1030.722444] binder: 5901:5919 Release 1 refcount change on invalid ref 0 ret -22 19:17:49 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f00000000c0)='nr0\x01\x00', 0xffffffffffffffff) fallocate(r1, 0x0, 0x2000424, 0x1) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'team_slave_0\x00', 0x100}) syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0)='TIPCv2\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) r2 = fcntl$getown(r0, 0x9) syz_open_procfs(r2, &(0x7f0000000180)='net/rpc\x00') ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1030.722821] binder: send failed reply for transaction 1514 to 5901:5911 [ 1030.722835] binder: undelivered TRANSACTION_COMPLETE 19:17:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x800) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x0, 0x0) ioctl$PIO_UNIMAPCLR(r2, 0x4b68, &(0x7f0000000040)={0x10000, 0x8329, 0x2ca8}) 19:17:49 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = socket$inet6(0xa, 0xa, 0x7) bind$inet6(r2, &(0x7f0000000180)={0xa, 0x4e23, 0x10000, @empty}, 0x1c) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) openat$keychord(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/keychord\x00', 0x200000, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/checkreqprot\x00', 0x2000000000100, 0x0) r4 = dup(r3) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000240)=r4) r5 = accept$inet6(0xffffffffffffff9c, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast1}, &(0x7f00000000c0)=0x1c) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r5, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) [ 1030.722842] binder: undelivered TRANSACTION_ERROR: 29189 [ 1030.794785] binder: 5901:5911 transaction failed 29189/-3, size 24-8 line 3255 [ 1030.807713] binder: undelivered TRANSACTION_ERROR: 29189 [ 1030.863030] binder: 5942:5948 Release 1 refcount change on invalid ref 0 ret -22 [ 1030.891661] binder_alloc: binder_alloc_mmap_handler: 5942 20001000-20004000 already mapped failed -16 [ 1030.905011] binder: BINDER_SET_CONTEXT_MGR already set [ 1030.912648] binder: 5942:5948 ioctl 40046207 0 returned -16 [ 1030.918933] binder_alloc: 5942: binder_alloc_buf, no vma [ 1030.918949] binder: 5942:5952 transaction failed 29189/-3, size 24-8 line 3255 [ 1030.919162] binder: 5942:5952 Release 1 refcount change on invalid ref 0 ret -22 [ 1030.928139] binder: undelivered TRANSACTION_ERROR: 29189 [ 1030.928178] binder: send failed reply for transaction 1519 to 5942:5948 [ 1030.928205] binder: undelivered TRANSACTION_COMPLETE [ 1030.928210] binder: undelivered TRANSACTION_ERROR: 29189 19:17:49 executing program 4: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vga_arbiter\x00', 0x4000, 0x0) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000000340), 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_FIOGETOWN(r3, 0x8903, &(0x7f0000000000)) r4 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r6, &(0x7f00000001c0), 0x7ba27d3a) read(r5, &(0x7f0000000200)=""/250, 0x29e4ba6b) sendmsg$nl_route(r4, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)=@setneightbl={0x14, 0x43, 0x208, 0x70bd2d, 0x25dfdbff, {0x1c}}, 0x14}, 0x1, 0x0, 0x0, 0x40040}, 0x40) 19:17:49 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) signalfd4(r2, &(0x7f0000000140)={0x37}, 0x8, 0x80000) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) r3 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, &(0x7f00000000c0)=r3) 19:17:49 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) socket$nl_route(0x10, 0x3, 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r0, 0x6612) write(r1, &(0x7f0000000440)="753d09e91d4c030fb533569cb6fe2cdee90c33f0ef170c2592199e7b3aa681eda9c4938ebaab84e66c870a6bf9a079dafece58d2968e1a1ab36fa103c95951f7e39e36448e99dfb7b3e6bb1f5aeb572175154eead48804864e3bdb96c90fd6d5ba53c339db554565e69b37a2ca771020f108ef26eb5900edce095bfb278b2446a18e02ee0917daddaf51503013c5aa3e867bb6039b269392feda5e68552fe97785e3afcdf83319441785954e9c4800e282d613", 0xb3) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x800000004e22, 0x0, @ipv4={[], [], @local}}, 0x1c) listen(r2, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000040)=0x100000001, 0x4) r3 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r3, &(0x7f0000000200)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000ac1414aa0b4824ca945f64009400050028925aa80000000000000080000efffeffe809000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0xa81, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:49 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) write$FUSE_INIT(r2, &(0x7f0000000140)={0x50, 0x0, 0x3, {0x7, 0x1d, 0xffffffffffff8001, 0x8, 0x8001, 0x9, 0x51f, 0x3f}}, 0x50) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3382, 0xffffffffffffffff, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0xa, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f00000000c0), 0xfe8) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) r2 = fcntl$dupfd(r0, 0x0, r0) write$P9_RWRITE(r2, &(0x7f0000000000)={0xb, 0x77, 0x2, 0x8}, 0xb) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000040)={0x6f, @loopback, 0x4e23, 0x0, 'fo\x00', 0x20, 0x8001, 0x56}, 0x2c) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="f609f27800"], 0x0, 0x0, 0x0}) [ 1031.072123] binder: 5964:5970 unknown command 2029128182 [ 1031.084756] binder: 5964:5970 ioctl c0306201 200001c0 returned -22 [ 1031.110829] binder_alloc: binder_alloc_mmap_handler: 5964 20001000-20004000 already mapped failed -16 [ 1031.126094] binder: BINDER_SET_CONTEXT_MGR already set [ 1031.131731] binder: 5964:5970 ioctl 40046207 0 returned -16 [ 1031.137912] binder_alloc: 5964: binder_alloc_buf, no vma [ 1031.137929] binder: 5964:5978 transaction failed 29189/-3, size 24-8 line 3255 [ 1031.144645] binder: 5964:5981 unknown command 2029128182 [ 1031.144655] binder: 5964:5981 ioctl c0306201 200001c0 returned -22 [ 1031.151708] binder: undelivered TRANSACTION_ERROR: 29189 [ 1031.151755] binder: send failed reply for transaction 1524 to 5964:5970 [ 1031.151791] binder: undelivered TRANSACTION_COMPLETE [ 1031.151798] binder: undelivered TRANSACTION_ERROR: 29189 19:17:50 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) fstat(r0, &(0x7f0000000040)) getsockopt$inet6_mreq(r2, 0x29, 0x1c, &(0x7f0000000100)={@local, 0x0}, &(0x7f0000000140)=0x14) sendmsg$nl_route_sched(r2, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000300)={&(0x7f0000000180)=@getqdisc={0x38, 0x26, 0x8, 0x70bd26, 0x25dfdbfe, {0x0, r3, {0xf, 0xffe0}, {0xb, 0xfff3}, {0xfff2, 0xf}}, [{0x4}, {0x4}, {0x4}, {0x4}, {0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x8080) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) getsockname$packet(r1, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000003c0)=0x14) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f00000001c0), 0x7ba27d3a) read(r4, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:50 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'vcan0\x00', 0x2}) write$input_event(r0, &(0x7f00000001c0)={{0x77359400}, 0x2}, 0x18) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) writev(r0, &(0x7f0000000580)=[{&(0x7f0000000300)="52efacd48cc92e", 0x7}, {&(0x7f0000000340)="ef47b1f736ead199e37d85c7587186225ab2b6174285cd7a1c75486e4135b07c83618156104e7d7159ab5883d4", 0x2d}, {&(0x7f0000000380)="c91bc9bd75fbb2a4c155e56349fbb176141bb9f279b2ea4a272d05b47cea32f6bb8ef2e5cda9c0678c37bcc54e8a5d350050c1b68f7e7bc7a0c86779057b1b00e81d81e2a4774e0297071a1db627587778410090426ee24772321356ebd8009ab9b219813b45abdf21800da3d6597366e6f815263d92863ab913542b6476ed8e59392e7ad5f1de33d5a80ccfb5312e10a4a74f19f1750ea446d18364f833876507d585552ab3a52817bf421dabf42393f3f06edbc5b9a8fc23e1190863d4aa65d2b9a3cc7ed394e3aa51de3f8c36f6de89453286b4df0f4116982d8db7fc1f1e29", 0xe1}, {&(0x7f0000000480)="3ed778d388ec945fa507c2d7526e776056c900837eb79bdc2e8cab4992bc55e0c83be587305b4c4ea68f6307e567970463f503eef95353c0c2b150e05f8ba19ca247ab1d646b458a49cb877af79d11c8f989806d4bd407de4a2d9eb29351bafb5e38e134e17cd2e90d5c7d3a2a7d0348a8f8339583d9e3c33275ef2f972a77757ec0c12717505225fdb5c709872cc74c38e085d06bc6e7447f338e20f4c5463b8a57a1a68dadfc176bd81131dc7131af58bcdc74c41a2d19b3eb19a301059c80a8fed61ef047a61f5ba9cfed7a795c97aa6e1d2709", 0xd5}], 0x4) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/avc/hash_stats\x00', 0x0, 0x0) getpeername$packet(0xffffffffffffff9c, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000280)=0x14) setsockopt$inet6_IPV6_PKTINFO(r2, 0x29, 0x32, &(0x7f00000002c0)={@ipv4={[], [], @broadcast}, r3}, 0x14) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) r4 = openat(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0x10000, 0x20) write$UHID_GET_REPORT_REPLY(r4, &(0x7f0000000180)={0xa, 0x9, 0x9, 0x9}, 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) link(&(0x7f00000005c0)='./file0\x00', &(0x7f00000000c0)='./file0\x00') 19:17:50 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = gettid() syz_open_procfs(r1, &(0x7f0000000040)='net/protocols\x00') r2 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r2, 0x0, 0x2000424, 0x1) write(r2, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r2, r2, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) ftruncate(r2, 0x7) 19:17:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x10000000000000) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getresuid(&(0x7f0000000080)=0x0, &(0x7f00000000c0), &(0x7f0000000100)) sendmsg$nl_generic(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)={0xf4, 0x3d, 0x105, 0x70bd29, 0x25dfdbfb, {0x4}, [@typed={0x8, 0x45, @uid=r3}, @generic="6640d875f147026a326f32efc8a28156b595fcbcf7a1f13662321db8b72787ae59749adece43336e3c88cea44167759521ad96c15d41f8cbe25dfd5e41945e3c5939395070a07cbef17fc294e3e878ea891246cde6623be20ffb20727452b4b27aff145dae697bdeb79d3a3619c856deb40202c2721ae161c2ed3984d035168ffc0c6b321b8c2319eba3110d45cf72eb50be1b80a31e51385855f168b0c66148f95a0b8eeeefa43874f87c568f9f53042850c1cba420ef83db0680203a9ab7916d42e00bbac115c8b02d3e7be1", @typed={0x8, 0x88, @fd=r0}]}, 0xf4}, 0x1, 0x0, 0x0, 0x11}, 0x840) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x105, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="066300"], 0x0, 0x0, 0x0}) 19:17:50 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$UI_ABS_SETUP(r2, 0x401c5504, &(0x7f0000000280)={0x4, {0xf277, 0xfffffffffffffffb, 0x61da, 0x4, 0xff, 0x1f}}) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x2480, 0x0) sendmsg$nl_netfilter(r3, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x53edaa541fe9618a}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x84, 0x5, 0x9, 0x102, 0x70bd2c, 0x25dfdbfd, {0x3, 0x0, 0x5}, [@typed={0x40, 0x29, @binary="bae36b502912452c16e41907c9e934c35211a97022d486a1900a020329ddb3ccde5c984d367fd042157ffb686c87a5a5e8a5dd8973964527fa22"}, @generic="4e91c25f541d5c77e0a28a68a20f5b3687fcda50ffc13e553fae0c417b3cd5d55654267e", @typed={0x4, 0x96}, @typed={0x8, 0x5e, @fd=r2}]}, 0x84}, 0x1, 0x0, 0x0, 0x10}, 0x20040804) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:50 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r3, &(0x7f0000003840)=[{{0x0, 0x0, &(0x7f0000002240), 0x1ba, &(0x7f00000022c0)}}, {{0x0, 0x0, &(0x7f00000026c0), 0x0, &(0x7f0000002700)}}], 0x75a, 0x0) getsockopt$IP_VS_SO_GET_SERVICE(0xffffffffffffffff, 0x0, 0x483, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) getsockopt$inet6_tcp_int(r2, 0x6, 0x2f, &(0x7f0000000180), &(0x7f00000001c0)=0x4) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r5, &(0x7f00000001c0), 0x7ba27d3a) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r2, 0x6, 0x21, &(0x7f0000000300)="aed51e34b446ba488bffe2dd491aa684", 0x10) fsetxattr$security_smack_transmute(r0, &(0x7f0000000000)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000100)='TRUE', 0x4, 0x1) read(r4, &(0x7f0000000200)=""/250, 0x29e4ba6b) [ 1031.474225] binder: 5990:5998 ioctl c0306201 20000440 returned -14 [ 1031.495840] binder: 5990:5998 unknown command 25350 [ 1031.516725] binder: 5990:5998 ioctl c0306201 200001c0 returned -22 19:17:50 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) pipe2(&(0x7f0000000240)={0xffffffffffffffff}, 0x80000) r3 = syz_genetlink_get_family_id$team(&(0x7f00000002c0)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000bc0)={{{@in, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in6=@local}}, &(0x7f0000000cc0)=0xe8) getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x24, &(0x7f0000000d00)={@multicast2, @multicast1, 0x0}, &(0x7f0000000d40)=0xc) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffff9c, 0x8933, &(0x7f0000000d80)={'team0\x00', 0x0}) accept$packet(0xffffffffffffffff, &(0x7f0000000e00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000e40)=0x14) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000e80)={{{@in=@local, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@remote}}, &(0x7f0000000f80)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000001c00)={{{@in6=@loopback, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@initdev}}, &(0x7f0000001d00)=0xe8) getpeername$packet(0xffffffffffffff9c, &(0x7f0000001e00)={0x11, 0x0, 0x0}, &(0x7f0000001e40)=0x14) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1f, &(0x7f0000001e80)={@mcast1, 0x0}, &(0x7f0000001ec0)=0x14) getpeername(0xffffffffffffffff, &(0x7f0000001f00)=@can={0x1d, 0x0}, &(0x7f0000001f80)=0x80) accept$packet(0xffffffffffffff9c, &(0x7f0000004000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000004040)=0x14) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000004080)={0x0, @loopback}, &(0x7f00000040c0)=0xc) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000004100)={{{@in6=@mcast2, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@broadcast}}, &(0x7f0000004200)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000043c0)={{{@in=@dev, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@dev}}, &(0x7f00000044c0)=0xe8) getsockopt$inet_mreqn(r1, 0x0, 0x24, &(0x7f0000004500)={@dev, @dev, 0x0}, &(0x7f0000004540)=0xc) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000005b80)={'team0\x00', 0x0}) accept$packet(0xffffffffffffffff, &(0x7f000000b540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f000000b580)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f000000b5c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f000000b600)=0x14) clock_gettime(0x0, &(0x7f000000c940)={0x0, 0x0}) recvmmsg(0xffffffffffffffff, &(0x7f000000c800)=[{{&(0x7f000000b640)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, 0x80, &(0x7f000000b700)=[{&(0x7f000000b6c0)=""/57, 0x39}, {0xffffffffffffffff}], 0x2, &(0x7f000000b740)=""/92, 0x5c}, 0x8}, {{0x0, 0x0, &(0x7f000000ba40)=[{&(0x7f000000b7c0)=""/197, 0xc5}, {&(0x7f000000b8c0)=""/235, 0xeb}, {&(0x7f000000b9c0)=""/41, 0x29}, {&(0x7f000000ba00)=""/42, 0x2a}], 0x4, &(0x7f000000ba80)=""/241, 0xf1}, 0x8}, {{&(0x7f000000bb80)=@l2, 0x80, &(0x7f000000bfc0)=[{&(0x7f000000bc00)=""/238, 0xee}, {&(0x7f000000bd00)=""/129, 0x81}, {&(0x7f000000bdc0)=""/68, 0x44}, {&(0x7f000000be40)=""/33, 0x21}, {&(0x7f000000be80)=""/147, 0x93}, {&(0x7f000000bf40)=""/80, 0x50}], 0x6, &(0x7f000000c040)=""/142, 0x8e}, 0x7ff}, {{0x0, 0x0, &(0x7f000000c200)=[{&(0x7f000000c100)=""/51, 0x33}, {&(0x7f000000c140)=""/147, 0x93}], 0x2, &(0x7f000000c240)=""/252, 0xfc}, 0x4}, {{&(0x7f000000c340)=@rc, 0x80, &(0x7f000000c700)=[{&(0x7f000000c3c0)=""/160, 0xa0}, {&(0x7f000000c480)=""/73, 0x49}, {&(0x7f000000c500)=""/247, 0xf7}, {&(0x7f000000c600)=""/105, 0x69}, {&(0x7f000000c680)=""/124, 0x7c}], 0x5, &(0x7f000000c780)=""/104, 0x68}, 0x2}], 0x5, 0x40000000, &(0x7f000000c980)={r21, r22+10000000}) getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f000000c9c0)={0x0, @loopback, @dev}, &(0x7f000000ca00)=0xc) getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000012c40)={0x0, @multicast1, @dev}, &(0x7f0000012c80)=0xc) getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000012d80)={0x0, @remote, @local}, &(0x7f0000012dc0)=0xc) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000012e00)={{{@in=@initdev, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}}}, &(0x7f0000012f00)=0xe8) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000012f40)={{{@in6=@ipv4={[], [], @remote}, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6}}, &(0x7f0000013040)=0xe8) sendmsg$TEAM_CMD_OPTIONS_GET(r2, &(0x7f0000013780)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x440}, 0xc, &(0x7f0000013740)={&(0x7f0000013080)={0x68c, r3, 0x208, 0x70bd26, 0x25dfdbfb, {}, [{{0x8, 0x1, r4}, {0x190, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x4720}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r5}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r6}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x4}}}, {0x64, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x34, 0x4, [{0x4, 0x1c6, 0x5, 0x642}, {0x8, 0x4, 0x4, 0x70d}, {0x400, 0x235d000000000000, 0x2, 0x10000}, {0xffff, 0x2, 0x85, 0x100}, {0x2, 0xffff, 0x7, 0x4}, {0x0, 0x9, 0x3, 0x6583}]}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r7}}}]}}, {{0x8, 0x1, r8}, {0x4}}, {{0x8, 0x1, r9}, {0x180, 0x2, [{0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0xffff}}, {0x8, 0x6, r10}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x80000001}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x3}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x81}}, {0x8, 0x6, r11}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x60ab}}, {0x8, 0x6, r12}}}]}}, {{0x8, 0x1, r13}, {0xc4, 0x2, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r14}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r15}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8, 0x1, r16}, {0xec, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r17}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r18}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x400}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x4}}}]}}, {{0x8, 0x1, r19}, {0x44, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r20}}}]}}, {{0x8, 0x1, r23}, {0xb4, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x3}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r24}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x4}}, {0x8, 0x6, r25}}}]}}, {{0x8, 0x1, r26}, {0x7c, 0x2, [{0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r27}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r28}}, {0x8}}}]}}]}, 0x68c}, 0x1, 0x0, 0x0, 0x40}, 0x10) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x8, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) r29 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r29, 0x6, 0x16, &(0x7f00000000c0)=[@mss={0x2, 0x5}, @mss={0x2, 0x620}, @sack_perm, @timestamp, @mss={0x2, 0x8001}, @sack_perm, @sack_perm], 0x7) setsockopt$inet_msfilter(r29, 0x0, 0x29, &(0x7f0000000140)={@remote, @loopback, 0x1, 0x7, [@multicast2, @remote, @remote, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, @local, @dev={0xac, 0x14, 0x14, 0x29}]}, 0x2c) [ 1031.526029] binder_alloc: binder_alloc_mmap_handler: 5990 20001000-20004000 already mapped failed -16 [ 1031.538015] binder: BINDER_SET_CONTEXT_MGR already set [ 1031.562229] binder: 5990:5998 ioctl 40046207 0 returned -16 19:17:50 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f00000000c0)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x1) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) write$P9_RUNLINKAT(r2, &(0x7f0000000180)={0x7, 0x4d, 0x2}, 0x7) socket$inet_udplite(0x2, 0x2, 0x88) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) prctl$PR_SET_TIMERSLACK(0x1d, 0x1f) io_setup(0xffffffffffff7fff, &(0x7f0000000040)) 19:17:50 executing program 1: lsetxattr$trusted_overlay_upper(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='trusted.overlay.upper\x00', &(0x7f00000000c0)={0x0, 0xfb, 0x29, 0x7, 0x5, "776a986b22327c318efa0ca0b2f2ce87", "92e06b7ce8ac5b102b829ca94c75dfc25cfc850b"}, 0x29, 0x1) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r2, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) 19:17:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$RTC_UIE_OFF(r2, 0x7004) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) [ 1031.577416] binder: 5990:6007 unknown command 25350 [ 1031.582646] binder: 5990:5998 ioctl c0306201 20000440 returned -14 [ 1031.610527] binder: 5990:6007 ioctl c0306201 200001c0 returned -22 19:17:50 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) socket$packet(0x11, 0x0, 0x300) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:50 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fstat(r1, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000001c0)={{{@in, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@remote}}, &(0x7f00000002c0)=0xe8) lstat(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r1, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000000b80)='/dev/zero\x00', 0x0, 0x0) mount$fuseblk(&(0x7f0000000ac0)='/dev/loop0\x00', &(0x7f0000000b00)='./file0\x00', &(0x7f0000000b40)='fuseblk\x00', 0x80002, &(0x7f0000000bc0)={{'fd', 0x3d, r7}, 0x2c, {'rootmode'}, 0x2c, {'user_id', 0x3d, r4}, 0x2c, {'group_id', 0x3d, r6}, 0x2c, {[{@allow_other='allow_other'}, {@max_read={'max_read', 0x3d, 0x9}}, {@allow_other='allow_other'}, {@max_read={'max_read', 0x3d, 0x3}}, {@blksize={'blksize', 0x3d, 0x200}}, {@blksize={'blksize', 0x3d, 0x400}}], [{@measure='measure'}, {@dont_hash='dont_hash'}, {@euid_eq={'euid', 0x3d, r2}}, {@fowner_lt={'fowner<', r5}}, {@defcontext={'defcontext', 0x3d, 'staff_u'}}, {@func={'func', 0x3d, 'KEXEC_KERNEL_CHECK'}}]}}) getresuid(&(0x7f0000000440), &(0x7f0000000480), &(0x7f00000004c0)=0x0) getresuid(&(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580)=0x0) r10 = geteuid() fstat(r1, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r12 = geteuid() getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000640)={{{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@multicast2}}, &(0x7f0000000740)=0xe8) fstat(r0, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x8, &(0x7f0000000800)=[0xffffffffffffffff, 0xee00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000840)={0x0, 0x0, 0x0}, &(0x7f0000000880)=0xc) r17 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r17, 0x0, 0x41, &(0x7f0000000940)={'filter\x00', 0x3, [{}, {}, {}]}, 0x58) fstat(r0, &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$system_posix_acl(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='system.posix_acl_default\x00', &(0x7f0000000a00)={{}, {0x1, 0x2}, [{0x2, 0x0, r2}, {0x2, 0x0, r3}, {0x2, 0x5, r4}, {0x2, 0x0, r5}, {0x2, 0x1, r8}, {0x2, 0x3, r9}, {0x2, 0x4, r10}, {0x2, 0x1, r11}, {0x2, 0x6, r12}, {0x2, 0x5, r13}], {0x4, 0x3}, [{0x8, 0x2, r14}, {0x8, 0x5, r15}, {0x8, 0x0, r16}, {0x8, 0x4, r18}], {}, {0x20, 0x2}}, 0x94, 0x2) fallocate(r1, 0x8000000000000003, 0x6, 0x5) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1031.677559] binder: 6022:6027 unknown command 0 [ 1031.685951] binder: 6022:6027 ioctl c0306201 200001c0 returned -22 [ 1031.709473] binder_alloc: binder_alloc_mmap_handler: 6022 20001000-20004000 already mapped failed -16 [ 1031.745010] binder: BINDER_SET_CONTEXT_MGR already set [ 1031.745019] binder: 6022:6027 ioctl 40046207 0 returned -16 [ 1031.792882] binder_alloc: 6022: binder_alloc_buf, no vma [ 1031.803861] binder: 6022:6028 transaction failed 29189/-3, size 24-8 line 3255 [ 1031.830644] binder: undelivered TRANSACTION_ERROR: 29189 [ 1031.836884] binder: send failed reply for transaction 1530 to 6022:6027 [ 1031.855441] binder: undelivered TRANSACTION_COMPLETE [ 1031.868699] binder: undelivered TRANSACTION_ERROR: 29189 19:17:51 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) write$P9_RREADDIR(r0, &(0x7f00000000c0)={0x49, 0x29, 0x2, {0x5503, [{{0x40, 0x2, 0x4}, 0x2, 0x6, 0x7, './file0'}, {{0x8c, 0x1, 0x6}, 0x8000, 0x2, 0x7, './file0'}]}}, 0x49) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x7ba27d3a) read(r1, &(0x7f0000000200)=""/250, 0x29e4ba6b) setxattr$trusted_overlay_opaque(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='trusted.overlay.opaque\x00', &(0x7f0000000080)='y\x00', 0x2, 0x1) 19:17:51 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f0000000040)) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) fsetxattr(r0, &(0x7f00000000c0)=@random={'user.', '/dev/net/tun\x00'}, &(0x7f0000000140)='nr0\x01\x00', 0x5, 0x2) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:51 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/sctp\x00') setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, &(0x7f0000000140)={'filter\x00', 0x7, 0x4, 0x4c8, 0x2a0, 0x0, 0x2a0, 0x3e0, 0x3e0, 0x3e0, 0x4, &(0x7f00000000c0), {[{{@uncond, 0xf0, 0x160}, @unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x4, 0x80000001, 0x10000, 0x0, 0x0, "fcb9f8bf4f240d0868a767abd1efa822cbab2999950f3f3be429ec98f2dd31377c9f81745d565acaa185500e2d13665e0bf62742801c3c165ecec99205bc9c38"}}}, {{@arp={@initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, 0xffffffff, 0xffffffff, @empty, {[0x0, 0xff, 0xff, 0xff, 0x0, 0xff]}, @empty, {[0xff, 0xff, 0xff, 0x0, 0xff, 0xff]}, 0x4, 0x2, 0x683, 0x3, 0x8, 0x9, 'lo\x00', 'syzkaller0\x00', {0xff}, {0xff}, 0x0, 0x11}, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @rand_addr=0x353c, @multicast2, 0x4}}}, {{@arp={@local, @local, 0xffffffff, 0xff, @empty, {[0xff, 0xff, 0x0, 0xff, 0xff]}, @mac=@broadcast, {[0x0, 0xff, 0xff, 0x0, 0xff]}, 0x3, 0x8c, 0x9, 0x7, 0x1c95, 0xffff, 'nr0\x00', 'nlmon0\x00', {0xff}, {0xff}, 0x0, 0x10}, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @loopback, @empty, 0xf, 0x1}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x518) 19:17:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r1) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) 19:17:51 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000440)={0xffffffffffffffff, r0, 0x0, 0x8, &(0x7f0000000340)='lowlan1\x00'}, 0x30) perf_event_open(&(0x7f00000003c0)={0x1, 0x70, 0x3, 0x6a8b, 0x3, 0x4a58, 0x0, 0x1, 0x10, 0x2, 0x8, 0x7fffffff, 0x6, 0x7, 0x3f, 0x165a, 0x9, 0x2d, 0x45ce6af8, 0x0, 0x4, 0x2, 0x100, 0x7, 0x80000001, 0x101, 0x3, 0xe3b9, 0x2, 0x2, 0x6, 0x2f, 0x5, 0x3, 0x8000, 0x81, 0x3, 0x2, 0x0, 0x4, 0x4, @perf_bp={&(0x7f00000001c0), 0xe}, 0x4, 0x401, 0x20, 0x4, 0xffff, 0x7, 0x5}, r1, 0x10, r0, 0x8) r2 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r2) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000300)='NET_DM\x00') write(r4, &(0x7f00000001c0), 0x7ba27d3a) getgroups(0x5, &(0x7f0000000040)=[0x0, 0xee01, 0xffffffffffffffff, 0x0, 0xee00]) r6 = getgid() ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r2, 0x4008240b, &(0x7f0000000480)={0x1, 0x70, 0x3, 0x1, 0x6, 0x1, 0x0, 0x7, 0x401, 0xb, 0x100, 0x7, 0x9, 0x9, 0x146c, 0xf7, 0x1, 0x1f, 0x6, 0x9, 0x1, 0xfffffffffffffffa, 0x2, 0x81, 0x7, 0x9, 0x100, 0x4, 0x0, 0x3593cf7b, 0x1, 0x400, 0x2, 0x1f, 0x2, 0x10001, 0x1, 0x5, 0x0, 0x3, 0x3, @perf_config_ext={0xd7, 0x9}, 0x1041, 0x40, 0x40, 0x9, 0x210, 0x5, 0x5}) stat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setresgid(r5, r6, r7) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:51 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r0, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:51 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000000080)='/dev/net/tun\x00', 0x0) r2 = dup3(r0, r0, 0x80000) write(r2, &(0x7f0000000140)="1df128680ae8541d04cf1030ac8298791194f6f9471108278b36cedc688f71b57bd5b9051f426ff426019387d8f94f5e54d627a6be737bde38e4400c6391e50195deef8b454951039d92f75c4488a094", 0x50) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r2, 0x400454d1, &(0x7f0000000040)=r2) [ 1032.504400] binder: 6050:6055 Release 1 refcount change on invalid ref 0 ret -22 [ 1032.523083] binder: BINDER_SET_CONTEXT_MGR already set [ 1032.528586] binder: 6050:6055 ioctl 40046207 0 returned -16 [ 1032.535169] binder_alloc: 6050: binder_alloc_buf, no vma [ 1032.535188] binder: 6050:6062 transaction failed 29189/-3, size 24-8 line 3255 [ 1032.535444] binder: undelivered TRANSACTION_ERROR: 29189 [ 1032.535489] binder: send failed reply for transaction 1535 to 6050:6055 [ 1032.535523] binder: undelivered TRANSACTION_COMPLETE 19:17:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = creat(&(0x7f0000000000)='./file0\x00', 0x30) ioctl$VT_DISALLOCATE(r2, 0x5608) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$FICLONERANGE(r1, 0x4020940d, &(0x7f0000000080)={r1, 0x0, 0x6ff, 0x1000, 0x80000001}) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r2, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f0000000540)={0x19c, r3, 0x102, 0x70bd27, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x14, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x2}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x5}]}, @TIPC_NLA_MON={0xc, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9}]}, @TIPC_NLA_LINK={0x9c, 0x4, [@TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xdc}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffff00000000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_PROP={0x44, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x401}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffffffffff8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x400000000000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100000000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}]}, @TIPC_NLA_MON={0x4c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xf4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xfffffffffffffeff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7fff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7d701434}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}]}, @TIPC_NLA_NET={0x18, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x800}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x1}]}, @TIPC_NLA_MON={0x34, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x4945}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xc000000000000000}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x80000001}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9}]}, @TIPC_NLA_NODE={0x34, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x101}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}]}]}, 0x19c}, 0x1, 0x0, 0x0, 0x20000000}, 0x800) mmap$binder(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x10, r0, 0x0) write$P9_RLERROR(r2, &(0x7f0000000040)={0x16, 0x7, 0x1, {0xd, '/dev/binder#\x00'}}, 0x16) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) 19:17:51 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x4, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) ppoll(&(0x7f0000000040)=[{r1, 0x20}, {r1, 0x4}, {r1, 0x252}, {r1, 0x400}, {r0, 0x2000}, {r0, 0x5080}, {r0, 0xa8}, {r1, 0x1000}], 0x8, &(0x7f0000000140)={r2, r3+10000000}, &(0x7f0000000180)={0x8}, 0x8) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:51 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x800000000000, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x8000000000000, 0x4000000000000000, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000000040), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='wchan\x00') openat$cgroup_ro(r2, &(0x7f0000000140)='pids.current\x00', 0x0, 0x0) [ 1032.535529] binder: undelivered TRANSACTION_ERROR: 29189 19:17:51 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r2 = open$dir(&(0x7f0000000040)='./file0\x00', 0x100, 0x7ed1b7692fab24a8) fchmodat(r2, &(0x7f00000000c0)='./file0\x00', 0x100) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1032.671599] binder: 6073:6076 Release 1 refcount change on invalid ref 0 ret -22 [ 1032.698783] binder_alloc: binder_alloc_mmap_handler: 6073 20001000-20004000 already mapped failed -16 19:17:51 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r0, &(0x7f0000000200)="2fb73e596c5850d7bf7f3fedc019483391505b352c036ae195e31a41207099eadc58230a7d0b147dbe6a22eb94650fc1431d1bb6379ae876c7c16750fa0f2274a65cb9c2d6ba78056f18c0b7717429eb79817c15569800fb125b05a15326c01945b830faa3c17347e564cc0b07b4aeac0180ce8a55704e2dd6c8ade3de070ad75397907aa375365162854b2f333e2731a5d585954114777e54ff7aa7252d39f65ffc2040f4957fa5788f652d9f0000000000000000000000ea010c92c0631f65b7e7b9cc2180", 0xc6) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1032.738086] binder: BINDER_SET_CONTEXT_MGR already set [ 1032.745516] binder: 6073:6076 ioctl 40046207 0 returned -16 [ 1032.760542] binder_alloc: 6073: binder_alloc_buf, no vma [ 1032.760563] binder: 6073:6090 transaction failed 29189/-3, size 24-8 line 3255 [ 1032.760608] binder: 6073:6092 Release 1 refcount change on invalid ref 0 ret -22 [ 1032.761182] binder: undelivered TRANSACTION_ERROR: 29189 [ 1032.761225] binder: send failed reply for transaction 1540 to 6073:6076 [ 1032.761254] binder: undelivered TRANSACTION_COMPLETE [ 1032.761259] binder: undelivered TRANSACTION_ERROR: 29189 19:17:52 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RRENAMEAT(r0, &(0x7f0000000000)={0x7, 0x4b, 0x2}, 0x7) write(r2, &(0x7f00000001c0), 0x7ba27d3a) ioctl$RTC_UIE_ON(r0, 0x7003) read(r1, &(0x7f00000004c0)=""/250, 0xfde1) 19:17:52 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) fadvise64(r0, 0x0, 0x7, 0x4) vmsplice(r0, &(0x7f0000000580)=[{&(0x7f0000000140)="058e5affb578f17c9644eea3301b0eda2f062958c86b90758dc867b426db83cf9943bd2a11ac2693d17258615e9870f6d0ba32f4a3c9a945d240055f806cf0776f8d9b3690dea7e39403c05544a5d23615fbf8870f48fabc3b9fc68e36e87f64fe1c51be91facdb39e93412513a85d86304ab74839d0058d683d960a0829220f243f2ec68a523612d8bcc740874edd458ef431633f5d105acebed37359b28a730617c732f3acea7a80aa72025552f70a1c66c10086bd4fed", 0xb8}, {&(0x7f0000000200)="74331a6220588736a41e887ad850d5fd91d22113492629581ad10e8ea21289f7fab5b9d4183abde886e49d5618f6b2cbea576c5027aa8a8b604e4533874bd94d9f7ca99a067a9d7339cbf441fe45c7fbd72bc0742ee091c429dc1d076231111aa8a94f5d7ecf5608bcdfa165e0d4e19e8f5be54fffadd228fd36753e0b95675047eca4e1c1fa6e4c2951e7524ad9ccd8e2b5cdab988def0f850718afa496addb3abd9228dd4702eb53e5a96490749609c69d416795087443e34123c6a38a56f303771931", 0xc4}, {&(0x7f0000000300)="44b2040429eafb1d50e4d476bb041afeae2268d0f29eeb4ceda31c01a44c59a4f8b80073b71a122d1d11842609366371269ad11eab0f6e625bd81e4d4d40fa303b40f72bc7a6e843d673737a83dd50a060dc62c6c8cb7d5ee01bdf1ca367c7979a2eda164b6c0a08fafe2919946a44c3631e929cc10405ee523932a0039866d48a6a701490c374389987720318efa022ec0fd1769761a888d2194e92535a3ee66728966b1ae88ee2ea2842e3501cc0ae8a67cca2a4dc327ade6eea97279c5e4f3c812d7370fa680c7bee", 0xca}, {&(0x7f0000000040)='{e', 0x2}, {&(0x7f0000000400)="e8b7b307b1baff5144db85b126e8eec4fdf89545e984510c56cc6d58e3705bb4be761ff158dc4a30a2211001d9c59e559067b79715e2b7519ce710022bcbbfe87cae49fb2b017cd050c4ed2a91b5343e0110b386a1aca23148ef37ba48522b0701fa30f2b9d8bb54fa038a0753b42fb7949fd149a2af886e807cd37e8bb2797511fdb92fe47e4dde9d9589a81c7e67eb2e99d8a1", 0x94}, {&(0x7f00000004c0)="6869bd62325bf9fada8bea701a2bdd7c54b1b38c9a810cf556ca7d1641af78f1a78b2aab20ff28d51128bf01ecd739accca1d4237076d7c60a984b4ee736a619a43a62db7a8397013837240d2c7285dda0e117fc8bdaa8346e0422ba9b8ffe6536db3abfd126eab08bc661fbbbd4b6abf89893a57d18d95dd58929b5f9cead922b11b90a6642eb11cae2055bc756032dfb5bb44b3daeeb2c3a552456f3d2f7", 0x9f}, {&(0x7f00000000c0)="f120bed301c3d5cace734cff652aa4f57ea80a7177f5", 0x16}], 0x7, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) dup3(r1, r0, 0x80000) 19:17:52 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x00\x00\x00\x00\x00\x00\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) flock(r0, 0x2) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) pipe(&(0x7f0000000040)={0xffffffffffffffff}) ioctl$PPPIOCSPASS(r2, 0x40107447, &(0x7f00000000c0)={0x9, &(0x7f0000000140)=[{0x6, 0x7fffffff, 0x80000001, 0x101}, {0xe468, 0xfffffffffffffe00, 0x9, 0x8}, {0x3, 0x7, 0x7f, 0x4}, {0x0, 0x100000001, 0x68, 0x1}, {0x8, 0x100, 0x5, 0x8}, {0xa698, 0x6, 0xfffffffffffff2b5, 0x1000}, {0xffffffff7fffffff, 0x2, 0x0, 0xffffffff}, {0x0, 0xcc4, 0xfffffffffffffff8, 0xffffffffffffffc1}, {0x6, 0x7, 0x6, 0x3}]}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) chroot(&(0x7f0000000000)='./file0\x00') ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) 19:17:52 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x40000000000, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r0, 0x0, 0x7, &(0x7f0000000000)='NET_DM\x00', 0xffffffffffffffff}, 0x30) r2 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x100000000008081}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r4, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffd000/0x1000)=nil, 0x1000}, &(0x7f0000000180)=0x10) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) getsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f00000001c0), &(0x7f0000000300)=0x8) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$UI_DEV_DESTROY(r6, 0x5502) sync_file_range(r4, 0x7, 0x3, 0x2) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r6, &(0x7f00000001c0), 0x7ba27d3a) read(r5, &(0x7f0000000200)=""/250, 0x29e4ba6b) [ 1033.253563] binder: 6106:6110 Release 1 refcount change on invalid ref 0 ret -22 [ 1033.277144] binder_alloc: binder_alloc_mmap_handler: 6106 20001000-20004000 already mapped failed -16 [ 1033.295381] binder: BINDER_SET_CONTEXT_MGR already set [ 1033.300702] binder: 6106:6110 ioctl 40046207 0 returned -16 [ 1033.306537] binder_alloc: 6106: binder_alloc_buf, no vma [ 1033.306623] binder: 6106:6116 transaction failed 29189/-3, size 24-8 line 3255 [ 1033.310711] binder: 6106:6121 Release 1 refcount change on invalid ref 0 ret -22 19:17:52 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0xc, 0x2, 0x1) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x10000, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x1ffe00000000000, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, r2, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x8, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:52 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r0, 0xfffffffffffffffe, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet(0x2, 0x4, 0x8) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f0000000040)={&(0x7f0000000000/0x1000)=nil, 0x1000}, &(0x7f00000000c0)=0x10) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) r3 = syz_open_dev$mice(&(0x7f0000000180)='/dev/input/mice\x00', 0x0, 0x101000) ioctl$RTC_UIE_OFF(r3, 0x7004) 19:17:52 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x0, 0x0) ioctl$RTC_PLL_SET(r2, 0x40207012, &(0x7f00000000c0)={0x480f, 0x4, 0x400, 0xff, 0x3, 0x8, 0x1}) write(r0, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000140)=r2) 19:17:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) [ 1033.311001] binder: undelivered TRANSACTION_ERROR: 29189 [ 1033.311046] binder: send failed reply for transaction 1545 to 6106:6110 [ 1033.311082] binder: undelivered TRANSACTION_COMPLETE [ 1033.311088] binder: undelivered TRANSACTION_ERROR: 29189 [ 1033.469651] binder_alloc: 6129: binder_alloc_buf, no vma [ 1033.486114] binder: 6129:6134 transaction failed 29189/-3, size 24-8 line 3255 [ 1033.500734] binder: 6129:6134 Release 1 refcount change on invalid ref 0 ret -22 [ 1033.509318] binder: BINDER_SET_CONTEXT_MGR already set 19:17:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000000)) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_NET_GET(r2, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80040000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000540)={0x2c0, r3, 0x830, 0x70bd29, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0xf0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1f}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @local}}, {0x14, 0x2, @in={0x2, 0x4e22, @empty}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x8, @remote, 0x4c}}, {0x14, 0x2, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x2b}}}}}, @TIPC_NLA_BEARER_NAME={0xc, 0x1, @l2={'eth', 0x3a, 'eql\x00'}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xebe2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000001}]}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x4}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100000000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fffffff}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x27f5}]}, @TIPC_NLA_LINK={0xe4, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x4c, 0x7, [@TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffffffffffe0}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffffffd}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}]}, @TIPC_NLA_LINK_PROP={0x44, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8001}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xa5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xafc}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x100000000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}]}, @TIPC_NLA_LINK={0x38, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffffffffffe}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}]}]}, @TIPC_NLA_BEARER={0x4}, @TIPC_NLA_LINK={0x24, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_LINK={0x18, 0x4, [@TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_SOCK={0x28, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x400}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}]}, @TIPC_NLA_BEARER={0x38, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @empty}}, {0x14, 0x2, @in={0x2, 0xf65, @loopback}}}}]}]}, 0x2c0}, 0x1, 0x0, 0x0, 0x20000050}, 0x4000) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) fcntl$setlease(r0, 0x400, 0x2) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) 19:17:52 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) r2 = dup(r1) write$P9_RRENAMEAT(r2, &(0x7f0000000040)={0x7, 0x4b, 0x2}, 0x7) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x201, 0x0) read(r0, &(0x7f0000000140)=""/109, 0x6d) write(r1, &(0x7f00000009c0)='/', 0x1) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) read(r3, &(0x7f0000002000)=""/4096, 0x1000) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:52 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00\x00\x00\x00\x04\x00\x00\x80\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) r2 = openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/current\x00', 0x2, 0x0) mount$bpf(0x0, &(0x7f0000000180)='./file0/file0\x00', &(0x7f00000001c0)='bpf\x00', 0x42000, &(0x7f0000000200)=ANY=[@ANYBLOB="6d6f64653d30303030303030303030303030303030303030303030332c6d6f64653d30303030303030303030323030303030303030303030302c18978cead4c5e76d6f64653d30303030303030303030303030303030303030303030332c6d6f64653d30303030303030303030303030303030303030303031302c6d6f64653d30303030303030303030303030303030303033353131302c6d6f64653d30303030303030303030303030303030303030303030322c6d6f64653d30303030303030303030303030303030303030303030362c61756469742c6f626a5f747970"]) fcntl$getflags(r2, 0x401) write(r1, &(0x7f00000009c0)='/', 0x1) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) mknodat(r3, &(0x7f0000000140)='./file0\x00', 0x20, 0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000005, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1033.514827] binder: 6129:6141 ioctl 40046207 0 returned -16 [ 1033.520691] binder_alloc: 6129: binder_alloc_buf, no vma [ 1033.526403] binder: 6129:6134 transaction failed 29189/-3, size 24-8 line 3255 [ 1033.534460] binder: 6129:6141 Release 1 refcount change on invalid ref 0 ret -22 [ 1033.534795] binder: undelivered TRANSACTION_ERROR: 29189 [ 1033.548896] binder: undelivered TRANSACTION_ERROR: 29189 [ 1033.620209] binder: 6143:6154 Release 1 refcount change on invalid ref 0 ret -22 [ 1033.630885] binder: BINDER_SET_CONTEXT_MGR already set [ 1033.637514] binder_alloc: 6143: binder_alloc_buf, no vma [ 1033.643302] binder: 6143:6154 ioctl 40046207 0 returned -16 [ 1033.658790] binder: 6143:6156 transaction failed 29189/-3, size 24-8 line 3255 [ 1033.669558] binder: undelivered TRANSACTION_ERROR: 29189 [ 1033.675640] binder: send failed reply for transaction 1553 to 6143:6154 [ 1033.700125] binder: undelivered TRANSACTION_COMPLETE [ 1033.714749] binder: undelivered TRANSACTION_ERROR: 29189 19:17:53 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = accept$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000)) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000040)="af519754921a9dbcc12786bc91f6d9c7155d2f3fa39a877e6eeab2d3517bd52f8849abb59615e46370cb2c0649f1713001ef56281fa21f72cc1a078d18f8f7a9324576643af33c040e2327f779ca893d761fac01340cd381f84a01d75d971d07e6bfc1156067ab4d540cc6139f17ee36274e367c0ee9", 0x76}, {&(0x7f00000000c0)="6a3da571f787740940b30660c03c951986dadc84a70f77be49153f692ffd5bb292b5e6824a2bc014ac327c4b78bc3df5727a6796daf565e29e0641b076c969fa7a88589385c38999c39c55ee044bd4f05422a746d56bef217b39f35addb67f", 0x5f}, {&(0x7f0000000140)="f92fdc324a6dfe4cfd804a0021c2966f8af0a2b0b9fdbe6f9b4563f33b9910258172dbaaced5fa78651389d5cc83b429f2ce76f8dd3216445c1694fb5932", 0x3e}, {&(0x7f00000003c0)="bec131a82bcfb8e83d599d97dc85125149213d83459e166d2bb0294b5e51cc96af6e4a5f5d73b56262644de816a3c145385133f0ddf262fffffa526ba483bc3f7a596f22c7283945f3abaac884173df7c4970b324ea859dcc7c0f10a51a8502cfb9cea8399794514c76d24f800e7c40710982a19b5fd9508a4adb0f0f687cbd920c3fee152c3d2fd8473b36d8b48fe123e34dc46e3aeac4f23fdf42a5eeb64620f1c203310ba1a968f42bd671f2d8fda8e106f0fab37e74a22fe283f2a1273aff216834102367938ec503f38", 0xcc}, {&(0x7f0000000c00)="94664fe99c89185c37d9ded2a1b8c56e805fbfa9cf698d2f93648243fc2cf50c8be024965246832a7333212e552ad8a8883988b24fd8b733a4ab9af9da8f497a7598e93042c65c2f4e3f0bbf30c61913dc6489b0ab2935da838720e9b7002878dcaaef92ce4fe924c16037b29aa33c96b11b4fc8e2427446f5199cb614932a3f4d365320847ff667dddf7a2918b337ea8f7399c6947bfa5deff2ac2462d57eaf991e6ccdeb73f0a165b6e7e0f1130774dcff08415d5e2c62d0fce0b1be131d7f44a4aa007401ffc4070958f4abb78c205caa5b3bc205a4c40cb7ce4a493625fe0479fe5348814737287f49fc1dd25cd301d2168579505f3d470a5f9342c504eef757018d418b1875e267e9abf2cb334cbbde920ffe48bb95a7af961cc713332c045a55258b6d70cee00a2eeb3d77b44d9f10a3ae3015e3d918787ff61faa4d80ee5ea478d4cb11aa8d81611af41bcd43a952cb349d411259b0993f2d82c635a4047e1443ae6998d120e67a5b83c725aaeab755bd67c9c84f384b3604364fcc2e6528132cfaf986d15d8915f6e806d9f6fd0f67fc4b5438dfa4367d12069dc58934b0b01c0c32926789a01bf882b3a2145f0869cc2a5f285204ca03d0f694d44dad2e32f81f4fc12b61ca4e4c5542cf5df99e13ccc89d3b44b7b2b32079c2f584e4f3b58e8a6a5e818bcda9d99bf28751f9a06482ecc2c75bff96a442fc049663e499fc2f3a76e667e2f4bb4f8aca90de0fbb55e3e0045d15f9561b56363bc9468aefbbd8f2adf50ab9a5a4c07ab278953c217b88364687065e22c8960b6b068fdcb080b35967fd2dfc17a1be20311dfd7205e1e57a0a444997dec09a985a5462aaf83c68bdb69d49328e6be0e64735b604c427e4ac3b992c35a22a768778d3b18a0f4ea804eaf43c825a7a8c2f0ef75567edda6305b22c2a7cf882ef8632804f8fe740aac2a883861eb0f6add920b1a2eebd615c45410d15eea98ad3f8aa2b7ebf4f9a371b1484eab33b7c9e73322b8568fcf6153b9495b644fd8162df7f821d934dbf984cbe04192432dcccd3b1ad84f87dba4a0a84c74e7337f10bae19a12170666e50f6dd642c12e676955504797363ecda5a8e66d9b664c3a57962a849d582babccae4dfc9641e514ac60ec35b26f0e62b7ddd977102c288efedf79fb07c0f3b75c40a7d7db086a81fe568673e0761f235fa03b9a545375babe4842420155474922270927f27b18089b365cca60f413c083ab1784c45f9c8aa32f41974391059e9b3521d0a7937638e68ed3cc673c22ebd7ebee7c40cb4015099367d8ee6b30c65ae2e165dbaabde13770b54752aa15a1bddebd50133205edd79740fc4b52003000fc6dd132dfb69040d9a1e541636140d0100e463bd35ea40b2ee406190ae7b29f10ec165f3405af46968b976802dfb490bed849da950a245e26a993ae134a999c67c9cec50ee8f2f74bf512e0129d93298af1f2f68f616b66d2a295127a196e5faa950913a80b210fbbc320543749687846720248117d272c48903483f1aa575b6e83c18fccf6b618bdf7ef1aa1d73be6286d1d97c472aea1ceafecb23a15e227071e9218739f2ab35ae150330d0a9577327cea8797dccd7bfee2f1231fffc15fae7a68305ea9e8925e46dafb15b8ce21ffad923699cfff999d3f4cba22342e217e6bb15c02456bf70cb547a00eb95f2e0b97360f4986c78abd160b62023ddc3d994891e34c28b3ec3c1a9c5c87a48e7ad4b5f0a48d026df8c866ecfde2584bd11ecf420e517af766fc0e595c97d88de2ea33bece2ebc3497a9ce90906676da50cb3700bbc5946501e031b3b299f9505de0889b2dbfa7863281eead0ed50c4114ead340ae3a373b42a9f55afb92398ab208e3f06d6370115f07a3e4f9990332fd3436c3948b4f39f4675368840bcd5f07f3baf8a8c34c17710a5819f61118bc4b53feafeeb63bdc03f2164722f0f7cb8b1d64aa0854bdf6c0edef8ea85ea8c743c52f133c7cac893e5834a5502182b7af39258a8458dda8b80c495e9beedd151ec9c778aa911bbe4620112fc2d95593de5d08b004d1ccf3a4395ec69ce747eb86373389b12752220dd787870f85d2b187451e0ce18fd6dbe33dd35e3d62263fb39ca55d841ac5f8ecdc94ce1910de2037bf9b001d5e76749aded4ecc49d5e3370d4500f697c0fe3a55ce1213aa60834b90e1b5a42b1a37bfc52dc8d15c2ca0a5ccbc1bb7ae44fe86fd46730106025ec6123310f140cde425a26a01e55d354d8abae1f43247302c6b7da9f1be7d94da3e1c58e11589ebf9d609e0b018bde9569b6c1c2700791c63353661d382c93b432474d56e52f5011a2aea69728b13c5f4766201688420385bdb2940e43b5f1b7111db5c76724b9a3d8c1ce9cb8970a88de1622fab5578b1ee656bfeb6400732ac33d7be75f4d1d4fbd8ce61cd369d8bb7c9aecff1133a3fc704e958981c3a78ccf1df311bb118df4de20e0c8aa96ff57226ff1ad5e6b8b68692a2a08ce73f630483f513eebf7440a6f862c294ef04d4effaea370f71252ba7d81501674fb7dec7c3f080a6f58e0439aa0bb585323788235ce01900ea67b659fa806ff3904ba4134ef02cc66488d4248b0d6b1651268bc070b30753f608f04454e688ffca63e6137c2df5cdd61e0a7aa60767b3f726eb39e7f18d639d6fd03c17d9241bd9b853ef34a3f6ce03faf27f8c542131c1d38d4c92d2a8df52f668b544ca40192cafac711504a1083ebc224d4b5567907dcb924b45544895bf263e39830252720c4645980d1d12ba38893a29fe0aed9e185193f66172c2bc61578f953bf932d3fd451943699ff870775e1aacd5e3e1431d06c6ec0843d165e27ce172336559628cc29b6f65b858c31b7392420756388a4ad510b4f11f6d9e98d0302408fa75bec1845d11d5ca75385c8df566eb6d016b35c335972a36281cb86ab025162283257e8f62a098aec1e818e7d4748cd8b653c9b3ae9f4d1946050710e762f2545a4da75f098f3b69630929dd703af1413554499f461e21c12eeb65971c44d075197b5d58a936cac8a7328fb8a6900145a1f5770558f8bcf0bfae7c47f9797dd2c72238c432535ec5e2991f1fda8e58aecb257761fc362bf6f8d44f6fe88ecbf547260d11a6d1679d365e1faa20154263b26b2ff69ce1052a44133354ed705f60de70675395b86a36e115b16272ba80a56cbee6c23a8fa56a087c91afb9f5d516c81ca33978d8c764ba43b07db96e8e1c31e3d3354f7dd29563ad3ccc62f8ad050c78917c81448caf95616f6dcc09f369c8ab5b4d3c27bfa5bc89729c55f94f43051ea5ad8f26765c52da3598b7923423ac2d95730289a0b383a7a0cf6e66172d649e922cb831956007057948b6e0c5b4e949527c4e03797279d52f5585484ff3a8840c2867090ea268247a6ad1c75086fb4cb2e67c0616e4c991994611a111703832411c18a7e8e8b72336516c8486e9e81949c484a2066519d9a20f632f74e0ae95885e75786421c4cff25aea8f9532a83f4cf84b8dc3f501d3cdefe737ee677f8b2383e5d185fbf8470d26d479c48192a044f49f278a1316330b1a18b684c0be986d93344f9447724738b3fc054b3da645e83684bd2d10fa796aefb63d70e18f3d2918cd5d9ae44f9b3777f661029aa325ca2573e3b64e6cf7b9ff020702263cc5f17490a5c7b71534e88d482add308722256c9a986a48c23556160aeaf88d8639ef31e36741f9779e1b331175bd50b8af74a3e1a95102fe9fd5aa6dbedb3a72abcdb08e23ceefabd56324bb70b5515ede4842bf924037be218f2b8fe8e9d4ab79dc158714b4d8cce2786ebb9e79c7c302e5f0bb65c02fedbe331eb35ed9e03690785253c00c6a6e42b712495470aa35f835cf7c963a930d2a670f9fba05afae0697f62f15566a27908b747fe87d905df7907c7ba2c144aa758f079f524c8ba3ca647648feec6cac3552e6a8706550e536f969c960468d1cc2b72141c7fa9364b4578e07ec5b636e1a248a04f9a1224cbf33c6f9d287dff883f025e755c2e10b0a785fddde1a98631e592bb982ac6fe423882b043610cf34a6e3a2821e41a54c2b5c9d4462fd248b73b2108599072970596e3faeb5fca5a7b36b7e2bbe7bcac94a2cf5e76d59e7646e0da1b36128a3e6cdf80ad74ec88b781d71b81e0bb4ba70038cd86936ee9212f3b947bec30b950241ecde9e28c7377f6db1e7d4d2cbde66562f9d2251c6c8346707eafe7912c229890dc655cc3385409d973c5a9948192e41209cd98b39a2b7889538d6ef4000fb60ec13fc46f920fbc1d69d159059b6c29e13a923648a7867e0c6fb8c263b35a5ed8ee9184f6405464f45b6151d5113e66e946fe12d810b5d0f1ca1b0d7faa3d2b1ada21bcae15c373b0a0bc2f36021ae704219977ece802705a9c59eabd754814fff188667f130cc6f3871e23e426b0752b6bc7b987e83166c59dfa7ce5ce8eb3461e15b7172f89ef662684df57a976799723c9c489a4c41de2b61df2e591fef936f9fd99ebbc5de1e6e0fa9b6876568d74289af9e06ddbf60abbae3fb3b3bdd956f2670d37eb1c8680ac332b65191cff172cf46e0213ed59ba1c35c9223838ddafa10477454c5680a1274a9d9b4856ef7399be924bbde5aa3c253ac0feba6f77683e02f19c3f7c346b32520c0c4ec79d8767428b01ec602732f923b8e581db8a88fcf0ee39378379bfe7a59650672c51d3fe2a924bad348fd618f0b86c8860c1c3d11051bc08f36c41ebc5cb587a8a969a7ddb8723408edc3b089f43f83bd193eecbebb59c378f5b60c4918eb377b1fe6c5481773d49e651f56e1e1488f28a101bb7f1cc1269a45cd8d9ba7a261c09c42c368cdb6d5e012c3806761ef18c7569a606b0f242792d0320312b7a110642967f24c7df3361fe4384a289155256c88f00346c0bf6e3a83a2022ed924a188673a33b4886df80a247a788f5c3ae0c1eb3e3021854385c8f24119cc81d85cecceb9d0e17da15cb93375acc6d5d17d9a53670210eab2af34fccc5be05e60ca5ba9844fed171dacd5eb7c8e71e92c56c62e65b6159cf0e89e34b45b0464076dbf73e746b121d5abc8e03f86fdf46c2830fbd2e495aedcaafa71df39bc29539ff6c82db9179c3fbe7817cbfdf5ab9db58209967da423b2922fc9c460c51a4df6465c2de70f2346d22b59bcb2996f5420dd68adcfdd977b791aedabd56cff325c769636709dad9ecc83a9626f3e73a24533714ae5df32ae130c1c1ccf435ac210c63799b4f7eadea44e9879f7a2be8ef692b4298079b36f23028f1ca92d66d4c12dbe3fad7edf3e4384a7dd82aafc350c8cbdc81b8f26fa66970086e3c684d7d1475b5d7acd69208fc7a71da2f9fbdbf74b7f3d59a97f39663bd7a284557d5d37e57295f0b1aff08f6f95a7873edb9a9ca7f019abbfc095cf743df53fc0283abe25b8a135fdf5be2ebe3ad577b896888bfa9a6ef78d25759a13d2f2b32fd7a8f29628356eceb96aba059d3333e5cb14f9976d4c0de8305f3681bfcbf11db5708a2f5a7f0aa555427895a3f9569b54736aaeefebfcf6f2b7be09c657370cfe76c6e6fba7907902514ec1174f3be0f3c7b96892d44776b96e2d0347c81ecbf4fa4aee9d19279d5167b700d0cca6c383de80290423576f50ae569a05a5c30f8ef50a1578797197ed880d8921e5fe8b75f6fc632e7abec93f05d8885235792a4c5ef6a9cf8030e845fbdb785a81ee44b69c9e28e2bbc989f191b25ff9ab2f5a9b0c4021b3728ad79cb6584a7322ca16aba2cabfd675dcb0", 0x1000}], 0x5, &(0x7f0000001c00)=[{0x18, 0x1, 0x2, "e124ce"}, {0xf8, 0x1bf, 0x800, "c2bb407b8721ff54a2f990f27459b46a4f752e812ecd887eb88901544245fe2a465880699eb6d1f9139145966fa31cbc392406dc3421fd4d3cda490c36b8951194a7953de1ac49fefdbba2c133de96359d1ecb9e7f9e494c552b7827a6c2b9df3d3e55ad4cc0a1500b643392be81954bebe4b577e645ce44beca69aa7d53851bbd4b4fe39781c43092c1117925dc56ec327bb523d9b056b73e3263aed272c34857091266a2fb35f752fdbed16c93999f176c670c8881ebc173edcc929267f3b45f63975908f8952ac44907c663d5c196b3b46895e04bd9f14eeee8929ef44b34eb3d46c0b9e7671d"}, {0x1010, 0x107, 0x11, "b4a1d2f19442d2967009dfcbfdb4f42e9350a17ad17d0873cc505706deb62cdbd0422e3fa24d9dd5883ef4960d14cfae95bd066f0cd435e6383ab4dbeedcf54910d9345e5838ef2be23e60bdc77cfabad55172163d0e65150831ef5aca0e8a65c4fc1b81c1b793432ebccd4c8ec3c29365b15291fc7c2cd36abecff827aef6a810b2eaf3d536d7782c2a2bcda2331c44ecf8a610c062743bf3d9d8d38fc0138ec8783a7a1acce6357c2714c853e32532742da0088ec33da92a94ce1a53c25a5b6128b94a70d745c47839fe67e115d1da950fd04a0a8d67e7168030801b52b0ca4f59d8c43cee472787f068f919050462be30e5f09d01dce3f2a7176ebccbd8c55449dacd65a8c427e6cfff03bd4d32c1c73df4076abe8f318c19d860fbe6f9ef0a0cab22681633a511f43213d068a7bd8e303bda6ffce9aa16a9f26620e5b18507e030283a237fd8b0f8102ab79f4d127423ebcc33b99b6c4ee520858bfbaab35bc840299bd9086e11b195d71c854f05ede6fb6f23ba4786b78770379c03f244c2333ad14a857d8016b0bcf93e802f6047c783e307677c6de8d046e807c73af9790df5f34d9bac8072ac6eea683756507074c23977d56fa8685bbe496571afc4b21376ed5db93c644fed4ead57921807a722ca0a56d50ad782f9ce4a53c5cb48c1dbde1508d4f611656a064b3e67a19461d01d0856fdffc04c6347542b94bb273c6f869d2fd0658bb6656b60c5c6de3f684f7fd11f636795947a699e1b2ab53f4a4928b67a578a21c3f40d8cbf5f7d52f802a1d6e7b11efa08e7b5c8c684d03d9dd90a2d285de47b480af426525e2b713fef484d776b0deca839f6941d738e02b44614800e064f0b752eb01d397f293d04fc4312a6a44cd4be69b8738e48601f471c259dbdc18fcfc4ac1e7d4c6cb28701c9a347a5806cb5bacb8babd533ca3f397c25dc1bf6935eab488d0e6501820f4aeb243302b2b0b4b1610639f8f29d1b4d8cf683f00b189d6435a84c0c2805157504a47269898ca7221fe6755c4d3b28b991159f402d4e3702aec7717e6f09b74167eb9e777c0feaeb3d3e960c51f56a0d9c4b38d53d327ce8612b9b3851c62f54dc7715616c79901f847fbe221f213f672199efa96428dfcf92e14ab4ec044b4e1b933343e23fa1a2f37428de702accacd0c6ddc42fd9a5eb71e0cececbe78f6d83caa72e0440d7236079b1f12a247fbb19bcaef63c92f4bba83cb4e150355540a84d7f3e9e37db254d8eac03336f344aaf1eac29da4a5ec9f07c88db3505ef4f83f69499a76ca679b7123f63fdf1b96832f1dd6a25591cadcbf5434a23463e6325485996b762e144cbce18090fb4ddd88a15c00c0a20c265463922be47f78a0148fc1a3e3891d024d46d4450fe6dc849b0d5eef8e709a357de1824f68bae82f03d751d06bd9b36084996ce39b86983c5365b393924fc81965927a6cd62a265dfcfd6c30d44e59ad7a6aa910de7157842cacad4ce9ed0c97d6d32d6503a27c862322cf0c4b43caad99edd35108035c5262d309b073af4a40ca83eb38f80048c9dcad91ddbc4ef260932c50c6389f223fef421fa77938ff73c8ec03e77cf6a8ccf3aebdc115ed2266e254657de968f809e695fc7d7c9bffacf32da4e0c81866736ec85065e47d453467eb9430dac73a3c859b01ef17e23b4b06ddd649d8e6f30a8b080694978110255a45f12b7d926fa8477a5575fe5c3d710f4e90798334db8d91b9cbc6459dfdf2b1ebac76a1f663fa626e6b9dcce08567c4352b9b002866e91ecf77b6f659dc46ee389ee57c0cbe8fe151a9113991c477f9557fcd0bbc8b36fea695debead8ade39c9220986a7eeff1d552c6ce26e14acf7ff2b7b912fc8b7de73d335e5b45f2e863e38e248c63e05a77d16d1e13ec3f59a0105ba51a37762d12cba8171724dfe24a3e4a0585ea1128e802ae5b0d40d88735cefd5e29b9470075098266f023af7cbb4de25e980fd1ae692a9441393da1b9506ffb44e3e2de9b329ca3aa166b61ee445ab8bf364e3238fdc94a3537ecc0c4264d870ef53be1279300de2332564614291fcf8fc20e2b4a655e76a5db6ccdaa92594163ed2e66a3d1f7e4f597c1e8259ea1ec3a07679768f8c8c596aeb8a8d0a7a796fd700eb6c29cbb80614874810d8f82b5b7a2bcefa183ca62a1c8814b8f6426d3129dfe2e0d476fb048767b60134dae610b8499a03e84aa76680cac3ef41cbf51688ff48038edf090ff5ff7061e3dc343b626db453b53d6361a67fe9dd00088da1ad20e531ecf94d82ab949f488f06f49140e9dfdad884b05cc1399bb380af00bada7ebc9e1feac0ff340a8177e32c6dbe573a2fc12ca4ad82037b9a11dae929e1d85617104db59ef497de4163f96867f7b79a9080bcccda3dd9ebb77092df8ea39c3c2ebfc111ba50e255df6f38933b011011839d5498d7872b32993d4d568969ef94fdd65364270d57702dbf2f0ea38d8f26dcdd00299ceadb492911affedad6dc06f9e83eeff260d6b01fe2789eab5427014d70f72bbacff84fd24efeaf3204426d365a021ec13dab2cad7efef77ddad399883a6b29ecf960c4d8b55fd544694583d73bcdb400ecf47ecd75cafe32a70cfce9aa61fa7cc5f07b5744971f674453d956c3233cf459bb82c6d815aefe09be5bb0d693860a8724601c88ae0ec4005dcc10ce717e537efa5c17c57cb2a88762c97dc9f34c57a36d58b789771ea7feee1ff20e34ffea8336629a105013db62a8066bce9d548770235bc3db74ff22b9ab3efd61ad675e4bb027d9dc14777fd6f23d5ebd4fec076b24efde52bc18791daca4819afdfcbf4689563a64f21b8c72faecbfe4790cb83a91219bb2b62ec2e1cbad009006ca543e4191580d675b7ace4bbf3a79b4d38345dfa2bc5257411f9aa7d513c6b1051dfde55ca124e0eb983e253511ecafe9892ef4780746a4930dacadca03b549d96936657f4732af6e98f4dfbf0a66c84a1d7bd87f0bc7e0445e09b7f85913761a00915d388c203cc26ad16022c36effd96700d1d03bcd1a72e027d9a13c855d8e9a91eeda715163841f7c49f7c0091918d4d449ce3b698161c92186aacd0ca8fc4c4d92ddba9b55ab4a0a5c9273a74b98618103204faa28ddc588939d4858c7eae73314b29452d2799063937b09c5f66dc42f854bdb6a7b15325a55aedb7ea800eb3b75b667c17f19d6d047cc65ae3f9b7ec2b22368154e1bfd54d9120cfd9a07f14008d295952b1e267a8c5c2dbd6cd1083e29f901fadce5ff170a7a7efb9b6f24659bbf01f4f582422fac3b72785f988c39308e99fe7b7a5587c3230b7540c6f6d0af1237365548208cc38a9703eee6b4448f8e90f7217a4574fbc9a73946baaae43be86184569b98851af579504f30e9f8d13f878adf7ec6ad4ea67cc58dc117123d8f5f2ab4885db3b161dba7bf3a77fb56c79fc126b7ed650021239dbd2a05d9530733f667c408d62e70553ef725c24cb8fa1251aabcffadd3b36596e43fe22d03c9f8555926d773e44463dbdec2620ba3214b3261a679fe2fb4497b4449dcce7bad11581d23ac9523c378cebaffb458842d3fded02718c4e039daaaae1a1ea5355c43c829297ea56b34d0aa522178249bdcbe1a944dd7c1a989cddb24cb2cb855f3d516725cccf1446927cee792da59457a11be0d7e9feed43dc670651edf159f6ae38c19f7ed407483078471f8f188023ad4fd551839ec39d41aadde431505d5e78bf852ac48913426435c0cca008a86f84ab8c56626306a3ecc3a556d2ecf558254686667acebd250832cbf16e01b9a44d5f3cdb2350b7db51725711870ed6aadfa3f3fbfaccd240a87fbe7ca95de586ecf243ab5cdc0de7783db58f7b72f75452a5f14159e6fc0a71265705b30c3fd4f8712c8394eb11510d9c16a796450e61472bec68122c3e5ffcd5294192e168ca71692b9e645234fe0d021cb074d57364ec8858a2a21756763e116330fab11c575067c95eeb21232a38d988539548cd7303f908424b17b3ca34fb438e8eab204315e403ba4b712902fd7cfdfc2de400fad3b80d7e44ee7bb49ebf60bd3e1914907803198175cb6527170a18c73490a6aa7c0001b8b92c6486791877ed6713f0ee7d268de41b3430bb321decb312fac4988ed403b1795d26bdca72bc2e1965f5def80cfe2bbff700eedd5d3f3a5f79f3dc17b3b4bee4ef88614c9060c356d006bfba51bb97534a896cb33ceb682bed1c6b9e325bfd33ae8b657c7d30c32f0985efccff9cdeac2dd064d6ca026876d7e434c6a3bab25ed0012f0c8890be264bb1875d59966a3e622f5199d7a7c99e2811db0ad7e56c2bc73a3951fc7579d44064158a0734279d80528cd0ad546252cbeebcdca5f936d629656968f6c6af744f7ae227291370e22e12f862e940e15b7565f15897b63d849dae618fe82cf842b626d3f8c0bb7f0a93f2195e48a001a8916ed8ccfb96b16bcb7fb331bd2c2f497e4e718b2545de34d3c400642b642ab9ed732d40e44b5ab4307bc33720971958a65165b46fabedb067a00224d1c4aa1f735ca316baac7c00c6403166257dce53df9ca02bed04385da88dca0b29749214b42e7f7f3f7b7f21678deda174088b71d35ca1172b88be603951782822d303b02562aa36536617ac6a53d996a2bb716a2f7b3294037fdd0215ac53a1639a18cdfdf6912a5055913710a3d7d15754512784affece4e82424839aeb377068cf1ebcb94b7ba7c488e0d9a8bc4b327b2086e929fe62d09288e22e87b73067f9e5cf482b1c20e1391269c208d0ecd8b2ad3c2c340d65b84351b90b89bbb63ab99a1cdb51b135c50635d966009312ac2799bb3c5e9bf40955981d28ef6b88cba10c17817f1516b946890f5e89ef9fca7baf2d5da308912439f96cbdd327940341dc5fd58a1241ec1edf0db2b1b3ec2858f03c33303d5a7303b214766ed573b7fecb15ff98919a12ca5be64c12e06e38217dca604a2aca50d2497b45122c00a8e271b86356ceb751adc021c87f71cebe450ec69a5035ab7347f250fad593036d5dc1aeb5d0c92e549c164cd8b77f8e30227f1e8d3bdb0e2e5e8a9dcc07c5714bcc07f3e43f04d302a4bb6f0d49e2b30a7cabcfa70ba61b6575af5bcdefe618fb69029df53c7668ae8bb875e231787fb963ec4a8a6090e1ca57ecf88cb7226e67454c9fbd49f4bad40f161e2cbf2edb8d8246de131caa61a917700dee9edd9de7f24cc66a181c56439cc30aa38f85eaf53698511f3fa197a7e044abe08e000e23d8915683acb8821c8812433793ec1626d2c5f7c242c99e5d940f783ce457a8762873795310ccfd03de1a7edc7191f1567af3530ad6b153fe60bda9228c2923147add0c91932e291f067d8c730155ae0a2a780c2d79a205a21088c69bc891ceeaf8e6f60c5491a1464b07feb4fdfc056b3a42ffa87fd3880ea811e0c5a56822258943ba517523cf05e650a1069ad1ecb1d4831539be40778b9e9abf0424dc64d03aa7ae15c1bf0b41d6e075f10b794034a27fa595a855c690ac5be9d0a76b9eb96ae0bc19f37345f7236b5e02ba3437e3ac57b4dabd36d9930833a9a917e69f345c9103976e984226320859b69aea0019187925f0588afcf8dc8ee1825abfede4db05e07c3b5082c0ca4a16b4c17ae8b0c104cd9a911260c56e412dccf35a26dfb0efa14973889e94837d7588dff6f3c01fe3afc7ef14c652abeb436e37fa6da2529274d21fed6a9a87700c33121be3aec3a82aaf9a34426318732b5f9a9558efd67a5d863fbb8e24812e4b885fb4ba17d"}], 0x1120}, 0x0) r1 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0x7ba27d3a) read(r2, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:53 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x1, 0x0) write$P9_RSYMLINK(r2, &(0x7f00000000c0)={0x14, 0x11, 0x2, {0x80, 0x1, 0x2}}, 0x14) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) 19:17:53 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\x00\xc0\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x5) fallocate(r0, 0xfffffffffffffffc, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:53 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) ioctl$EVIOCGREP(r2, 0x80084503, &(0x7f0000000000)=""/61) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r4, &(0x7f00000001c0), 0x7ba27d3a) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:53 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x200004, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f0000002000)="12b6ca04b3e643842b59db0aa3e06fa7d96f90a630aba0c8520e025bb4f57e34be5b039de90405c23da43b5f3a6546bf2f352d79d18bc857f558caaf7bc9f61f4a677d8c49b5cfcccff279c2e1c3a9029d10e67f2bb7230f259c0bf950c6bf9dbdf5b1c135bb4611034c439491442207d7387b89c2c181ffd24e7bc37ce0a143fca8a039def21f20fa1d660f807b9908c1039c45014398df97df4ee24bcc4229606f87e20e87db37abb31fa8571b97969087d2e74190fc0eb469bd9b495244f69c910373ecb7e87512e88c5095077c7da5576ff267e1188af06f74d3473e90b44da1fc82e5f1776e779b1c523d88ddc329daed790a339b6435741cf1b6f74cdef1bd68fcddcf90a227902e1888af25e6ff169afca3af43be9ecc9417625495b9dc5656ef6aa1781f8485b4130c1a8024bd82fa5d324b9d983fd43dac3a94a8a15fc5e92d02847835a0c5bd4829b6b1ac6c7eca9fe1a24f73729a94497e03fb6df012f8a2e939c1e0e6794f064793cb42e406e5b23cf0a5361dabf30a0907d1a7abe2888b7e9b2c28510db748006b468a72a955c08002a59332d1d190e0e191644ed9c49507df0c3bf0b5a52a31ce5d5a5ecdf38e9b84081b85e97ae6b31d43572072be6abe206422b566bdde3ba077b4ea0ace216f9c3b2e1517d0bb9bb692daff461e50b0ccf561d79a831c09442c795d8ecd6b6091c28259b0ef152f38896630db4042b747c11b7245f70d3af0bf28376c128c3ed5c99ed1a29d0ce00c86d0c4c76cc30ac75ec721a732cd4c4f4a338863df941c9c69280f9c6d199bdc7163a591763cd8d9ad10f15abf6685cc8600e0b7ad3a149a39916ea87d9d75ecedc36237837d8525277acd4ea4372aedaad4dd80b8284e8a0113efe8d503fbc6c78a9de8a3ceb642b2e3db590a2d7050c700ddd85c5a1646f321801bbd3211f78b90f2f0369f754fcf7486ab93b3548ae42f743558ef4c2aef32d8fcaff6f1f16c1a4f0f8f2949e2960b68c97e0c2ad6251a8f9bfc802b4020377030293abedce4735c8a44ac148fbd354b7b27513634be54de9b8c209348ab8d41267dcfe84c6d8ce9e571dbf33bc96d3679584731c7ce1aed03c381d3b35676842fe1415f7ee75cb93bdffe44274adc865df232135d8a2b2734bad3a423514e37967b7a0bdc0398d584e5c485930ae0c32befaba1799f9a3e920a8170743ee3840d4b755dd2ab77be48b38a09a53d60219dc1064d9bd3ecdafd33262dc9e3c5476265068cc0a7872a347023c9c6a98698a3fce11d7bea850c9845d61954daf1b7190544c218f226c6c6065ede8f7c93e73d64e6e8c2a3f70fbc8f1842c5c3420f1af512b64ff7d4426cd842290d0bd6ab2802f789bc33502134c2cc19ef19b3b75cd38814fb7ed0fc18267a1c5768714427782aa60567571db24ac4afb922f0061c0c0733c8990d2da3319300a0849c43e651af9e46a7cc5add730c5ffc574f56b0600c64741fef8dab6d81a237d50bdc420e1de2d732d166885d4f9b7f555ff457198ee8a6378a7246846a9f9a8428e9bab284be37556127a2f0465648166491b3401fe32be0d0767ed5c2c8318fb0287c1a86661dfae2e3d0d5f260d3430f03bea9a113d36b97b446c03eed8b91056c7930b156d6f330ea0ac88cbf33efb92306bd98be8edf901683d41eafc764cb4b777f8b114919d2dd73001af81821eb3c65dbd9d3d686062f933a153d693f9190b3521fff6123d454fb9526cc2a21fabf812bfebe5147d139c403780ecbd2f40cc18944d8dbfc5ba958733dc10f79e88d015a8a21319559475351c0147e2ea89b9acf609217f80e4286927ebef0d25d99f2dc42a00a60f6dce906bdeff508c018d4bc8be2898fae8a892c99c2c26e453c067cccfac64b8f5bab3571de59b4a0db1ba94fc3a7fa1526fe6718b34b27c64e678a9ad12cc43f46987de4811fb64cdde9fa71e7b246cdd43900a9751fa814e00abd7a044d79b41ec3cf1a19abb0ca6cf5f1bcfe9dff92cb6e1a65613fdac89ce8f33b8e596ec9b5d0ce4e20ca14b3e412b15e115d291d2321044592edaae9d897eddc5ebcc1d71b91fe0ac036794289fd6c2974a6c2610363ba67de202e86f3f5badedfa7e84d09c41e5fed76b0b99dbc62497aa8d653697e9a1dcce8bd8a0d12064c5dca01c322afb751cd3ea36126f1e8424dc429a515d66b9385d7c13dc391ac86af89ec3a7b1ac8bc8cc9c67e859ce966ffd35b822b9eb51fac08a9bf1cec5cd086605a8cc7b10349f02a34b36db53023d1611d6941a66fe42b004abbbde823dd185cb428b9589167b838e86aad9f1629e178f81e1cbaa4dde0d96e0cfc3ef55fe606a1d37941bba2e14b2a8556ee289f51371ee03c7b126b9a6f0ba4228684da62362871d950d8baffe667c4834f6db173e4bb966ba6162596362ea5662532958af12e9f9bf8e3cd76229dd365f31d53f9599fa5a8f0845fde04457c01329f7ffcdf3d76a8c4a1a8f36f269bff23a710b5d3d7d357d151de92dd2fd3c05a5421d85939ecd73e9c4ae531b409018d9e1795769cdf3722cab06aee2ae0c602cabb19d3cb583950eba9fdc56851f116b0ace7d35e4035104194e6adc385ffb19aa7b746a594462f16c4ea7efcb680a63035ab83bb03e43befc5596a13c1b5c740515567bb65bd936683635aa9e5558d49b5f5106bf6ae4cd650578b95815d89e2b633416fd408227793d3e89986e1b9c9d8e875b52c5ca6db7d654f91678bd3ba22659dc67a8b72edf1c44e10e7bfccd647815d4c4e7041688b0527acb62b0dea3ede3823022ee98a97444d830c8f60961948d0bf02d99ca258ec1e367ede236d22a1730dbd68770b9e0a8ecfb272f3ef9d1dfc7209e5c22903e7ce38c283f35f356a249c8ca3261f71a8a69014e672b9657e01765c0edc832f37901b8da0ee6afdd3564eb771352d8ae6e331b3dd322b3f62dc34cfbcf3b7caca2b4b5c47abf59053cf20670554702f0a9767614162fa14508d9a0e13e04ce3aca7090ac887f28dffad47deb39c8cbc03fdcb39b29e0a8d167e0dd13c2927eb5b24976d760113f93ee14be610770863191e091b1e47f0e18a8fc49b72be41239c7da7b6733e8a503843017ddd60efcba79903fe1cbbf68c8483060820fb5619f20e0acdd0e2aaeea3358505a602a821c3ee9259564236cbb7d6573fbcd2c76a71b25a7f4a85bf7c20eaa33943953e83a417a38c6c06c2bf59c0544a387be2a50d1532f138f6ce51d3466e4c5abd7c29e94e92bb12f1a4d31925ba0833b94bb6a8d64cf63919084457aca11255f1a9fa51d5638180be42635673fbf6a8f5940b8e2b5f33e57cb2281ea053dd935d9bab3af0c74b80eebbaa632aa278385632020c3a6a27bc9683d36d8a7a714daf2b321561b00a98679e88049b8c7e007d4cf7ab2ddd923c7d592361e2d7462127d224b1c476888327adfacc9d2281f7520bee10dda409ccb8eea7282f240aca89822ca29933285ca37335d3f447e6b8cd254836bb5bb8c65c0d4cf33fe8c39c867eba739bf45f5b19979fff0e2c34517d5200ad596fefe338f86a0d26ab5f6233669a530b393b39135da8f2d51600df1e12a3d3357f2f602729285c203ae0bc266da7f41dfdf1be0e3d50af2094de8dc34982519605bec9fc2f820b3d27e8f1bd5190032be3db56cf32501516ae7baef74a9619875342a4ede0e3d76430646eb3939f9a5dded227d41ad02491aa389fbc61827972b34b3edf2425cf00b7469f58c8daa99c4e519a76fb02d4e4e6884dd1de62c230ee51f9026472df5253feb32e0732dadce1bbc567bcbc0096b19439d9f29c50fc20bd3378b701caed0427d567811685773ee56bc7cd3f34c23e37eb176c2fd4aba3fbaf4f3172e31ad2fa824489294502f40e56d1ea24ca001124ecc372d9df0a096b616f13d6814af53dab59e06b1eb6748e36d31a83fad1c11d1ea3570318fac1ac7ac36395ebf452f460cfeaba3dd6349ceb56b3adab63285bdb133f5fb6feebcdd469fde18635253be036e40d70e3f05b0000c7e759627de3bbb828c2435dab2d60164c523ab94ff210ec7aeeaebd14c04867ad39a32cae69e05058a1b4cc4f16c8f526ee1692dd04f61ce64bd10b2ec53ce3b23e4b8908eaffeb0e70b1f593876aa2ba53af76f73c7af7cb2f3826b26f103b66bae6db49fbf3483a965e3a10c638788fdb5c537345f1d5842c8d1748a0acef231b2c6d663d7e076a8e51f09ffa7cef9a3bc9af348ce71649829185b63c634ed7350e6f99d377ce3b35562395308bb0f54b06a247324cbfe7239d55938c930e6adf73a3cbec8fb747f148c3bf4146257a43b31fdb8ca7a0d0fa9c4b231e50edf9378a32da0ac186182175988ffbf9f8a2a7ed9427c4e25aceb2fbab5d46e66c08fcf0b26976b932369167e0d3d394f96ad40d04c2df1722537bce7c99e441bdbe3f2851b92f1123904d242dec74e7718f0959de0c6b8f4df84cbeb1be0e250646d60eab706ac73f9e37e1d6caf7c26c66bd7b7272faa8517b129c95d1e9579df3cf695df2a534c58ee4b78b68565cf01e3d1f163fb7ae87e7d4f43c0c379b5248b36c068b12025357fd9f4163877fd015f21ce3b3069547e2132a9f413a7077f16f1fb038825dc6790bb27fd6af3ec7c1b688616e4d027f01161138de5b98486df5e1b836800b3f5b3820be13c7054b1034cd78cba15411cecd6987a82b091465af06f257c6a313d0a4a64047d26d8260dc525c2d5d4f4baf5e246aa7e6cce31c6da7feb913885433adbd0417beb5f9428a47e5ef15cf9a9e5548db6e0aa7af7c65a5cf22e0836f256b758f2913a8a553aa337b451afffcddce2458c9d7ca9a1f3b6d8239e87ecfadaf4aa97e937722e7cc0b33e751a0ac4d0e1ad132caf78953c01ff8562eb2d014bf6f47c33100a4f02d88b9500292aeb43ca2cb4bb1bd092ac26acd7f200706289ca14353d52dc1405e46490a812ee89e2909cd079f6b320f607c24ceb3f1a4b89409bd27abdc2bcba0e616ecb27a29f6b13164eee6eaa482a791d15d61953c165f5022fe16d32723c94854fd28568f6be84f695ebfb628673ca234b54aa9be9f1fbd0881251aa44f2e5f3a7e3fddec9661295c7caa2145b86f4ceb30a42b8b800681b99b3397c22f2310ee3006d27078d1035091aacd20d9b52e13d27fcc178be718081db53021f22f84815bc9815369c1b698ae7a01a1dcdddd0e8607a0171e5267b353c2d06d410ccf94471b424c81a85aa8f065ff801fd87f75aaa083d73eb4eeeea5c6c3625e61c5e1d86e50064be23b082c04efbee4187f42e9622523fcd86a8e3f33234c1384a177380f6e0053e74e605178dc73974f0ab7b3d2c1cc1f80ffd3c5c90bd1ef8ad2ee1f77046db65429daa77f49cffa34fed8bc2178080dad3c99bb4bd709e2a1bed1880be97d110a9c5d599a681bdb8fd0d467ff7cad8d0b2ab2f0de90cb1b8320563a4a928cd2cabffe42f29d0b146fdf97bddc0556f848e1000cba72e2fb40d1ba3832242ca2923e5f14337b04b710db476f3c452ea8998f161796f6de54a72dfab426909be4f46ec13326c995d1f822dc48ffdd51f81002fd6b1bfc627d2e390a6bd552507542bc0e9920a6ecdbe90a89a8cf7076fa3fac7167a65f410a66bd6e8a793a222c86905df84c753fc70330e7c25bdd7671c172651cd4a942691793c45ce85e02f1213134660ace42888006db5fb7de1baf9d91cdf3c89bc440a382f108547e0edb3a52319dbc535e920f83291dd147182c259bec0ca72339fd83ee4fda4e", 0x1000) r2 = accept(0xffffffffffffff9c, &(0x7f0000000100)=@un=@abs, &(0x7f0000000040)=0x80) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000200)='bpf\x00', 0x82000, &(0x7f00000002c0)={[{@mode={'mode', 0x3d, 0x5}}], [{@fsname={'fsname', 0x3d, '[keyringGPLcgroup'}}, {@subj_type={'subj_type'}}, {@fsname={'fsname', 0x3d, 'selinuxposix_acl_access.cpuset'}}, {@dont_hash='dont_hash'}]}) getsockname$packet(r2, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000001c0)=0x14) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1034.159568] binder: 6168:6173 Release 1 refcount change on invalid ref 0 ret -22 [ 1034.189977] binder_alloc: binder_alloc_mmap_handler: 6168 20001000-20004000 already mapped failed -16 [ 1034.202832] binder: BINDER_SET_CONTEXT_MGR already set 19:17:53 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) ioctl$FS_IOC_FSGETXATTR(r1, 0x801c581f, &(0x7f0000000040)={0x3f, 0x10001, 0x7, 0x80000000, 0x10000}) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1034.209030] binder: 6168:6173 ioctl 40046207 0 returned -16 [ 1034.215648] binder_alloc: 6168: binder_alloc_buf, no vma [ 1034.215668] binder: 6168:6183 transaction failed 29189/-3, size 24-8 line 3255 [ 1034.215925] binder: undelivered TRANSACTION_ERROR: 29189 [ 1034.215970] binder: send failed reply for transaction 1558 to 6168:6173 [ 1034.216005] binder: undelivered TRANSACTION_COMPLETE 19:17:53 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) ioctl$TIOCSTI(r1, 0x5412, 0x1) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ioctl$VT_RESIZEX(r1, 0x560a, &(0x7f00000000c0)={0xc6, 0x7, 0x8, 0x8a0, 0x80, 0xffffffffffff331b}) r2 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) read(r2, &(0x7f0000000140)=""/132, 0x84) fallocate(r2, 0x0, 0x2000424, 0x1) write(r2, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/status\x00', 0x0, 0x0) sendfile(r2, r2, &(0x7f0000001000)=0x19, 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x400454d1, &(0x7f0000000240)=r3) 19:17:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000180)=ANY=[@ANYBLOB="4a1367af3ccbdb4d9a67fe97f6b4190652615ec8afea27e36a7f0000001a94563b2c2d", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000000)={0x6, 0x3f, 0x2, 0x1528, 0x6, [{0x9, 0x101, 0x43, 0x0, 0x0, 0xd00}, {0x9, 0x1, 0x7, 0x0, 0x0, 0x3000}, {0x4, 0x212a, 0x7, 0x0, 0x0, 0x202}, {0x1, 0x6a, 0x7e07, 0x0, 0x0, 0x400}, {0x2c56, 0x8, 0xc451}, {0x2, 0xffff, 0x4, 0x0, 0x0, 0x1}]}) fcntl$setflags(r0, 0x2, 0x1) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/checkreqprot\x00', 0x40000, 0x0) r3 = syz_genetlink_get_family_id$nbd(&(0x7f00000002c0)='nbd\x00') r4 = socket(0x11, 0x800, 0xfff) r5 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000380)='/selinux/checkreqprot\x00', 0x400000, 0x0) r6 = creat(&(0x7f00000003c0)='./file0\x00', 0x84) r7 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000480)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r8 = openat$keychord(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/keychord\x00', 0x0, 0x0) r9 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000500)='/proc/self/net/pfkey\x00', 0x0, 0x0) r10 = openat$full(0xffffffffffffff9c, &(0x7f0000000740)='/dev/full\x00', 0x40, 0x0) r11 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./file0\x00', 0x200002, 0x0) r12 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/vga_arbiter\x00', 0xc40, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000800)={0xffffffffffffffff, 0xffffffffffffffff}) r15 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000840)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$EXT4_IOC_SETFLAGS(r14, 0x40086602, &(0x7f0000000540)=0x81) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000009c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000980)={&(0x7f0000000880)={0xd8, r3, 0x300, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0xfffffffffffffffb}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}, @NBD_ATTR_SOCKETS={0x34, 0x7, [{0x8, 0x1, r4}, {0x8, 0x1, r5}, {0x8, 0x1, r6}, {0x8, 0x1, r7}, {0x8, 0x1, r8}, {0x8, 0x1, r9}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_TIMEOUT={0xc}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x1}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3096}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x100}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_SOCKETS={0x34, 0x7, [{0x8, 0x1, r1}, {0x8, 0x1, r10}, {0x8, 0x1, r11}, {0x8, 0x1, r12}, {0x8, 0x1, r13}, {0x8, 0x1, r15}]}]}, 0xd8}, 0x1, 0x0, 0x0, 0x4000000}, 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0xfffffffffffffd88, 0x0, &(0x7f0000000200), 0xfe07, 0x0, 0x0}) 19:17:53 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000040)=0x0) getpgrp(r2) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1034.216011] binder: undelivered TRANSACTION_ERROR: 29189 [ 1034.326017] binder: 6199:6202 got transaction with invalid offset (0, min 0 max 24) or object. [ 1034.355564] binder: 6199:6202 transaction failed 29201/-22, size 24-8 line 3349 19:17:53 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/policy\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) fcntl$F_GET_RW_HINT(r1, 0x40b, &(0x7f0000000040)) 19:17:53 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) ioctl$TUNDETACHFILTER(r0, 0x401054d6, 0x0) [ 1034.405480] binder: 6199:6202 ioctl c0306201 200001c0 returned -14 [ 1034.417169] binder_alloc: binder_alloc_mmap_handler: 6199 20001000-20004000 already mapped failed -16 [ 1034.435073] binder: BINDER_SET_CONTEXT_MGR already set [ 1034.444469] binder: 6199:6202 ioctl 40046207 0 returned -16 [ 1034.455105] binder_alloc: 6199: binder_alloc_buf, no vma [ 1034.455126] binder: 6199:6207 transaction failed 29189/-3, size 24-8 line 3255 [ 1034.496362] binder: 6199:6214 ioctl c0306201 200001c0 returned -14 [ 1034.497060] binder: undelivered TRANSACTION_ERROR: 29189 [ 1034.497154] binder: undelivered TRANSACTION_ERROR: 29201 19:17:53 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpgrp(0xffffffffffffffff) perf_event_open(0x0, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x7ba27d3a) read(r1, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:53 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:53 executing program 1: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000240)={'nr0\x01\x00', 0x2}) r3 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000140)={0x1, 0xff, 0x7fff, 0x0, 0xf}) fsetxattr$trusted_overlay_origin(r1, &(0x7f00000000c0)='trusted.overlay.origin\x00', &(0x7f0000000200)='y\x00', 0x2, 0x2) fallocate(r3, 0x0, 0x2000424, 0x1) write(r3, &(0x7f00000009c0)='/', 0x1) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r3, r3, &(0x7f0000000040)=0x2000000000, 0xfec) fcntl$setlease(r4, 0x400, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r3, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r2, 0x40045402, &(0x7f0000000000)) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) r2 = creat(&(0x7f00000000c0)='./file0\x00', 0x1f) setxattr$security_smack_entry(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.SMACK64EXEC\x00', &(0x7f0000000080)='@,nodevlo.,vboxnet0\x00', 0x14, 0x1) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x61, &(0x7f0000000100)={'filter\x00', 0x4}, 0x68) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) 19:17:53 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fcntl$F_SET_RW_HINT(r1, 0x40c, &(0x7f0000000040)=0x2) r2 = getuid() getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000000140)=0xc) fchown(r0, r2, r3) fallocate(r1, 0x0, 0x2000420, 0x7fff) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0xffffffa3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7e41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:53 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(r2, 0x29, 0x40, 0x0, &(0x7f0000000300)=0xfe) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r4, &(0x7f00000001c0), 0x7ba27d3a) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000000)={r2, &(0x7f0000000100)="c33167197b875d2465a314e64a2e495db4cea09af530529d90ae67be0bcc97eaada0d2f39752c04614991c1568997b9f6c6f6225cffd0c3f14a9523665e7c4286c55a1662e2d770d602dc8499be6ecaf6c90acbd6a1c6be26a62c5563d63fe2d88dc490be4378791f35717509f5c7da81f04bc615b4a39d0c9b69b31632e13dab4224857580e9df874f2b7f78d"}, 0x10) 19:17:53 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x0, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1034.832527] binder: 6228:6237 Release 1 refcount change on invalid ref 0 ret -22 [ 1034.852533] binder_alloc: binder_alloc_mmap_handler: 6228 20001000-20004000 already mapped failed -16 [ 1034.864969] binder: BINDER_SET_CONTEXT_MGR already set [ 1034.870453] binder: 6228:6237 ioctl 40046207 0 returned -16 19:17:53 executing program 5: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x8000, 0x0) fsetxattr$security_smack_transmute(r0, &(0x7f00000000c0)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000140)='TRUE', 0x4, 0x2) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r2 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r2, 0x0, 0x2000424, 0x1) write(r2, &(0x7f00000009c0)='/', 0x1) write$input_event(r0, &(0x7f0000000180)={{0x0, 0x2710}, 0x11, 0xad, 0x3ff}, 0x18) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r2, r2, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x400454d1, &(0x7f0000000080)) 19:17:53 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) clock_gettime(0x0, &(0x7f0000007480)={0x0, 0x0}) recvmmsg(0xffffffffffffffff, &(0x7f0000007200)=[{{&(0x7f0000000140)=@ax25={{0x3, @rose}, [@bcast, @default, @null, @bcast, @remote, @bcast, @remote, @rose]}, 0x80, &(0x7f0000000300)=[{&(0x7f0000000040)=""/10, 0xa}, {&(0x7f00000001c0)=""/150, 0x96}, {&(0x7f00000000c0)=""/23, 0x17}, {&(0x7f0000000280)=""/117, 0x75}], 0x4, &(0x7f0000000340)=""/106, 0x6a}, 0x1}, {{&(0x7f00000003c0)=@hci, 0x80, &(0x7f00000006c0)=[{&(0x7f0000000440)=""/239, 0xef}, {&(0x7f0000000540)=""/75, 0x4b}, {&(0x7f0000002000)=""/4096, 0x1000}, {&(0x7f00000005c0)=""/104, 0x68}, {&(0x7f0000000640)=""/106, 0x6a}], 0x5, &(0x7f0000000740)=""/8, 0x8}, 0x98a}, {{&(0x7f0000000780)=@vsock={0x28, 0x0, 0x0, @hyper}, 0x80, &(0x7f0000000940)=[{&(0x7f0000000800)=""/127, 0x7f}, {&(0x7f0000000880)=""/143, 0x8f}], 0x2, &(0x7f0000000980)=""/10, 0xa}, 0x9}, {{&(0x7f0000000a00)=@nfc_llcp, 0x80, &(0x7f0000000e00)=[{&(0x7f0000000a80)=""/139, 0x8b}, {&(0x7f0000000b40)=""/88, 0x58}, {&(0x7f0000000bc0)=""/44, 0x2c}, {&(0x7f0000000c00)=""/43, 0x2b}, {&(0x7f0000000c40)=""/235, 0xeb}, {&(0x7f0000000d40)=""/55, 0x37}, {&(0x7f0000003000)=""/4096, 0x1000}, {&(0x7f0000000d80)=""/127, 0x7f}], 0x8}, 0x2000000000000000}, {{&(0x7f0000000e80)=@pppoe={0x18, 0x0, {0x0, @broadcast}}, 0x80, &(0x7f0000000f40)=[{&(0x7f0000000f00)=""/42, 0x2a}], 0x1}, 0x9}, {{&(0x7f0000000f80)=@nl, 0x80, &(0x7f0000001300)=[{&(0x7f0000001040)=""/12, 0xc}, {&(0x7f0000001080)=""/67, 0x43}, {&(0x7f0000004000)=""/4096, 0x1000}, {&(0x7f0000001100)=""/201, 0xc9}, {&(0x7f0000001200)}, {&(0x7f0000001240)=""/190, 0xbe}], 0x6, &(0x7f0000001380)=""/183, 0xb7}, 0x401}, {{0x0, 0x0, &(0x7f0000001540)=[{&(0x7f0000001440)=""/111, 0x6f}, {&(0x7f00000014c0)=""/115, 0x73}], 0x2}, 0x1}, {{&(0x7f0000001580)=@pppol2tpin6, 0x80, &(0x7f0000001700)=[{&(0x7f0000001600)=""/112, 0x70}, {&(0x7f0000001680)=""/104, 0x68}], 0x2}, 0x400}, {{&(0x7f0000001740)=@in6={0xa, 0x0, 0x0, @mcast2}, 0x80, &(0x7f0000001b00)=[{&(0x7f00000017c0)=""/97, 0x61}, {&(0x7f0000001840)=""/236, 0xec}, {&(0x7f0000001940)=""/73, 0x49}, {&(0x7f00000019c0)=""/191, 0xbf}, {&(0x7f0000001a80)=""/12, 0xc}, {&(0x7f0000005000)=""/4096, 0x1000}, {&(0x7f0000001ac0)=""/35, 0x23}], 0x7, &(0x7f0000001b80)=""/50, 0x32}, 0x81}, {{&(0x7f0000001bc0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}}}, 0x80, &(0x7f0000007080)=[{&(0x7f0000001c40)=""/68, 0x44}, {&(0x7f0000006000)=""/4096, 0x1000}, {&(0x7f0000001cc0)=""/213, 0xd5}, {&(0x7f0000001dc0)=""/35, 0x23}, {&(0x7f0000001e00)=""/148, 0x94}, {&(0x7f0000001ec0)=""/253, 0xfd}, {&(0x7f0000007000)=""/83, 0x53}], 0x7, &(0x7f0000007100)=""/223, 0xdf}, 0x6}], 0xa, 0x1, &(0x7f00000074c0)={r2, r3+10000000}) syz_mount_image$ext4(&(0x7f0000001200)='ext3\x00', &(0x7f0000007d40)='./file0\x00', 0x2, 0x7, &(0x7f0000009180)=[{&(0x7f0000007e80)="75da80f18ac24fa4895a988e6a3b19d3a8b8ba5ec612afebb6e5fe9ebd2fa73156dba651b1bf78cf7e03207957366571a7c916ecbc3d26e7acf733f80bba58f2dda1f0496eaae810478f2432bfba755d07f04c0c97535a0bb860093d47f9a4d2051f96781cd7cf702295763feb5dbe41cae87b9db3a61c2b63323ba413ab92a635edb6490410cf0a006064a2fe848d453c44baf5ab60c8e9", 0x98, 0x433}, {&(0x7f0000007f40)="0f24f5c2e43e5bd5e44ebc2bd481ddcd2ae7d90cd396304e021b2be38cc664a98a0128a05b4f3a7d04a7d2531aec836b478c43b9c057ddc916883b66ad16ee85ace10616c8aaf2", 0x47, 0x6}, {&(0x7f0000007fc0)="fc7dfe677e2bb1d02d097c3bab61084c1485bdad00472d50d7405aa11cf2efaf7bd9fc34592958a28a0877641dfe1bc3ddb0e83712b53c99506b59f61463503303e5337393dd922efb116c0c061f6dabe6e5ede86c23459672e620a4f2", 0x5d, 0x4}, {&(0x7f0000008040)="25b4b7e43ac265b6e39b034eed67452b871060f1cafbb14cc8164d6d1c1b0ea81cdb2a63adda9928b992ed34", 0x2c, 0x4}, {&(0x7f0000008080)="c89e25e2e719ee1e75d9a65b0edce679f35b70b8b70a9f909be9f07aa465e4088385a6c291cf781c2d06e7525823348260f0672b49804caaf832bcdb5ca0d31728ddd35078b190d5299968ee36c51d6151250c6027a796e75af18067d7e02b79d03669777c05125184da804073ec3da763fd0ee46b8f95673b0623041654c522854361010d5555cc363062ae9b8a73023de023927b2cab3fbd34e36ab354c9c43bc2baa49cc2bbe28de42866d2e813037878c99c8d91819bc538c40ae72e9adfacb1d571ddc0a27a74003be6ca817cb27d380cf5483957701331d3a094ef7559413fd251cff2fc6eac07a7c60c3e37fb16d6c89a6e7c7048a448c26cbf6795aba867ce53f05e1f0494fdeced5fb95d0a8dc0d21deea172e0fc17caefcab8c4f6c1827fa2777180fc978b35fd12f8bfefc1e38fe4098a744b214c9d606e30f3a5a4f566a617a63f8d75e0ad5a8f03bcff7a5b1978642443360a174fb1f246942762b189ae5fab35db249fab761238a81495714e478e2eb42c90cbe9a43636d17c0338e25ca19664164509310ade22285c53d4457c2cf0e11b31e0bb64d63ce6c23cbae4ca64cf4698c2297c70ae6d1520a205d943e00270d2d012910a6ce8b1bef62ab235712c6fdf9743372b8913df6a0cb62e101d3ec9ef8ff9bde8e612afcd8abd93ad113a2807ebed2d07fabd4818e349b7376fce0ec04c5cefdfd8c27ad04c8230bfaed2cca34b897c36009dfac3a6b9d3da5a10cbcaea7aebd55a83fef47d73e07710c640c933ab21f6157e70a93184e736851375cee9ffd161852259b1b9bc95dbac20d8e1683d5a457d4a5a57537f8f8f60a994736375832890b2e3859ea03d00925242b910b1725d8dd9c08782d26941b8ff3cd0c4151a50dbf6412c993c33df17064ae232771d42c86ab8316c6a632bdded405c4901e48dabb13a503a2625be2ebdc60ab499cef129f39e37e7491b0b72fab7a08943905450d9e7e5570b7d5548f354f4ac515304f6a99015bb040e1dc40793aae6ba474d7f4f3565ae6eb83b65720bff1ff1a859735a14ecaead4f0fdabc7ae63bcf57e15cc48183db9eee54f92ab09ba575c2c1c7ecc5f349151ebd502f6d92dc0f9363649a7ca7757b2ab09afd8a40ca2660b557d6367b2c896929b0673653fa064bb5e68ad8b1e904d5b728818221d691c5de9fbd1d7087825604571d697c2a2aaa1aad12f502be21d37fed7fad29715063e3e1edbc714571be2ba205333ed0daa03c1552d081090274e1b239fbd35cfa122c489be6021028203d6a8b516c2ed0d78c72bb0f5d27d3117ad21c7ab63cf65c739068b1b5ab539f89e272f4d022044bc137bd1b00e971f77bb7a7d6db4034b9a38cf9ee7c57a5520b83fc1fe5c095f5893ac826934e9d61afb4291dd8b317c52670a7ab8839f3ebe52c468e3ce0da567f965a1d51a69278b4de20543c10b840054e71e42389b4e1ce576afd81ae367f2eaa79aabc1dfb4a90eac00f04d5143a1d774405895da48c48ef63ec193a880f47c806a4c039c0377b64d96e2241280e46722ea3bbfba13b44853642cf7ec5709ea01a8d69f2b84105d623c0b405a661aab7a8d69cbb91fc2e90b94998a35c25be66e0e139e526e8cef1e2ce66e9f1d1b5bb86fb0106f038f9f52808e5d32e5b984fa24c9fbfa504cd5e436db9a9891555d7cc1363dcb66271246690de2cc01fed2574ed4f55e95431db252c05819461d89af7459dd252b2b07af3779bf05a849599cd2587b88a856a11cede525cded8bef4f2f992feb2c83f9cf58567da98a570d7aaf8e6af5eb21aa2f25142d6afcc80733591059bc29eeaaf95c1de7fa00c90df35573c2e06092ac2ac5fa9d2023a76d83a8f66c12c190f987d6af5be1d61ba6caca9b3f715e0f2bbfb630b0be2e182a1ddf3526e89d01138dec0aaf199096a0af3b27f5ae9f5356f36d2e7444187388b660dd77f1175923444b59dc4990ac545334f4b18e642972b1afa14be04127c949c5c0ec34e5099352836c96c35a6b8409337e405dba7607b784ade77980cfb556c12d42116a95beac7bf97e454a4c367ccced185b03650f0d28f022e8fa301dae2e633c11314f7360e63fce022d1772a6a794e9f473465e976c7d4950386cd317fd036b0d9c8f0f5633a0d22346a4a7a045020660f2c9b5c17abc25d370b36d8885fa33a4fe8958c97c373462170043e8e367a76923d5692857101123943988acdb2aee181118d27e191203fc88b743efecedd0322dbcd38b6561e0d8444d2611735e3a7e2fa0d39493844e6616178dcbe2e9ae4e73daf318d1ad162329f57dbef173c333bb84ca06cb7801dc47031b235222bd3c9a2605344488bb1ffb6810a4abcadf0a42f32fb1734349ccd4bdb83395d95cffacab473a44a78f17b7b19e7e34f328541202d96be47c9a4e837ac15e3d6058d631b807fab7cc53e45ff5b6b3d698a6281dec6093a6a325f534e0ae1bc1ccb5aa9e106da05754deeb1d78dfd266b7f3fd7412a8ef25c9a02f19bd56f7e1f8fdcb5a62633631ce497388941168d672cd7c8805101ecf5d7827d2431aac6d8b58c8e80c3bab99c4508a8fa0afb832b09cd2943b7490a20615b97cfdd66b0556b3867eb235b0633eefe17877f673891cc8fcc6278c2be1d31b6b2f41b7c59fee54259fd9d008b8b0ef3b3e2d4ad6ec3c95c83d1ed45f26b9a716ec27e8d322b46423d667af9ff168a82573a496c419be358ecd93addbd3a07a913b9222eb3fdb4c3d097ea2d5f2340177e4fedb8768bcc1e9f0b0292344f3c11fbe5850c9a62a91c7b76906369a58c0a2b20c21223bb561603f650c43548405e490b448fbb898170a51809e1034e283671cfe3a63dcbdf1aaa43172f10cee182956a1721340b715be738bda2d9d0d3320eecf142815341a5861091edf2fb01383bfcf10ee55eecdc0d19712390ef2367267eff1391f999c8a186b7d21db57d67da1f257475d2cb50028f2d2e11deb664e264005d36e605440057e1869513562269610184b759f8dbbc67be8f6e817a68c2e8cda4dcfd38342aee8a35c3ffd23063b72063e3e93a5c99da6473b6f37dd4b5074d4b3fe10dc754cb8d5c8a2055530ecc79483b1e9f0633ba12f034dc478bede51b3a6397a597beded03365a309a279f62cabe71070b35c4f3d8fad05b26eb053c17424d696e5d4c816fc1be9c3507a5cd3f8354f8e20b86349940dc0fa4014cb158e4b687a269fd714201638eaf6824c531c04d39bdae45eb7bc7988c05cfdae51fb706791b27c14cf7beaa274bb6abb01d41987e0a4c106903c69b83a463897672e7770c16ebad422ab8dc34e76b53060bb305c5343aaa860bd476aa32f3f671d4be0f411a3922c1d1f8aabe0a700b8d37f7dc5c2baeb278a44a37aab8facaa788febe430c05c0d69ab854603f88cf493937d918ac7b4eea843d109077a2a6eb3a38eecb763a051246e94174f14a3936dfda0aa1a74b37826938f781e6dda8e34b1da07ad6c68ac7dd00d6593fa800962753849dafe945bde5cbf7497bd844ea49b6fb06df3854a942ffa477720312ee0f4a06a18d44c4fc11613a56c1b8bc4c9149418a77af9f34007ce146a0df937f9c98cff2b4bbd8a047343564f69466f05c9a7d0f13be5e6f1eb0bb59abc4283bbec5e1a830c290c78382176ad9fdc2cce24906f9de39b11cac584aa1683527c2623b8f8e06687c4b626fab6fac04698d79e870f77fd86c2d7718c29ed3999568952575150f9db4fcff6f05ddeef93f1fb55d2be6b48cb7c147d3fa4b3e68b9db95eedd8c13edacd31fa9aa8ad29768b07248c175a2c4d6cc1c6f84e71e29a50e228755a3db9f2cd7f354c4a7c3178a4f1a3e3a6ef1acc95ffbca7e69b87cedb12eb0bd2e36ad4273ceb5188ce56e24dae3e73717d05ed1e90a15b91a4fa74a4b18784aa0d07cde9bd4a23781b2d277e7a20d5ad326d9fd9ab4b3668f87be7040c0433331fda350ce374e416a058f315725d603297ea298ebd6a174df8c85f721becda17834e8a23759ef1be234a0f03f8dfc2f40058d43f099322e4c728fcaf2503741e905646e5a6d8867eea2b4e670b728b321e803d9be4cc5fe4ad7d0d9ab4db7122e95c5c3e7e51f94c86ebe7eb51f9b9e804cc0eabcab999641948aa95c614dcb2622c4f5cb87e357aebeb7ef3cc31ceaf467c13fd78bfbee91f635ad7473781df5a04d4ad2909319c7eb04ab79cc31d87fdcfe610ed0ae02df17de94c236e69a661da4257daa23652754832476bfed03b923f773dd2c13155805b4a76e02bd0fd3832f4966162ab620bcf69274740743b0ead59f2575162728cbfc0957b1acbef21e6e5c66c3bc454d5d3091cb6e60ce1a08787b2dcf1da77102061558baba63b302b4507ea7ddeae0a7c16030d8b9d480b08981e5270e669de5479f0f8984adbc94ca796561c398fff52ecc6c4b91b1b99894986ec74ecf18ce46248309872b77ddc0b420f2822ae4ef3ec12645cac635dcf424d298a069409c86ea2d7af143cf52dd886e4ec304604f57578ba56847a95fe3d1a213d284cfd3e68a416852aaf15cd40c9237275b9a966fc3175cf47f9dde1c6ac1eb5321ed51706d309f3156d81d91eb607dd68be1d856fe4a2f62cd4ee2d5756d51a47ea3900e6eca559d6917a6d0ca8376d6adf7ff7e7529b6c422a29869eb55c5ab11c45a61f4c50bd9ab1f5017bd927a49cdea30563b2385ec0ba0aee7be48214215fdca4af1c08c1b8ef4b74afc39e2e7aa8cef36d0f94fe1c23411e49d6a9450f83a97f20c78b9235aa4fd9f2566876e8019606d3f311cd457d48682652e18c84320ae757f8caf7ed3bf6ce952dfbd08b8c497ffad5a691ca09a1a66ac9ac26761a77ad6608fe3e7330b2e7f2b8ec1b482ade18cc67829aa41594c96de11906d0f76e01a49a7b2e7514d0dbe3e3f2a8bb13774ca57316a1b848305368249583572236b601b00ce6f131553a1f45fd1802b90abd0358cdc3dc193a8f85e970a0428107c81a36f97ea88f003e890fd50a9433d5b7f3b31d74081c0d8d6a8567f5568a43d9ce2e8a1d4c9d2ffe34c8bf8ef62fcc8f5dbb0f6e459781dc1169e307d28d5b8d528720a20522954c455587b96696a80feb1a1ad8fd4b2fc3b28185d084fa0318694e3b65fc555535b4aa3954a81b5212a76807ffcd4358a8cb49a7cae875c1579c4e0edcbd67632e2e928ea5e15a0514030ddfd6d88dc27d81721fd6489badaad585804dcdfb34e7ae54468bd481978eb174939b877e394a064529d284277f5809c4ffcc756d613c5fc3fd5395cf495ac7695397490e9e1a62cf58de9948f8da95d60b885935253b96774db832a51622c9650cb94a4f00988749cf04ad0c817860db08e100d147121569d5a0e647777c40d58d7ef83e8d3e58ab4cfe5791713d5b093847231ee94d578ef8ddaefff13f0a44fdd1162a7ef6ab537ef1adcc47d36367af24dcc6719f9219464bc6ef13cb71f47d4c76f44feda31a6fcfa39f978efb9173f16977b83c6be9efefb004f2ea6a05bb7d9026dbf4eb1105ea70edc1725ef825a2b1c345d481f2ee43a98c7a2509d5adcf97c755df13b1a6af05bdfeb5300bcf97c5230271411fa1997f178e1aba6a839c710e197dbe5799550e7e00b7553d06c946d7582ba16ebb11d41b2e524b1a914549bed6878f414f8285a0b7a053926040d23fdd34485ea0e36be2c7f2af3b68d692fbdc8f04429ec3d3a9537c2bc7a480e9fc37f3507365182f8b254ee0e275acf7949bb4f42f70a69755481c16bc030293c919", 0x1000, 0x8000}, {&(0x7f0000009080)="b172abf09053725272ec115000e5b6f2f0172aef026b64", 0x17, 0x1}, {&(0x7f00000090c0)="8a4a2b302a8b3e1655f68902b988cdcdb72e016b7326db7732d8fc7925040379578a4118057b0d760522c1d3df457af3ddc119f422071bbf240fbdaaa0fb1a3d7d1e2e6e666a39329f573d65fac1d10519cdac2977b2f12d149b359b6a0d46adcceacf4be4cce3f5e6b4f3c6f02694822ff869f5cf7ff1c743ce28f7ab41706190a8205d3cd40d9f7f23754939a4869573caa059f64facadec051a1de730dd8bb4baae326838ce95bd5ea76735e97f198c9d77308835d1", 0xb7, 0x3}], 0x1080000, &(0x7f0000009240)={[{@nombcache='nombcache'}], [{@obj_role={'obj_role', 0x3d, '/dev/net/tun\x00'}}, {@smackfsdef={'smackfsdef', 0x3d, '/dev/net/tun\x00'}}]}) recvmmsg(r4, &(0x7f0000007d80)=[{{0x0, 0x0, &(0x7f0000007600)=[{&(0x7f0000007500)=""/200, 0xc8}], 0x1, &(0x7f0000007640)=""/134, 0x86}, 0xfffffffffffff1e3}, {{&(0x7f0000007700)=@hci, 0x80, &(0x7f0000007a40)=[{&(0x7f0000007780)=""/41, 0x29}, {&(0x7f00000077c0)=""/115, 0x73}, {&(0x7f0000007840)=""/143, 0x8f}, {&(0x7f0000007900)=""/32, 0x20}, {&(0x7f0000007940)=""/76, 0x4c}, {&(0x7f00000079c0)=""/103, 0x67}], 0x6, &(0x7f0000007ac0)=""/111, 0x6f}, 0x5}, {{&(0x7f0000007b40)=@nfc, 0x80, &(0x7f0000007d00)=[{&(0x7f0000007bc0)=""/74, 0x4a}, {&(0x7f0000007c40)=""/177, 0xb1}], 0x2, &(0x7f0000007d40)}}], 0x3, 0x10020, &(0x7f0000007e40)={0x0, 0x989680}) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1034.876934] binder_alloc: 6228: binder_alloc_buf, no vma [ 1034.876952] binder: 6228:6244 transaction failed 29189/-3, size 24-8 line 3255 [ 1034.886099] binder: 6228:6250 Release 1 refcount change on invalid ref 0 ret -22 [ 1034.886403] binder: undelivered TRANSACTION_ERROR: 29189 19:17:53 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1034.886469] binder: send failed reply for transaction 1566 to 6228:6237 [ 1034.886505] binder: undelivered TRANSACTION_COMPLETE 19:17:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000280)='/dev/binder#\x00', 0xffffffffffffffff, 0x800) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) finit_module(r1, &(0x7f0000000000)='/dev/binder#\x00', 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3e, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYRES16=r0, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="369577467d37363f"]], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) r2 = open(&(0x7f0000000040)='./file0\x00', 0x107400, 0xe0c68d55c828ea53) setsockopt$inet_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000080)={@in6={{0xa, 0x4e23, 0xfff, @mcast1, 0x9}}, 0x0, 0x7fff, 0x0, "133b7990cdaf6725d4f5e55959d3e47d21e3a04f4872416a5417d2cccc93c1608a7cc8a71edb77a9a0e0399c39504c95e9c3aa62f7ff9fa2eee39a1dd5126aa36d7484f5b9c49da174a1bd705fb7f827"}, 0xd8) ioctl$VT_GETSTATE(r2, 0x5603, &(0x7f0000000180)={0x9, 0xffffffffffffffff, 0x9}) [ 1034.886511] binder: undelivered TRANSACTION_ERROR: 29189 19:17:53 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1035.153630] binder: 6272:6278 got transaction with invalid data ptr [ 1035.177334] binder: 6272:6278 transaction failed 29201/-14, size 24-8 line 3287 [ 1035.204974] binder: 6272:6281 Release 1 refcount change on invalid ref 0 ret -22 [ 1035.232214] binder_alloc: binder_alloc_mmap_handler: 6272 20001000-20004000 already mapped failed -16 [ 1035.249228] binder: BINDER_SET_CONTEXT_MGR already set [ 1035.258159] binder: 6272:6278 ioctl 40046207 0 returned -16 [ 1035.263324] binder: 6272:6283 Release 1 refcount change on invalid ref 0 ret -22 [ 1035.264317] binder_alloc: 6272: binder_alloc_buf, no vma [ 1035.264338] binder: 6272:6281 transaction failed 29189/-3, size 24-8 line 3255 [ 1035.265896] binder: undelivered TRANSACTION_ERROR: 29189 [ 1035.265965] binder: undelivered TRANSACTION_ERROR: 29201 19:17:54 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0x7ba27d3a) read(r0, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:54 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000140)="8569544d1031e47c407b29ec500aaa73", 0x10, 0xfffffffffffffffc) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f0000000180)={r2, 0x3f, 0xeb20}, &(0x7f00000001c0)={'enc=', 'pkcs1', ' hash=', {'sha3-512-ce\x00'}}, &(0x7f0000000240)="198d2c30ea2533122a5c85286b5f5fa2a0d04449f8038ee96c6469b68a8349777c9575b7b3947960299af7c45cb0bab18e456b32e80517c6383299b6d0623b9c4dc86110e085dd934230abd2327084b0c0b0e5d08bc12a76eea6401ab8b5a56b0eaddd3cc87c433c4d449c31529ee2b6a02a866d9afd247360a5cdbb2fe02de21c2f31d3efa045ffee9752740116638ce33001ba7d9f4d288e16028c00b6c1cdedeedc40e5c67dca2e5cd007fe", &(0x7f0000000300)="b4") perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:54 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r0, 0x10, 0x2000424, 0x88d) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:54 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BLKFRASET(r2, 0x1264, &(0x7f0000000000)=0x3) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r4, &(0x7f00000001c0), 0x7ba27d3a) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="faffffffffffffff"]], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) 19:17:54 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) fsetxattr$security_evm(r2, &(0x7f0000000040)='security.evm\x00', &(0x7f00000000c0)=@md5={0x1, "fbf3f884d98dad1763079bd66a9efa5d"}, 0x11, 0x1) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:54 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r0, 0x22, 0x3, 0x3f) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x40000000004, 0x11, r2, 0x3) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1035.543074] binder: 6294:6297 got transaction with invalid offset (-6, min 0 max 24) or object. [ 1035.583589] binder: 6294:6297 transaction failed 29201/-22, size 24-8 line 3349 [ 1035.599756] binder: 6294:6310 Release 1 refcount change on invalid ref 0 ret -22 19:17:54 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_FLUSH(r2, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400010}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x6c, r3, 0x0, 0x70bd26, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x24, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xff}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x81}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x40}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x200}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x1e}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xfffffffffffeffff}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3fe}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xf49}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4}, 0x0) [ 1035.625067] binder_alloc: binder_alloc_mmap_handler: 6294 20001000-20004000 already mapped failed -16 [ 1035.669156] binder_alloc: 6294: binder_alloc_buf, no vma [ 1035.669159] binder: BINDER_SET_CONTEXT_MGR already set 19:17:54 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)=ANY=[@ANYBLOB="400000001500080c28bd7000fcdbdf25020001fd", @ANYRES32=r3, @ANYBLOB="14000300000000000000000000000000000000001400030074659cdf5f736c6176655f3000000000"], 0x40}, 0x1, 0x0, 0x0, 0x40000}, 0x4805) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000140)=0x5, 0x4) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1035.669172] binder: 6294:6297 ioctl 40046207 0 returned -16 [ 1035.715347] binder: undelivered TRANSACTION_ERROR: 29201 19:17:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r2, 0x0, 0x40, &(0x7f0000000000)={'mangle\x00'}, &(0x7f0000000080)=0x54) [ 1035.792954] binder: 6294:6310 transaction failed 29189/-3, size 24-8 line 3255 [ 1035.828499] binder: undelivered TRANSACTION_ERROR: 29189 19:17:54 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000040)={0x0, 0x2, 0x7, 0x2}) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1035.901512] binder: 6323:6325 Release 1 refcount change on invalid ref 0 ret -22 [ 1035.938741] binder_alloc: binder_alloc_mmap_handler: 6323 20001000-20004000 already mapped failed -16 19:17:54 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) prctl$PR_GET_FPEMU(0x9, &(0x7f0000000040)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1035.971475] binder: BINDER_SET_CONTEXT_MGR already set [ 1035.977284] binder: 6323:6325 ioctl 40046207 0 returned -16 [ 1035.983370] binder_alloc: 6323: binder_alloc_buf, no vma [ 1035.983403] binder: 6323:6329 transaction failed 29189/-3, size 24-8 line 3255 [ 1035.984010] binder: 6323:6329 Release 1 refcount change on invalid ref 0 ret -22 [ 1035.989161] binder: undelivered TRANSACTION_ERROR: 29189 [ 1035.989215] binder: send failed reply for transaction 1577 to 6323:6325 [ 1035.989247] binder: undelivered TRANSACTION_COMPLETE [ 1035.989265] binder: undelivered TRANSACTION_ERROR: 29189 19:17:55 executing program 3: perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0x7ba27d3a) read(r0, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:55 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r0, 0x10, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='net/if_inet6\x00') ioctl$UI_SET_MSCBIT(r2, 0x40045568, 0x10) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r2, r3, &(0x7f0000001000)=0x8000, 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:55 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'n\x00', 0x1000}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r2 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x4000) sendmsg$nl_netfilter(r2, &(0x7f0000000200)={&(0x7f0000000040), 0xc, &(0x7f00000000c0)={&(0x7f0000000180)={0x5c, 0xe, 0x6, 0x100, 0x70bd26, 0x25dfdbff, {0x2}, [@typed={0xc, 0xd, @u64=0x8}, @generic="d5097e1f320ee7091c209e650d5c72c95fc5c69ddf4269e5e844cc4fc626052f2104676c194f51b8357dcd2d738464dc23ea04cbd69c026b67ef1e6e"]}, 0x5c}}, 0x0) fallocate(r1, 0x0, 0x1, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fsetxattr$trusted_overlay_origin(r2, &(0x7f0000000280)='trusted.overlay.origin\x00', &(0x7f00000002c0)='y\x00', 0x2, 0x44825aa0b218f41b) sendfile(r1, r1, &(0x7f0000001000), 0xfec) sendfile(r3, r2, &(0x7f0000000240), 0x9b7) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:55 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x2000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) getcwd(&(0x7f00000003c0)=""/195, 0xc3) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000000)={r2, 0x50, &(0x7f0000000100)={0x0, 0x0}}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000180)=r3, 0x4) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r5, &(0x7f00000001c0), 0x7ba27d3a) read(r4, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$ARPT_SO_GET_INFO(r2, 0x0, 0x60, &(0x7f0000000000)={'filter\x00'}, &(0x7f0000000080)=0x44) 19:17:55 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:55 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0xffffffffffffffff, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x282, 0x0) ioctl$TIOCGSOFTCAR(r2, 0x5419, &(0x7f00000000c0)) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x4, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:55 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) r2 = accept4$inet6(0xffffffffffffff9c, &(0x7f0000000040), &(0x7f00000000c0)=0x1c, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r2, 0x5411, &(0x7f0000000140)) [ 1036.348491] binder: 6352:6357 Release 1 refcount change on invalid ref 0 ret -22 [ 1036.382607] binder_alloc: binder_alloc_mmap_handler: 6352 20001000-20004000 already mapped failed -16 19:17:55 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0x400c6615, &(0x7f0000000040)) prctl$PR_SET_TIMERSLACK(0x1d, 0x9) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1036.400787] binder: BINDER_SET_CONTEXT_MGR already set [ 1036.406748] binder: 6352:6357 ioctl 40046207 0 returned -16 [ 1036.407081] binder_alloc: 6352: binder_alloc_buf, no vma [ 1036.407101] binder: 6352:6366 transaction failed 29189/-3, size 24-8 line 3255 19:17:55 executing program 1: r0 = openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$smack_current(r0, &(0x7f00000000c0)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x3f) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r2 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r2, 0x0, 0x2000424, 0x1) write(r2, &(0x7f00000009c0)='/', 0x1) r3 = getegid() getgroups(0x9, &(0x7f0000000540)=[0x0, 0x0, 0xee01, 0xee00, 0xee00, 0xee00, 0xee01, 0xee01, 0xee01]) setregid(r3, r4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) readv(r2, &(0x7f00000004c0)=[{&(0x7f0000000140)=""/153, 0x99}, {&(0x7f0000000200)=""/198, 0xc6}, {&(0x7f0000000300)=""/55, 0x37}, {&(0x7f0000000340)=""/137, 0x89}, {&(0x7f0000000400)=""/156, 0x9c}], 0x5) sendfile(r2, r2, &(0x7f0000001000), 0xfec) fcntl$getown(r0, 0x9) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x400454d1, &(0x7f0000000080)) [ 1036.407952] binder: 6352:6366 Release 1 refcount change on invalid ref 0 ret -22 [ 1036.409807] binder: undelivered TRANSACTION_ERROR: 29189 [ 1036.409855] binder: send failed reply for transaction 1582 to 6352:6357 19:17:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x400000, 0x40) getresuid(&(0x7f0000000040), &(0x7f0000000080)=0x0, &(0x7f00000000c0)) r4 = getegid() getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000540)={{{@in=@remote, @in6=@ipv4={[], [], @broadcast}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@multicast2}}, &(0x7f0000000100)=0xe8) write$P9_RSTATu(r2, &(0x7f0000000640)={0x95, 0x7d, 0x2, {{0x0, 0x73, 0x10000, 0x9, {0x80, 0x2, 0x8}, 0x10000000, 0x5, 0x400, 0x101, 0xd, '/dev/binder#\x00', 0x16, '}:X&vboxnet0(\'vboxnet0', 0xd, '/dev/binder#\x00', 0x10, 'securitykeyring)'}, 0xd, '/dev/binder#\x00', r3, r4, r5}}, 0x95) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) [ 1036.409889] binder: undelivered TRANSACTION_COMPLETE [ 1036.409895] binder: undelivered TRANSACTION_ERROR: 29189 19:17:55 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) ioctl$TUNSETSNDBUF(r0, 0x400454d4, &(0x7f0000000040)=0x80000000) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1036.557878] binder: 6383:6384 Release 1 refcount change on invalid ref 0 ret -22 [ 1036.582269] binder: BINDER_SET_CONTEXT_MGR already set [ 1036.594252] binder: 6383:6386 ioctl 40046207 0 returned -16 [ 1036.600106] binder_alloc: 6383: binder_alloc_buf, no vma [ 1036.605662] binder: 6383:6384 transaction failed 29189/-3, size 24-8 line 3255 [ 1036.621801] binder: 6383:6386 Release 1 refcount change on invalid ref 0 ret -22 [ 1036.622050] binder: send failed reply for transaction 1587 to 6383:6384 [ 1036.622086] binder: undelivered TRANSACTION_COMPLETE [ 1036.622093] binder: undelivered TRANSACTION_ERROR: 29189 [ 1036.682968] binder: undelivered TRANSACTION_ERROR: 29189 19:17:55 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x200, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000040)={0x0, @remote, @initdev}, &(0x7f0000000080)=0xc) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x7ba27d3a) read(r1, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:55 executing program 1: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040)={0x0}, &(0x7f00000000c0)=0xc) rt_sigqueueinfo(r0, 0x2, &(0x7f0000000140)={0xf, 0xe8, 0xa1c9}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r2 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r2, 0x0, 0x2000424, 0x1) write(r2, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r2, r2, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x400454d1, &(0x7f0000000080)) 19:17:55 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) r2 = getpgrp(0xffffffffffffffff) ptrace$cont(0x1f, r2, 0x653, 0x8) 19:17:55 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) fcntl$getown(0xffffffffffffffff, 0x9) r2 = socket$inet6(0xa, 0x3, 0x8) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000000)={@local, 0x0, 0x0, 0xff, 0x3}, 0x20) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) r3 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x50040, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(r3, 0x891c, &(0x7f0000000180)={'ip6gretap0\x00', {0x2, 0x4e20, @loopback}}) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000140)={&(0x7f0000000040)='./file0\x00', r3}, 0x10) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:55 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = getpgid(0xffffffffffffffff) wait4(r2, &(0x7f0000000000), 0x4, &(0x7f0000000100)) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(r0, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r3) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r5, &(0x7f00000001c0), 0x7ba27d3a) read(r4, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:55 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) r1 = accept$inet(0xffffffffffffffff, 0x0, &(0x7f0000000040)) setsockopt$EBT_SO_SET_COUNTERS(r1, 0x0, 0x81, &(0x7f0000000140)={'filter\x00', 0x0, 0x0, 0x0, [], 0x1, &(0x7f00000000c0)=[{}], 0x0, [{}]}, 0x88) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r2 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r2, 0x0, 0x2000424, 0x1) write(r2, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r2, r2, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1037.144673] binder: 6409:6412 Release 1 refcount change on invalid ref 0 ret -22 [ 1037.182453] binder_alloc: binder_alloc_mmap_handler: 6409 20001000-20004000 already mapped failed -16 19:17:56 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000000140)='\x00\xac=\x9d\xd2\xdbN\x12\x9b\x1f\t\xbd\'+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0fr\xaf\x8e\xaei\x12 ]\x16E\xff\r\x1f\xc0\x8dX\xbc\xc2\xbb\xdc\xdb;\x99\xff\xa5\xff\xda@\xc4c\x8c?IJ\rh\xf9\xb1\xbep\xfb\xaf\xa8\am\f\xe9\xe9\tk\xe6\x01hy\xfe|\x17\x02\b\xbe\x11qA\"/\xf9\x01(\xbe>\x91\x7fiac\xaa\xae\x03\x8a\xf46\x01\xdc\x88}\xa8\xdaF:P\xad\xd4\xb2\xbc\xb3\x13\xcfE2\x81\x94\x90\'\x81\x021\x95\'B\xc6\xc6\xdc\xc2\xbfUJ\xb3\xc5\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x1) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) r2 = creat(&(0x7f0000000040)='./file0\x00', 0x0) ioctl$TCSETAF(r2, 0x5408, &(0x7f00000000c0)={0x0, 0x5, 0x9, 0x8000, 0x15, 0x4, 0x0, 0x417f, 0x9, 0xfffffffffffffffa}) 19:17:56 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'nr0\x01\x00\x00\x00 \a\x00\x00\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) r2 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000140)={r2, 0x7ff, 0x5}, &(0x7f0000000180)={'enc=', 'raw', ' hash=', {'crct10dif-generic\x00'}}, &(0x7f0000000200)="5982b4f6840580049c6e5530576c0861f2e9bd7ac3f4a3709a8d70c0c625fdecd6313058136d28b8c532adfa96b5e3e3c17484250190515f62b07af40fd30b93bac17f25e93081cc841b6422aec064d19b6450a19f16049d3fbe2e2afff85c36aee82ab347496ee07e782ad0e1534ff168ecb6422adac745f9d42dd3d96d8c", &(0x7f0000000280)=""/93) 19:17:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) r3 = getpgrp(0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000100)=0x7) r4 = creat(&(0x7f0000000140)='./file0\x00', 0x1) ioctl$TIOCSPGRP(r4, 0x5410, &(0x7f0000000180)=r3) r5 = getpid() write$cgroup_pid(r2, &(0x7f0000000040)=r5, 0x12) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="0702fffffffb0000"]], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x40, 0x0) ioctl$PPPIOCCONNECT(r4, 0x4004743a, &(0x7f0000000280)=0x400) [ 1037.197005] binder: BINDER_SET_CONTEXT_MGR already set [ 1037.202662] binder: 6409:6412 ioctl 40046207 0 returned -16 [ 1037.208877] binder: 6409:6421 Release 1 refcount change on invalid ref 0 ret -22 19:17:56 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f00000001c0), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180)='/dev/zero\x00', 0x121000, 0x0) write$UHID_CREATE2(r3, &(0x7f00000006c0)={0xb, 'syz0\x00', 'syz0\x00', 'syz0\x00', 0xfa, 0x25c, 0xffff, 0x0, 0x3, 0x755d, "2a639d7b88c472a94fb699c81bc3b2f4b9a29545482acf17499c9cf98343628974125ea692a428633d6c9bb2e31dfac65fba0fe8031f334f1cb2b2475ac847cac804314b89b01f486159926e356ce693c53cd746767ae719369706a33665451c2f4be5f752702047845535607e4e0e49eafab6885e456bf2b8c58a4a4a4436fee90d401d26e3ea57f592a4f87cc4ed3461a64a0778be24746a80f824f347d807879f8c2bd1fdb7a1383c8a8b6d35479192f2744a0f0ade7931855054d77a5f89f2ca960523bc9c49143c2e60b53ba3751975fb65532f137c69d3042ed0e29f54380b7eb971ea6aceaad981e0eefe5cebf456cad0b5455a5e7d7b"}, 0x212) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) r4 = dup3(r2, r2, 0x80000) getpeername$packet(0xffffffffffffff9c, &(0x7f0000000580)={0x11, 0x0, 0x0}, &(0x7f00000005c0)=0x14) sendmsg$nl_route_sched(r4, &(0x7f0000000680)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000001}, 0xc, &(0x7f0000000640)={&(0x7f0000000280)=ANY=[@ANYBLOB="400000002900100c25bd7000ffdbdf250000c4dd9d147c3f434f89f8bde390c9e34569e37c4c720b8fc1dbc4d7bba6e21a284fcba22457fffb4d171b231b675a3758394a99c6049a91a676098c643e6bd8cad4a1fb8082d4d6d90f68c9671d3dc3a57966fe411f11a207d4cdd0e7ed33d064eef7f455f93d5e5beeea47ad25f0122e461eacaeb0e45a24f565b9a4e44809233ae5f882daab2d9bc4aec4386f8c6d4601ab6d464c43d7c86da680807f3c520e74782bcb09b99355f2e5abad5a7eafd287fbb4cccadfeca617785308e4a5b9255ac61d5e5ecccf77b7579d4d8b0dd3a4021a13604f04b57ca62b41dc43213dede70de1e24553869cd829201aef162fd72fe04c44a767e51d05d9f42314c749ba3bfdc0be1e619d002d34d68ab4f337b6949bb53bbcf751782bbf7daca9ec0ea4aecf934c5e856c8b79389186d08bf3c07ffde7030ff585b29d4e84066adb41b1c2170152d1c934a5094752467efa3cd699cc756e32e109d02c71ad504752e13836b306a6961481e1d17dbcf1f6f3c73a330469c8bbe83799b6ba108bcc54e6111a9574476b4673826a3e862281a66c15d1", @ANYRES32=r5, @ANYBLOB="ffffffff07000000ebff0f000800050005ff000008000100647272000c0002000800010005000000"], 0x40}, 0x1, 0x0, 0x0, 0x4004004}, 0x44805) r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x1, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x23, &(0x7f00000000c0)={&(0x7f0000001000/0x4000)=nil, 0x4000}, &(0x7f0000000140)=0x10) 19:17:56 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = getpgid(0xffffffffffffffff) ioprio_set$pid(0x2ef0081c45f21cb9, r2, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) memfd_create(&(0x7f0000000040)='ppp0lo\x00', 0x7) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1037.269732] binder: 6433:6435 got transaction with invalid offset (277076930134535, min 0 max 24) or object. [ 1037.287071] binder: 6433:6435 transaction failed 29201/-22, size 24-8 line 3349 [ 1037.306316] binder: 6433:6435 Release 1 refcount change on invalid ref 0 ret -22 [ 1037.346473] binder_alloc: binder_alloc_mmap_handler: 6433 20001000-20004000 already mapped failed -16 [ 1037.380767] binder: BINDER_SET_CONTEXT_MGR already set [ 1037.380778] binder: 6433:6435 ioctl 40046207 0 returned -16 [ 1037.433904] binder_alloc: 6433: binder_alloc_buf, no vma [ 1037.439403] binder: 6433:6435 transaction failed 29189/-3, size 24-8 line 3255 [ 1037.447520] binder: 6433:6444 Release 1 refcount change on invalid ref 0 ret -22 [ 1037.447949] binder: undelivered TRANSACTION_ERROR: 29201 [ 1037.466319] binder: undelivered TRANSACTION_ERROR: 29189 19:17:56 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0xfffffffffffffd76) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000000200), 0x6a2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) r3 = epoll_create(0x1) epoll_ctl$EPOLL_CTL_DEL(r3, 0x2, r1) memfd_create(&(0x7f00000001c0)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x2) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0}, &(0x7f0000000140)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000040)='security.capability\x00', &(0x7f0000000180)=@v3={0x3000000, [{0x6, 0x9}, {0x5, 0x6}], r4}, 0x18, 0x1) ppoll(&(0x7f0000000240)=[{r2, 0x5100}], 0x1, &(0x7f0000000280)={0x77359400}, &(0x7f00000002c0)={0x1ff}, 0x8) 19:17:56 executing program 5: pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000140)={0xe37, 0x2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r3 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r3, 0x0, 0x2000424, 0x1) write(r3, &(0x7f0000000040)='/', 0x1) fgetxattr(r2, &(0x7f00000001c0)=@random={'trusted.', 'nr0\x01\x00'}, &(0x7f0000000200)=""/144, 0x90) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r3, r3, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r3, 0x0) ioctl$RTC_PIE_OFF(r0, 0x7006) ioctl$FS_IOC_FSGETXATTR(r1, 0x801c581f, &(0x7f0000000180)={0x8, 0x1ff, 0x9, 0x4}) ioctl$TUNSETSTEERINGEBPF(r2, 0x400454d1, &(0x7f0000000080)) 19:17:56 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) fallocate(0xffffffffffffffff, 0x0, 0x2000424, 0x1) write(0xffffffffffffffff, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000040)) 19:17:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x40200, 0x0) setsockopt$packet_fanout_data(r2, 0x107, 0x16, &(0x7f0000000080)={0x4, &(0x7f0000000040)=[{0x7, 0x0, 0x3f, 0x9}, {0x8, 0x6, 0x4, 0x100000001}, {0xa5, 0x1, 0x1, 0x100000000}, {0x50, 0x5fab, 0x0, 0x3ff}]}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00040000000000007aab4c4dfeb3cbb970df2ae123736faf8da83b"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) 19:17:56 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x6, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext, 0x0, 0x7fff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sync_file_range(r0, 0x0, 0x3, 0x7) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x7ba27d3a) read(r1, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:56 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) fsync(r0) r2 = gettid() perf_event_open(&(0x7f0000000100)={0x4, 0x70, 0x1, 0x3, 0x7, 0x2, 0x0, 0x0, 0x40, 0x7, 0x3, 0x80, 0x8, 0x0, 0x1, 0x10000, 0x6, 0x4, 0x9, 0x3, 0x8, 0x0, 0x4, 0x3, 0x24000000000, 0xd8, 0xdda7, 0x9, 0x8, 0x8000, 0x2, 0x5, 0x5, 0x3ff, 0x0, 0x100000001, 0x9bb6, 0x20, 0x0, 0x6, 0x3, @perf_bp={&(0x7f0000000000), 0x4}, 0x282, 0x0, 0x200, 0xb, 0x40, 0x7, 0x10000}, r2, 0xffffffffffffffff, 0xffffffffffffff9c, 0x2) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/checkreqprot\x00', 0x28100, 0x0) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r4, &(0x7f00000001c0), 0x7ba27d3a) openat$ion(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ion\x00', 0x90000, 0x0) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:56 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1037.712982] binder: 6458:6463 Release 1 refcount change on invalid ref 0 ret -22 [ 1037.729460] binder_alloc: binder_alloc_mmap_handler: 6458 20001000-20004000 already mapped failed -16 [ 1037.744724] binder: BINDER_SET_CONTEXT_MGR already set [ 1037.750483] binder_alloc: 6458: binder_alloc_buf, no vma 19:17:56 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/raw\x00') ioctl$GIO_SCRNMAP(r1, 0x4b40, &(0x7f00000000c0)=""/43) r2 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r2, 0x0, 0x2000424, 0x1) write(r2, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r2, r2, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) time(&(0x7f0000000080)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="066304400c1152d7"], 0x0, 0x0, 0x0}) 19:17:56 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x24) ioctl$EVIOCGKEYCODE(r2, 0x80084504, &(0x7f00000000c0)=""/7) fallocate(r1, 0x0, 0x6, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) ioctl$TUNSETFILTEREBPF(r0, 0x800454e1, &(0x7f0000000140)=r2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = request_key(&(0x7f0000000180)='asymmetric\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0xfffffffffffffffb) keyctl$read(0xb, r3, &(0x7f0000000240)=""/171, 0xab) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1037.753749] binder: 6458:6463 ioctl 40046207 0 returned -16 [ 1037.771194] binder: 6458:6467 transaction failed 29189/-3, size 24-8 line 3255 [ 1037.784116] binder: undelivered TRANSACTION_ERROR: 29189 [ 1037.789940] binder: send failed reply for transaction 1596 to 6458:6463 19:17:56 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) r2 = accept(0xffffffffffffff9c, 0x0, &(0x7f0000000040)) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00') r4 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000240)='/dev/keychord\x00', 0x400000, 0x0) ioctl$PPPIOCATTACH(r4, 0x4004743d, &(0x7f0000000280)=0x1) sendmsg$TIPC_CMD_SHOW_STATS(r2, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, r3, 0x100, 0x70bd2c, 0x25dfdbfe, {}, ["", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4040) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1037.817354] binder: undelivered TRANSACTION_COMPLETE [ 1037.838372] binder: undelivered TRANSACTION_ERROR: 29189 [ 1037.852323] binder: 6488:6490 Release 1 refcount change on invalid ref -682487540 ret -22 [ 1037.869590] binder: BINDER_SET_CONTEXT_MGR already set 19:17:56 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) r3 = dup(r2) unlinkat(r3, &(0x7f0000000040)='./file0\x00', 0x0) [ 1037.899246] binder: 6488:6492 ioctl 40046207 0 returned -16 19:17:56 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x6, 0x2}, 0x0, 0x0, 0x100000000000002}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x13, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1037.911024] binder_alloc: 6488: binder_alloc_buf, no vma [ 1037.911042] binder: 6488:6490 transaction failed 29189/-3, size 24-8 line 3255 19:17:56 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x400, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000140)={r2, 0x7, 0x1, 0x401, &(0x7f00000000c0)=[0x0, 0x0, 0x0], 0x3}, 0x20) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1037.919145] binder: 6488:6496 Release 1 refcount change on invalid ref -682487540 ret -22 [ 1037.919390] binder: undelivered TRANSACTION_ERROR: 29189 19:17:56 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x1000000000000000, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) write$binfmt_elf64(r0, &(0x7f0000000140)={{0x7f, 0x45, 0x4c, 0x46, 0x2, 0x1, 0x0, 0x485188d3, 0x5, 0x3, 0x6, 0xa338, 0x2c1, 0x40, 0x12a, 0x1ff, 0x4, 0x38, 0x2, 0x5, 0x1f, 0xe6ef}, [{0x6474e551, 0x2d19, 0x400, 0xb30, 0x4, 0x7, 0x3, 0xfffffffffffffffe}, {0x60000007, 0x9, 0x80, 0x7fff, 0x2072, 0x10001, 0x100000000, 0x1000}], "6925e61bc5e23f6e5371d6bad592cde0d8e8edee2bdc22dae6c89040ee7203dacd5b1f032820147b79574249159adea16ed8196ad070f4cb8aa4848f15dc7b3485", [[], [], [], [], [], [], []]}, 0x7f1) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1037.919441] binder: send failed reply for transaction 1601 to 6488:6490 [ 1037.919473] binder: undelivered TRANSACTION_COMPLETE 19:17:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x4, 0x3c5b, 0x8, 0x0, 0x38, 0x1, 0x5}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={r2, &(0x7f0000000040)="3ec5d28ed9aed7a71575cea78958ae6ca3de4d9f7097a70626acb003b85e7c3ee498d7ce62c4776b01986bcfbb29cd5658b97c93c5c497168952453d5450a092502d27e97c86745a6190e45720ce33fa4c328b9e059c29b3782dc9e972ffe65ba59ff28963d0d3c90dace9f3d222b230e1d554493c0f9640010e4765a0a12c5523b1a54c9834a4d59e8abaf2c613e6b7d3e3a403b8c6759dfd82da567445c0f04ee1ef3b61a0a1fa4100d21509cdf9570f40e7420baedb414322858de104ee9fcb0c4675bccb6dab4c4f5cc9c42a5163cc9c61904b2afef3b0232e438afce27e2749f59a980720217d3e3e", &(0x7f0000000140)="f2c0bc15c689b109", 0x3}, 0x20) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0663b589d1230000"], 0x0, 0x0, 0x0}) [ 1037.919479] binder: undelivered TRANSACTION_ERROR: 29189 [ 1038.196265] binder: 6517:6518 unknown command -1984601338 [ 1038.219423] binder: 6517:6518 ioctl c0306201 200001c0 returned -22 [ 1038.248242] binder: BINDER_SET_CONTEXT_MGR already set [ 1038.259196] binder: 6517:6518 ioctl 40046207 0 returned -16 [ 1038.259277] binder_alloc: 6517: binder_alloc_buf, no vma [ 1038.259295] binder: 6517:6522 transaction failed 29189/-3, size 24-8 line 3255 [ 1038.259542] binder: undelivered TRANSACTION_ERROR: 29189 [ 1038.259589] binder: send failed reply for transaction 1606 to 6517:6518 [ 1038.259622] binder: undelivered TRANSACTION_COMPLETE [ 1038.259628] binder: undelivered TRANSACTION_ERROR: 29189 19:17:57 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_INFO(r2, 0x29, 0x40, 0x0, &(0x7f0000000380)=0x3a6) pipe(&(0x7f0000000bc0)) write(r0, &(0x7f00000001c0), 0x815e8d3) read(r1, &(0x7f0000000200)=""/250, 0xfa) 19:17:57 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f0000000040)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:57 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) splice(r0, &(0x7f0000000040), r0, &(0x7f00000000c0), 0x60e, 0x4) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:57 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet6_mtu(r2, 0x29, 0x17, &(0x7f0000000100)=0x5, 0x4) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) write$P9_RFSYNC(r2, &(0x7f0000000000)={0x7, 0x33, 0x1}, 0x7) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r4, &(0x7f00000001c0), 0x7ba27d3a) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x3) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x40401, 0x118) ioctl$VT_RESIZE(r2, 0x5609, &(0x7f0000000100)={0x2bb3, 0x9cc5, 0x4}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) r3 = dup(r1) ioctl$BLKIOMIN(r3, 0x1278, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) 19:17:57 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x200000, 0x2000424, 0x3) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(r2, &(0x7f00000000c0)=[{&(0x7f0000000140)=""/127, 0x7f}, {&(0x7f0000000040)}], 0x2, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1038.452720] binder: 6530:6532 got transaction to context manager from process owning it [ 1038.476382] binder: 6530:6532 transaction failed 29201/-22, size 24-8 line 3109 [ 1038.489247] binder: 6530:6532 ioctl 1278 20000080 returned -22 [ 1038.497170] binder: 6530:6532 Release 1 refcount change on invalid ref 0 ret -22 [ 1038.508257] binder_alloc: binder_alloc_mmap_handler: 6530 20001000-20004000 already mapped failed -16 [ 1038.518378] binder: BINDER_SET_CONTEXT_MGR already set [ 1038.524352] binder: 6530:6532 ioctl 40046207 0 returned -16 [ 1038.530462] binder_alloc: 6530: binder_alloc_buf, no vma [ 1038.530482] binder: 6530:6543 transaction failed 29189/-3, size 24-8 line 3255 [ 1038.544375] binder: 6530:6547 ioctl 1278 20000080 returned -22 19:17:57 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) setsockopt$inet6_MRT6_DEL_MFC(r1, 0x29, 0xcd, &(0x7f0000000140)={{0xa, 0x4e22, 0x80000000, @local, 0x42}, {0xa, 0x4e20, 0x3ff, @mcast2, 0x4}, 0x1000, [0x7, 0x4, 0x80000000, 0x400, 0x73, 0x1, 0xa9, 0x80000000]}, 0x5c) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) r2 = accept4$inet6(0xffffffffffffff9c, &(0x7f0000000040)={0xa, 0x0, 0x0, @initdev}, &(0x7f00000000c0)=0x1c, 0x80000) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f00000001c0), &(0x7f0000000200)=0x30) 19:17:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = dup(r1) write$cgroup_int(r2, &(0x7f0000000000)=0x5, 0x12) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="85420000000000000000000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) 19:17:57 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000040)=0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000000c0)=0x0) tgkill(r2, r3, 0xc) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1038.556117] binder: undelivered TRANSACTION_ERROR: 29189 [ 1038.570930] binder: undelivered TRANSACTION_ERROR: 29201 19:17:57 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x4, 0x10, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0x7ba27d3a) read(r0, &(0x7f0000000200)=""/250, 0x29e4ba6b) sendto$unix(r1, &(0x7f0000000040)="3103fcc301a3bd7682c40ca755bbacf4bb0bc2bb5de3ca04fde191234096b2fdff83ae28b54783b0336a2e2df773c000f9bc82ee7894b19599e1856f003b0ea2cd9281b20afd54722a55e8b0ecbc4a718c0a5b5473faa601e0e27c2ae125c2bc044de83a0d50d969ffcb37d5b32ecd947997a00e105f9a559d6d55274a7beca09625b2504e2cae31bb40787f522c7c237a4ed4496f0da0a44571bd8190d7b75cff0ab2bb", 0xa4, 0x40800, &(0x7f0000000100)=@file={0x0, './file0\x00'}, 0x6e) ioctl$void(r0, 0x5450) [ 1038.627649] binder: 6551:6555 got transaction with invalid offset (0, min 0 max 24) or object. 19:17:57 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x5) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$LOOP_GET_STATUS(r2, 0x4c03, &(0x7f0000000140)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:57 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x149002, 0x0) ioctl$TIOCGLCKTRMIOS(r2, 0x5456, &(0x7f0000000140)={0x800, 0x4, 0x4edf, 0xf96, 0x11, 0x8, 0x3, 0x29d, 0x1, 0xbe16, 0x0, 0x7}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r0, r1, &(0x7f0000000040)=0x1, 0x4002) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1038.674167] binder: 6551:6555 transaction failed 29201/-22, size 24-8 line 3349 [ 1038.677040] binder: 6551:6559 Release 1 refcount change on invalid ref 0 ret -22 19:17:57 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) ioctl$TUNGETSNDBUF(r0, 0x800454d3, &(0x7f0000000140)) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) splice(r0, &(0x7f0000000040), r0, &(0x7f00000000c0)=0x5a, 0x3f, 0x8) [ 1038.760644] binder_alloc: binder_alloc_mmap_handler: 6551 20001000-20004000 already mapped failed -16 [ 1038.790104] binder: BINDER_SET_CONTEXT_MGR already set [ 1038.795964] binder: 6551:6555 ioctl 40046207 0 returned -16 19:17:57 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x4003}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) accept4(r2, &(0x7f0000000140)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000040)=0x80, 0x80800) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000001c0)={{{@in=@loopback, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@local}}, &(0x7f00000000c0)=0xe8) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x8916, &(0x7f00000002c0)={@remote, 0x18, r4}) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:57 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) sendto(r1, &(0x7f00000001c0)="2fdd4154832d72cf7841c6f59ab91ac1bffce113c4ef3b85828190d1a1", 0x1d, 0x80, &(0x7f0000000200)=@isdn={0x22, 0x7, 0x400, 0x2, 0x9}, 0x80) ioctl$KDGETKEYCODE(r1, 0x4b4c, &(0x7f0000000280)={0x200, 0x5}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r2 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r2, 0x0, 0x2000424, 0x1) write(r2, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r2, r2, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000040)=0x0) ptrace$setregs(0xf, r3, 0x0, &(0x7f0000000140)="234f4fc72d571ac402ed9572d019254be1561bcd06ac49fa2236d319e0bc32d222e6cb11ecd2755155211f3704adfbc7c91254e930bb8aaec784c5d0da1a30452804acaca861a64f39a9b0a15cece53f83b61d4e8c4a65ecf8cdadc3e65acb88cf167a6bb68edd0a3ccbc07c1a8500") [ 1038.811165] binder_alloc: 6551: binder_alloc_buf, no vma [ 1038.811187] binder: 6551:6575 transaction failed 29189/-3, size 24-8 line 3255 [ 1038.819532] binder: undelivered TRANSACTION_ERROR: 29189 [ 1038.819592] binder: undelivered TRANSACTION_ERROR: 29201 19:17:57 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x58b9, 0x7, 0x1000, 0xfffffffffffffeff, 0x0, 0x7fffffff, 0x0, 0xe, 0x3c3858ba, 0x6, 0x3, 0x4, 0xd9, 0x7ff, 0x1f, 0x401, 0x9, 0x0, 0x7fff, 0x7f8d, 0x5, 0x3ff, 0x101, 0x101, 0x2, 0x73, 0x7, 0x1, 0x79, 0x45d7, 0x9, 0x9, 0x9, 0x1ff, 0xa0bf, 0x1, 0x0, 0xfff, 0x4, @perf_bp={&(0x7f0000000000), 0x9}, 0x1000, 0xfffffffffffffeff, 0x2020000000000, 0x9, 0x5, 0x3, 0x2}, 0x0, 0xa, r0, 0xb) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r2) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r4, &(0x7f00000001c0)="7b8ef655c9728a6a547e3e11fe4959d03423cce2230b84bf192581eb184b3578d3adfacf86f858314224cbd91ed3170fd351e9b38528bd791caa850866c40ca26dba91d676adff8f", 0x38) bpf$MAP_CREATE(0x0, &(0x7f0000000240)={0x1b, 0x3, 0x4, 0x9, 0x4, r3, 0x5}, 0x2c) read(r1, &(0x7f0000000780)=""/250, 0xff34) 19:17:57 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fallocate(r1, 0x43, 0x7c, 0x8000) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000040)=0xffffffffffffffff, 0x4) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, &(0x7f00000000c0)=r2) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000140)={0x1, 0x101, 0x5, 0x36d, 0xffff}) 19:17:57 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r2, 0x10e, 0x5, &(0x7f00000001c0)=0x2, 0x4) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000140), 0xffffffffffffff24, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000000)=[@release], 0x0, 0x0, 0x0}) 19:17:57 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = getgid() setgid(r1) r2 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r2, 0x0, 0x2000424, 0x1) write(r2, &(0x7f00000009c0)='/', 0x1) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PPPIOCSPASS(r3, 0x40107447, &(0x7f0000000240)={0x3, &(0x7f0000000200)=[{0x96, 0x6, 0x3ff, 0x5}, {0x7, 0x7f, 0x0, 0xd42}, {0x3, 0x4, 0x2, 0x6}]}) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) write$apparmor_current(r4, &(0x7f00000001c0)=@hat={'changehat ', 0x4, 0x5e, ['/dev/net/tun\x00', ',%:ppp0\x00', '/dev/net/tun\x00']}, 0x3f) sendfile(r2, r2, &(0x7f0000001000), 0xfec) pipe2(&(0x7f0000000280)={0xffffffffffffffff}, 0x4000) ioctl$LOOP_GET_STATUS(r5, 0x4c03, &(0x7f00000002c0)) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000000080)={0x3, 0x0, 0x100, 0xfffffffffffeffff, 0x1, 0x8}) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000040)) fstat(r3, &(0x7f0000000140)) [ 1038.993208] binder: 6593:6597 unknown command 0 [ 1039.003597] binder: 6593:6597 ioctl c0306201 20000100 returned -22 [ 1039.018544] binder: 6593:6597 Release 1 refcount change on invalid ref 0 ret -22 19:17:57 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PPPIOCCONNECT(r2, 0x4004743a, &(0x7f0000000040)) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r3, r1, &(0x7f00000000c0)=0x3, 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1039.038523] binder_alloc: binder_alloc_mmap_handler: 6593 20001000-20004000 already mapped failed -16 [ 1039.073166] binder: BINDER_SET_CONTEXT_MGR already set [ 1039.073241] binder: 6593:6609 unknown command 0 [ 1039.073250] binder: 6593:6609 ioctl c0306201 20000100 returned -22 [ 1039.111088] binder: 6593:6597 ioctl 40046207 0 returned -16 19:17:58 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x100, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r0, 0x0, 0x1000, 0xda, &(0x7f0000000c00)="e68defeb3752575b38b03244a2a266156360b53ae6e47f6ee5697076f32d6a642d13e34f20738f982d207baaa2b2fed0506786fa4f5f821f52bd100c10da4cce9d8e1bf1ba318be1962806d0b6717b028ee729c8fa9823b26d3c85ac63b2c675fc9894ece12d573fa7d3e2ab16c5b6b06c4289fc70c46c3061087ebb34b4f7f7b7518670e3a2b6f3c61b08c2f94c5da2bac22a8e0f99aabe08a5cb9b8cb1b4745a4a1cbdce990874aeb9d905123ae33cf50293fe0d2ab64dd99b5fe68b8f74722904546e9aae5fa6db27420c18d7cc27fe67c77886c3bf1695aaa8a2cf58c7d8700ac0ffc83a702d0899afed91e57aafd728008bef92c635e2a6aac4db065247565f7a61f6d518dcc8222ff2ed1b62b0f87e72d65f468b130a496e340824963eb53fde0d174a7e4aab3cfb2bdeda54d676c49df87632a33c3fc33d8d02a7c3d0a3fd116228bc3df61d749ee6183153408e058cd3b7970147cf11bb6fc0e250b955a84973debbdd8b905c9d53113f300aca83caef56ce5c996ea1178ce6300cf12ac1f07c3279689d335dcc805ef22b79bbc4f9db2c8f9772ff89d765a6c4515b834ce56a24c197aa41b7ce80e21061e7df887813318e9a023130a7519ac4cf7d1d7a7294391ccd84df5a4e69e3df029fc812b4412ae41fecb0367bb507bed8ac097b92a89e4880c3647de5b5f3a8c2c7a4a8e0732e96cfeac4a9a8c04d2b3b181d2c4f4b07dc335d5b94f6f9f08a380d87cfdfcc8d73f8932b9d6c9fff8dbfa722b5ff03ad16a38a1ebc05a71629c17bca728a63c50364ad1a33ba8840a046d7ab9321e7aba8bb8ed47d076561fae40801e8e1711e81cc5fe7555dfa0ad02539ce7df0c4260ff339f802555d1227f7b31a0ae32f585d2ac3f400d291807ba35e1daed2eb62e5678abae94bba3fe4015d59b0bc3fdbb499ba5b446adc5babc1c808d7b5b30db7702d9b06598dd722c7df43ad14e002487304e7c6643132a8855e807475594188ce41d513dcbd1751753bbfa676e358a54c2e8c5e16831edad7b9f04e8397e3e1d8e608b9f975016561926f3309a142480689692f187167a71d1c12c066ae0d360a7ea39eafbbfa3167301bb12b5d75bd290cf9ba7b828865fd6111dc3d797bed19d3bb6daa8476ccb5be0fe92e85c76d2d3835c65fd4ffde0231858a71539e36316d46ca214b6dbb501dffac1f107a71de9d347f41e36bb3423b687c49d846375d948217484b156d801db740534f0ab123fe8367365d81a865acf3f918fa79d6a8d600f02cb06cd4521a23bba6481d0621a74df7774e6202b5a45a6a13e4fb18abb62ff92b820daeeb4fce94aa6c4b0eff403e56761a6f27db1c878c20f39be0d30460851a757062b250e14a63cb289e223ce2eda0c3ee24439ffdb022a95cc143808c58de74754953937de929af277b53d76fdf1ea03a53c0e4df549e2e63daf3484037affb81c88ffca58ad4973da7383bae4bf0497fcaae85aa8e4564794342096647235e628a04c574c61d685e9bd9ca0a3723b1424f79bf39a192ccce473091b51a7b527dc2a6a6d965fea0e96d20f616ee8a6e77a8d46d4a4ff726ecadcf39322b78326ea3c0ca0a4748d64c3ecb8931eeb748d8d514a3d3b6440166ad3c41bb890e4d864323301e7e5cddfede84c20abb786c51b2acfdad44a251f0d894f624555dd849460bb78c3cdc3265c878930c8df4365332e8baccbe58d07b3f48f84294b3884267dbf6266bbc7851c5a4c80533169af114c0cffeb336c6b08f28dc262da8dfa7ef819c50b9f0fe5ef57b9ec4f6343a1f36125c6a329c376797a8eeddc96df5c201320491f435a177d7deda0fa469e2a306260f701ae416200be80e4e8b08079bf4066e2b21719e0ac571cf677ccb41393944f413f75e01493681e18404ad2516a4e2e8f34342d415d4d19ac1cd8ce3f99adfb86740130bd6f4ebc394c5a9859fdfd8ef1e76ac6de416b9c8f4adad01976b05d2a748c1c3c4651286f6db732e158e94238c013c0b6f93e572071a5d0e2b8975a8bb90d1fb142f4bca8d2b06e627a1d0abaacd551cc3ce76c8756638c88b8c817333d5152269c35cfbaa55d80aa3d4509ffb200e63829e3dcc5f78f13530a713cfef3e65354ff99ca4b831e4836f432ee38ba4fc53ccd23776d49d7c0ae25c93dc07639deb1709acab98ef7941e80b85e0f0149fe84566d8e74553e4dd1d9e1dba90b2e7d1814bdb3e5f291ad9455656085ad4e50cb44248cbfcef4ef72bdf94031e4ecacd604d45fe2746f1408b8dccc1dd3da6857c9d0ef1c1a3a4e778d688c13d9172a5ae081d11d171c80dab899684433cd751b30f309a0f840f294f4d64837d64da26b0261f2010170c0f8c9c317998c4b01f5e9d301dbe198cb67e8e4dcdc51ece0a539f259b8d826cdbd0d22f4e0db930ba69342662b917997e8ffb0e1bfba2f341c99308a9f4ee98a66c4c578cbb7bac6161354c8eea629db1dfb87724563f227411bedff9556dc6787953d8314d4c1c6414d3bca65f319d35351b41dc282df6ed2c61c85ccb3175c550ed132019e49603b3909cb8388c25cc74d0c5529f49e51b278e5e1a7bf8dc2644f89444254c2a38972613e07176c40ced062655bb909a969cdc1f6ef8a4cef6e6ad7be4bc0f4c28c3dcec0af45c8011779ee937f47a740d1d258cecbb2f9967e8aada1ab57332e97c8de22cb63b536c14d298079e2752f75d9b1e7f26178cab1e56bc90a4ef03e4eb22f5869ddc594648d0904570f6c6fa55e07fb4216b3ea25a6077401108f3e3df243ae66819656675af8a978e21c506af54f8ba28639d395d67eb2d91a80fd758825cfc57a1ef3012721ffed57c3f70c774bc436a5d91b23f73dc0426934a9107f731e613b37cf201eefb93c21e4730945f9e4ad16617c5d606c7eca97d49babca32a3ec204fa0151d26147f52e0700c7108b470d1096c9a0c570c073adad67ba655abe936d2e0cce58c784838b82793233cacc1156f934501ceab1fab7e46669d352f40b75aeb0537a8983485afa64316f8785fa6d9e691cfd7eda4c9362ba74f50dd1409f0cb60606646bcc9d44b43458cb4255d11498c36bdaf2db8433063aa5661a6e740fb88ab259dbde6fbc633231211dcd8f1ce5d315916e82177b429864d14057c652b679e222b5d183ada2ebfd360c57312711ef0c34cdd366727816dfef073f388ced87c2eb69926ccec0fd77a36d1464b17bcc44ecb7c2859b9e0ef7917a5cf7130f418c41a122f49e9e312d92be69808e4dc4313d094df2d9b165bac257616be4a6c1e521c28e9cbf124dc44d1e2c5aaa674ea85f1cc2a28f6835149f76a9abc1768118eac7009521be269a5eaf2b59e5a760a68a15d09fef964defd92afdaf8b2f5092f812def0a510c7312f1e26813aff9e679aa267df5daef4cd28c0111f3a133ae24f1d2331af8a48d30f89ca1cc651af9a4a8ab7f7d5dbda48393db81ade029ee9c09583751ad0e35a135fbf3c6bf665069716ea2b97803f1e3b15794ea09483bc4d85e9f725986824508d6ff02e3b6154fdd828046d2a2fce29ec47aa9e3be38813d2f5255ed014355e151fcbe3ab4343528f589650b9e3f3fe40496eaafa4b5d895cae8980f17f8dacb3e59b9a6e6fb8cc53a916d77ec26b13fbd7cfe603fd4ec8cc2a12f988055e75eabbffa4420eac13b26a9e741795a9c1a4bf1b8bbdda6da73499021357ddf15709d33a5d01ea5d1c105a4a2629b657817262a84be7965c3a4c3318d084f6eb39ab9014756235177ea29028ab61b4f16ff22220838cd2ffae90d16edf25bf801436d1a8e8dbd9aba3c2cbd09969efa291a2f6f92894a9771ece153971080ea4144b94b24e2e1f889bba4d67db84a4364e1fd46eedbe70ef89e070e58fc9efc7a4358318b7bd91029699194cb1998e76f6902c7ca73441c5c0c9756cb8a283fb107fbe5b4361a7be7bee57292c99767a4fcc8a2f836e5d9d1e30fe15fa83eb0410cbcf65547d0fddcb0c742acc185650ce047a38521450926d9ed757b8c37bf8776a2dfee1d610311c9c329d8a0f67f566b42248ec2c04f916a61e395e728f3816d50871975701c6256aba35a0214e6e6bb400e74a9f8d2bfe3e04f9e958564815eaf2f1f50f18d365873e0dc9363eb8439b1675bb364856da0c3f503af925010f9c4dcd88d135311c713260d714395ef6bee1931e6af3c372a358ec8fc0034e52bdfcdca1893b348cef6e05d0bef7e8cf11fa1fe19ec0179b7aabf278a3b5d45474a00f6d8b250b91f1bfce9384971787b555bd2bf1a0e120bacbc8d6fa6d9dffc0acf3cd56cf8c4f77c14a4792eabc39c9999c5ee24a6754fe6471f90ff389da0f08f525e974f4b3085c969539a2271a8a1970fad73a5c63b50399c3343da6dd3ef4a873b3684e6a95a24482e791a4e5be15cb3ac55e230311c1916e9e44c50b868006f3306f56896e3c6ff342658d786044b36be2b48b23d4f33a271faefb22514f9b55ba575a7fa855dc77abc36a44edbad9f5f25ee19f90993796cf95b3a3fe9abbb7c9e35b0945aab367cfa2e7a6cfb7d88a623fdc66b67345b8b4069068c9f93f9409c70fd3cdee7e16451784c0b56547c437e57580c0073e89c6a930936026708116b63eba2ba256542d9425c67795249b408bd49b625f9ef35304ac4e585e3e98059c43a3eb8a6432c69cfe40f6bad58777cdee5a65b132525637fe07cd7be8ca7d6be621a26640f59d4641a9af7df6b395d8fed424eeec5f8401465d9da2d12d8bd9d1f67c01b53351aa33360aba9cddb5782818df025ae605e3a124a31a592ce183da125a3aee2ae419949195b5047450cd8e87888436f3de47755948c598307ac0809797febf537d707cff9c89a1afa64cc5f856ff0d9ff2a43bd472ec9cb005237a7dd22e2447fdc4fb68c64687e7bbc3f901277e0925f607b9bcae404f2f8c29644621eb14670623714568b143de2235c54ed8c6d7d76d8e2d6fb2a65a56dd0a4afcbfcdd075c77feccca9d5e1a6c96c904af97bdc4f792ea4c113441df5d171a745cec337b32db1fa6a30ec7da88bc80fe6fbd819243514efbb3cd35b5ec3ab5addc86a81f04a3e061002ec5c868b950660cd94dfe3ab729ab54abeeb82d9a16aef94f28170f69c89fcb35bcec3cd6cfa8bc145d7b0a0efaaf4e3fd88f2ac42c8a0d92a49edd0c11c6abe40793b7748d7d877cc34fe1d6ef3a49a8bdaede9458097e31e19709505620073b8c0706bd723359b31c1f490234ebbf445fc5517f4b65b9b9a81f5319789faea3d26610e29278c3f639cc28cc3d081e8cd3ab757124c683e97714b8a8480190161ab32e4174c38395b1234150245c3940307fd367cb46ea3b43d839ad7d21a2a8c9b4db4bfaadb96f6639f0a7b22eb66658dab8a2575d6f5ace3acf260d47479ebcf8034add85db8147bebb9be19c4646f8086709b9cdcd47aee5e3cbad5a42083989243392c1ae407f4489a7bd16737726e723cc94f320223e80c78d138114b6e5a2b0dad3ccd4f32e6d574a2ebe25af1f4d3601110e51626789e4c9f2fa0aeb98500c09a9d2e520b7c9f24cfc8eae5a60af6a65d6a793fb7c2d2445e17a321913f70c6e71aa485cf7e9e71dc6300a244e64b4a3ccea0375165139ec45a59759022b2ce400c965df68186d8d2bb2d14446907e5e93c82c72e8d81dc20556536ec428a85e699d4ec758a509300ddc9df9a9226f264aee337f9af90a49201e24c36b2ad49fb750a6db1543027d6ab4406c63ca1712f3c7c09ba3e616405e3e932ee4d496e84279d54", &(0x7f0000000040)=""/218}, 0x28) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0x7ba27d3a) read(r1, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:58 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r3, &(0x7f00000001c0), 0x7ba27d3a) read(r2, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:58 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x81) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x8, 0x11, r2, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:58 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r2 = dup3(r1, r1, 0x80000) ioctl$RTC_UIE_OFF(r2, 0x7004) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) r4 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) write$P9_RVERSION(r4, &(0x7f00000000c0)={0x15, 0x65, 0xffff, 0x0, 0x8, '9P2000.L'}, 0x15) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r3) 19:17:58 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r2 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000040)='/dev/keychord\x00', 0x2000, 0x0) ioctl$RTC_ALM_SET(r2, 0x40247007, &(0x7f00000000c0)={0x3b, 0x27, 0x14, 0x4, 0xa, 0x3, 0x3, 0x106, 0xffffffffffffffff}) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r3, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x92000, 0x0) write$P9_RSTATFS(r2, &(0x7f0000005240)={0x43, 0x9, 0x1, {0x7fff, 0x2, 0x100, 0x0, 0x3, 0x8, 0x1000, 0x7fffffff, 0x38000000}}, 0x43) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) clock_gettime(0x0, &(0x7f0000007e40)={0x0, 0x0}) recvmmsg(0xffffffffffffffff, &(0x7f0000007cc0)=[{{&(0x7f0000000100)=@sco, 0x80, &(0x7f0000000180)=[{&(0x7f0000000380)=""/156, 0x9c}, {&(0x7f0000000280)=""/72, 0x48}, {&(0x7f0000000540)=""/248, 0xf8}, {&(0x7f0000000480)=""/109, 0x6d}], 0x4, &(0x7f0000000640)=""/132, 0x84}, 0x7fff}, {{&(0x7f0000000700)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, 0x80, &(0x7f00000039c0)=[{&(0x7f0000000780)=""/4, 0x4}, {&(0x7f00000007c0)=""/229, 0xe5}, {&(0x7f0000000040)=""/40, 0x28}, {&(0x7f0000000900)=""/4096, 0x1000}, {&(0x7f0000001900)=""/4096, 0x1000}, {&(0x7f0000002900)=""/4096, 0x1000}, {&(0x7f0000003900)=""/191, 0xbf}], 0x7, &(0x7f0000003a40)=""/54, 0x36}, 0xc}, {{&(0x7f0000003a80)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000004fc0)=[{&(0x7f0000003b00)=""/78, 0x4e}, {&(0x7f0000003b80)=""/152, 0x98}, {&(0x7f0000003c40)=""/38, 0x26}, {&(0x7f0000003c80)=""/90, 0x5a}, {&(0x7f0000003d00)=""/216, 0xd8}, {&(0x7f0000003e00)=""/131, 0x83}, {&(0x7f0000003ec0)=""/83, 0x53}, {&(0x7f0000003f40)=""/4096, 0x1000}, {&(0x7f0000004f40)=""/122, 0x7a}], 0x9, &(0x7f0000005080)=""/146, 0x92}, 0x7fff}, {{&(0x7f0000005140)=@caif=@dgm, 0x80, &(0x7f00000052c0)=[{&(0x7f00000051c0)=""/117, 0x75}, {&(0x7f0000005240)}, {&(0x7f0000005280)}], 0x3, &(0x7f0000005300)=""/241, 0xf1}, 0x5}, {{0x0, 0x0, &(0x7f00000068c0)=[{&(0x7f0000005400)=""/193, 0xc1}, {&(0x7f0000005500)=""/4, 0x4}, {&(0x7f0000005540)=""/215, 0xd7}, {&(0x7f0000005640)=""/162, 0xa2}, {&(0x7f0000005700)=""/238, 0xee}, {&(0x7f0000005800)=""/170, 0xaa}, {&(0x7f00000058c0)=""/4096, 0x1000}], 0x30f, &(0x7f0000006940)=""/31, 0x1f}, 0x200}, {{&(0x7f0000006980)=@x25={0x9, @remote}, 0x80, &(0x7f0000007c40)=[{&(0x7f0000006a00)=""/247, 0xf7}, {&(0x7f0000006b00)=""/34, 0x22}, {&(0x7f0000006b40)=""/142, 0x8e}, {&(0x7f0000006c00)=""/36, 0x24}, {&(0x7f0000006c40)=""/4096, 0x1000}], 0x5}, 0x8}], 0x6, 0x20, &(0x7f0000007e80)={r4, r5+30000000}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000007ec0)={'hsr0\x00', r6}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000007f00)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="0000000000000000f2b51510dfdea6b1cc25b8a90434c3e958b5e10f805b7a41ed68b5f20f38f65c72caa4799fb9fd608743e22fd152e55bdb762ac7dde234ab62f544d8e582d03cd7c35d339ad69664a75bcc4e58a9001e81c91d3be009f815f255c75d3d56eb9fe519e5b6682bf8bd32a0673fa70c69c0fcfcc04b79ae2ba3cddb9d6b3eb5e22e55183ddb1cc8601cd3e44bc195e64aac6ccb0778416e99484eb0cca5bfa36b002baf32ddcdc1976c73978bfd5592a65dd82e610047d9"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) 19:17:58 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = dup2(r0, r2) setsockopt$inet_int(r3, 0x0, 0xb, &(0x7f0000000040)=0x7dfbedef, 0x4) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:58 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) r2 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x501001, 0x1) ioctl$EVIOCSCLOCKID(r2, 0x400445a0, &(0x7f00000000c0)=0xfffffffffffffff8) [ 1039.447804] binder: 6632:6634 Release 1 refcount change on invalid ref 0 ret -22 [ 1039.474822] binder_alloc: binder_alloc_mmap_handler: 6632 20001000-20004000 already mapped failed -16 19:17:58 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f00000001c0)={0x96a, 0xa1d, 0x0, 0xffffffff00000001, 0x1, [{0x100000000, 0x4, 0xfffffffffffff374}]}) r2 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) write$binfmt_elf64(r2, &(0x7f0000004000)=ANY=[@ANYRESHEX], 0x12) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) socket$packet(0x11, 0x0, 0x300) r3 = openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendfile(r2, r2, &(0x7f00000001c0), 0xa198) syz_genetlink_get_family_id$tipc(0x0) ioctl$PPPIOCATTCHAN(r2, 0x40047438, &(0x7f0000000000)=0x3) perf_event_open(0x0, 0x0, 0xb, 0xffffffffffffff9c, 0x0) openat$selinux_user(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/user\x00', 0x2, 0x0) sendfile(r3, 0xffffffffffffffff, 0x0, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r2, 0x6611) clock_adjtime(0x0, 0x0) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) write(r0, &(0x7f00000009c0)='/', 0x1) openat$cgroup_ro(r1, &(0x7f0000000040)='cgroup.controllers\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000000180)=0x20000000000000, 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:58 executing program 5: r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000140)=0xc) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$FS_IOC_FSGETXATTR(r1, 0x801c581f, &(0x7f0000000040)={0x77, 0x9, 0x5, 0x5e, 0x9}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r2 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r2, 0x0, 0x6, 0x80000000000001) write(r2, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_GET_DUMPABLE(0x3) ioctl$UI_SET_PROPBIT(r0, 0x4004556e, 0x1e) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffff9c, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) sendfile(r2, r1, &(0x7f0000000300), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) r4 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/checkreqprot\x00', 0x2, 0x0) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200)='TIPC\x00') sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x220}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x34, r5, 0x8, 0x70bd25, 0x25dfdbff, {{}, 0x0, 0x4101, 0x0, {0x18, 0x17, {0x1b, 0x2, @udp='udp:syz2\x00'}}}, [""]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x804) ioctl$TUNSETSTEERINGEBPF(r1, 0x400454d1, &(0x7f0000000080)) [ 1039.505498] binder: BINDER_SET_CONTEXT_MGR already set [ 1039.511756] binder: 6632:6649 ioctl 40046207 0 returned -16 [ 1039.518087] binder_alloc: 6632: binder_alloc_buf, no vma 19:17:58 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1039.518109] binder: 6632:6656 transaction failed 29189/-3, size 24-8 line 3255 [ 1039.518216] binder: 6632:6634 Release 1 refcount change on invalid ref 0 ret -22 [ 1039.518472] binder: undelivered TRANSACTION_ERROR: 29189 19:17:58 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ID(r2, 0x80082407, &(0x7f0000000140)) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) r3 = creat(&(0x7f0000000040)='./file0\x00', 0x8) ioctl$sock_inet6_tcp_SIOCATMARK(r3, 0x8905, &(0x7f00000000c0)) [ 1039.518518] binder: send failed reply for transaction 1618 to 6632:6634 [ 1039.518551] binder: undelivered TRANSACTION_COMPLETE [ 1039.518558] binder: undelivered TRANSACTION_ERROR: 29189 19:17:58 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) write$tun(r1, &(0x7f0000000140)={@void, @void, @eth={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [{[{0x9100, 0x3, 0xfff}], {0x8100, 0x9, 0x2, 0x1}}], {@ipv6={0x86dd, {0x4, 0x6, "866a09", 0x387, 0x2f, 0x7f000000000, @mcast2, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, {[@routing={0x6, 0xc, 0x1, 0x3ff, 0x0, [@dev={0xfe, 0x80, [], 0x13}, @loopback, @ipv4={[], [], @local}, @initdev={0xfe, 0x88, [], 0x1, 0x0}, @mcast2, @initdev={0xfe, 0x88, [], 0x1, 0x0}]}, @fragment={0x2f, 0x0, 0x7ff, 0x81, 0x0, 0x100000001, 0x67}, @hopopts={0x6c, 0x0, [], [@pad1]}, @srh={0x2b, 0xa, 0x4, 0x5, 0x81, 0x30, 0x6, [@dev={0xfe, 0x80, [], 0xf}, @remote, @mcast2, @empty, @mcast2]}, @fragment={0x2b, 0x0, 0x0, 0x2, 0x0, 0x2, 0x66}, @routing={0x3b, 0xa, 0x0, 0x90, 0x0, [@dev={0xfe, 0x80, [], 0x27}, @rand_addr="cbbb7e263aeec197f261c1b6d167070c", @empty, @ipv4={[], [], @local}, @mcast1]}], @icmpv6=@ndisc_ra={0x86, 0x0, 0x0, 0x7f, 0x3ad, 0x0, 0xffffffffffffffff, 0x8, [{0x3b, 0x12, "4c1f3eef6172cb87a877cfc854e87aaf5d22450ba627828cc4509321132cfec209e3cd1da6981e463fec68973fdd5475af570456eddc8dba338407a5892a62ecf2906a5d89c7f1b070c2d4cf3b149b0308339cb9ad0a5bda6a612a753f02ee1ffd53349b82525f0ed27a28806040fe1b67a6c6e5f312a4ab3d8e12b32a099b64cc81c8e11a93e29fa48f513608122fccceb6712fe8"}, {0x1f, 0x1e, "924d60cad506168f82971d854a5f9ddf16a48de60d4899642dc741a33737f94580f06eb8977780b197fe84fdd8acbc148f234f4fb938bdf42c2e513be0dc54cac3b104c807709829f8378b51649777b218e88589a872062c61bb0d2b22300ec12ddd5ccf3433f87fa1544988a62b66c8c8c3c66afdea2f3e441e004ad888905ec872a00f0bd2bf3134c9cd34b6eb652aa6263ba3f7ed82b9999eda4c7a41bdb512c5ba6ba3a8eb7a735c9a182afac5b690943c71f578ff2f0b744f7625000ef16471ceea8c71a2035387614aa78ce1d055ebc99342d4e79fe88711369cabd61386e9a677c65aa4770a8c541cbdb365f0a828"}, {0xe, 0x16, "f33dc5721e4472b9fb1c43fd58f618fc2f00e70f1d565415f1743694c4b1f464cc51676149c558bcd409d023fc95f657117b4bddb0516728f642d87e8e41222dbcca358b987f53bb8bd0ee16157a9ee526d190f29400d44bec99495696c1a46d1f15f6acd5e57b0a371d7f012c5baf0d62d8e2c19bbf79b7740b6e7dc346ba2d14bc41ca15442552a1b68a5ab8ccbfa100a54b2a75b3e308239fb35c74d10d6ae4223ee9ffabc002624bed269d678ac930aa"}]}}}}}}}, 0x3c5) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:58 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000100)={0x5, 0xfffffffffffffffd}, 0x8) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @rand_addr=0x7fffffff}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000013, &(0x7f0000000180), 0x4) close(r0) 19:17:58 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) memfd_create(&(0x7f0000000040)='userposix_acl_access\x00', 0x3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f00000000c0)) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x4, 0x100000000011, r1, 0x1) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/policy\x00', 0x0, 0x0) ioctl$EVIOCGUNIQ(r2, 0x80404508, &(0x7f0000000180)=""/161) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:58 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(r2, 0x29, 0x40, 0x0, &(0x7f0000000380)=0xfd79) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r4, &(0x7f00000001c0), 0x7ba27d3a) ioctl$LOOP_CLR_FD(r3, 0x4c01) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="040200a290cf3682"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) [ 1040.110211] binder: 6688:6691 Release 1 refcount change on invalid ref 0 ret -22 [ 1040.141602] binder_alloc: binder_alloc_mmap_handler: 6688 20001000-20004000 already mapped failed -16 19:17:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) r1 = accept4(0xffffffffffffffff, &(0x7f0000000140)=@ax25={{0x3, @bcast}, [@rose, @netrom, @netrom, @bcast, @null, @default, @rose, @rose]}, &(0x7f00000000c0)=0x80, 0x80000) r2 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x6, 0x0) accept4(r1, &(0x7f0000000380)=@x25, &(0x7f0000000400)=0x80, 0x80800) r3 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ppoll(&(0x7f0000000240)=[{r0, 0x660}, {r1, 0x1200}, {r2, 0x40}, {r3, 0x8028}], 0x4, &(0x7f0000000280), &(0x7f00000002c0)={0x100000000}, 0x8) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r5 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r5, 0x0, 0x2000424, 0x1) write(r4, &(0x7f0000000580)="6f2e4906e69cfb50d47e33", 0x612) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r5, r5, &(0x7f0000001000), 0xfec) r6 = fcntl$dupfd(r2, 0x406, r3) r7 = getpid() write$cgroup_pid(r6, &(0x7f0000000340)=r7, 0x12) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r5, 0x0) fcntl$getownex(r1, 0x10, &(0x7f0000000300)) ioctl$TUNSETSTEERINGEBPF(r4, 0x400454d1, &(0x7f0000000080)) [ 1040.163032] binder: BINDER_SET_CONTEXT_MGR already set [ 1040.168542] binder: 6688:6691 ioctl 40046207 0 returned -16 [ 1040.173814] binder_alloc: 6688: binder_alloc_buf, no vma [ 1040.173981] binder: 6688:6695 transaction failed 29189/-3, size 24-8 line 3255 [ 1040.174253] binder: undelivered TRANSACTION_ERROR: 29189 19:17:59 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x8000000003, 0x2000424, 0x9) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:59 executing program 2: lgetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@random={'osx.', '/dev/binder#\x00'}, &(0x7f0000000080)=""/229, 0xe5) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) [ 1040.174301] binder: send failed reply for transaction 1623 to 6688:6691 [ 1040.174376] binder: undelivered TRANSACTION_COMPLETE [ 1040.174384] binder: undelivered TRANSACTION_ERROR: 29189 19:17:59 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) write(r0, &(0x7f0000000140)="25839888c394733ddfb636334e5b69873d284081f0bf8aa8d76d33bf1c83fe725836c5b5ba99d7633a688908032a98e5b3d7652a6a1b11ec5f53054a9100683f02b6867a127fc189af6fa648d36b7e7b7de4dde978a6b760879ba946b12dbeb2c1a6977269dc69c73037b9b4b70b43c3c1a33a2cd21ea7925d711d91f68ddcddcf82e018496f519ba177254b9299dde9f7c83f34a32ca6be82c9cec6060f44d2c6732b661c7b7a06ae9e46e51821cad3a9f2c2b2e7f83cb279cbb8dca5e4bba10be79d42bb15dd62cc74e6d45dbcdca12e7545e1a4711663d45519bcb8feaf2a", 0xe0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:59 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000180)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@mcast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f0000000080)=ANY=[@ANYBLOB="e0000002000000000000000006000000"], 0x1) [ 1040.290629] binder: 6711:6712 Release 1 refcount change on invalid ref 0 ret -22 [ 1040.311359] binder_alloc: binder_alloc_mmap_handler: 6711 20001000-20004000 already mapped failed -16 [ 1040.327697] binder: BINDER_SET_CONTEXT_MGR already set 19:17:59 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x6) fallocate(r1, 0x0, 0x2000424, 0x1) ppoll(&(0x7f00000001c0)=[{r0, 0x223}, {r1, 0x8000}], 0x2, &(0x7f0000000200)={0x77359400}, &(0x7f0000000240)={0x8}, 0x8) write(r1, &(0x7f00000009c0)='/', 0x1) bpf$OBJ_GET_PROG(0x7, &(0x7f00000000c0)={&(0x7f0000000040)='\x00', 0x0, 0x8}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vga_arbiter\x00', 0x2, 0x0) write$FUSE_NOTIFY_STORE(r2, &(0x7f0000000180)={0x2b, 0x4, 0x0, {0x4, 0x3, 0x3, 0x0, [0x0, 0x0, 0x0]}}, 0x2b) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:59 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000040)=0x6) [ 1040.327708] binder: 6711:6713 ioctl 40046207 0 returned -16 [ 1040.327839] binder_alloc: 6711: binder_alloc_buf, no vma [ 1040.327857] binder: 6711:6713 transaction failed 29189/-3, size 24-8 line 3255 19:17:59 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) io_setup(0x75, &(0x7f0000000040)=0x0) r3 = eventfd(0x1) r4 = eventfd(0x0) r5 = openat(0xffffffffffffffff, &(0x7f00000003c0)='./file0\x00', 0x0, 0x0) r6 = open(&(0x7f0000000480)='./file0\x00', 0x900, 0x8) io_submit(r2, 0x5, &(0x7f0000000500)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x4, r1, &(0x7f0000000140)="e15cdb19d27c04364dccabc7e0240e716d553315d852e645245b48c1bf80b7ab3c65be6e3316ffd172758479e8150255cedc81f29dddec9e61c1304eb6958cf547514e0800041bb21d837f73028c774a6726e3209cf8d9f35a8155d0a638e7798c113bb6cf1d3c3824b0c349b329d651211d87fb6e4d91fce8dee75d9767eaa5b259ff131f4035954a4ff41dc8f9f0d204be5564c8647eb9b76dfedae3d5a5b4eb719ae9ee21ec5249614d0ad346ecebf35beefff611caa6b08becd9b239f00c2d7bbc54c55ffe53aba90b7aff3af999f61d0bb762481f3bbe9ca4d942876480", 0xe0, 0x1, 0x0, 0x0, r3}, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2, 0xfffffffffffffff8, r1, &(0x7f0000000240)="68c981d746a1e1935e92ec3dc3d3553d9c63183cab0c75e1e452ffed04bbd2fe61ef79567132eba3a4fd119b594ecdc5931747d9ad1a776d801808bdd42443c2fbe832f2ce131985992edc18257d0ae6c246e0bb51e66cdee8fb40b4b7cb57e56dc97465", 0x64, 0x401, 0x0, 0x1, r4}, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x3, 0xffff, r1, &(0x7f0000000300)="c4d8c09cceb0dcde1dbb729946ddcebc7d650cc44f002800689bbc8ca57c3c", 0x1f, 0x702f, 0x0, 0x1, 0xffffffffffffff9c}, &(0x7f0000000400)={0x0, 0x0, 0x0, 0xf, 0xfffffffffffffffd, r0, &(0x7f0000000380)="76eb0def67d6239f3e43e864f60238cd9a49b276e511ee02c5ace9ab09fb8fe733771f02", 0x24, 0x1, 0x0, 0x0, r5}, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0xd, 0x2, r0, &(0x7f0000000440), 0x0, 0xffffffff, 0x0, 0x0, r6}]) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:17:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8040, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_PEER_REMOVE(r2, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f00000006c0)={0x184, r3, 0x4, 0x70bd25, 0x25dfdbfc, {}, [@TIPC_NLA_NODE={0x28, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x800}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MEDIA={0x88, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4dc}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_PRIO={0x8}]}]}, @TIPC_NLA_NODE={0x24, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x97}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2be7}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x26b3}]}, @TIPC_NLA_BEARER={0x68, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'ib', 0x3a, 'batadv0\x00'}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80000001}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xc61a}]}]}, @TIPC_NLA_NODE={0x28, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xbb7e}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xe0}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x8000}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x400}]}]}, 0x184}, 0x1, 0x0, 0x0, 0x4000000}, 0x40) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) prctl$PR_GET_CHILD_SUBREAPER(0x25) getsockopt$SO_COOKIE(r2, 0x1, 0x39, &(0x7f0000000140), &(0x7f0000000180)=0x8) [ 1040.442001] binder: 6711:6727 Release 1 refcount change on invalid ref 0 ret -22 [ 1040.472909] binder: undelivered TRANSACTION_ERROR: 29189 [ 1040.478932] binder: send failed reply for transaction 1628 to 6711:6712 [ 1040.526484] binder: undelivered TRANSACTION_COMPLETE 19:17:59 executing program 3: mknod$loop(0x0, 0x0, 0xffffffffffffffff) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001540)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') preadv(r0, &(0x7f00000017c0), 0x1d0, 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) [ 1040.555819] binder: undelivered TRANSACTION_ERROR: 29189 [ 1040.569168] binder: 6736:6738 Release 1 refcount change on invalid ref 0 ret -22 19:17:59 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) fchdir(r2) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r3, &(0x7f00000001c0), 0x7ba27d3a) read(r2, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:17:59 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000000240)=0xfff, 0x4) sendto$inet(r0, 0x0, 0x0, 0x20000806, &(0x7f0000001180)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='sit0\x00', 0x10) sendto$inet(r0, &(0x7f00000003c0), 0xed5f0dd4, 0x0, 0x0, 0x184) 19:17:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) r2 = dup(r1) getsockopt$inet_mreq(r2, 0x0, 0x20, &(0x7f0000000000)={@local, @loopback}, &(0x7f0000000040)=0x8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) [ 1040.571693] binder_alloc: binder_alloc_mmap_handler: 6736 20001000-20004000 already mapped failed -16 [ 1040.571778] binder: BINDER_SET_CONTEXT_MGR already set [ 1040.571797] binder: 6736:6738 ioctl 40046207 0 returned -16 [ 1040.571845] binder_alloc: 6736: binder_alloc_buf, no vma [ 1040.571866] binder: 6736:6743 transaction failed 29189/-3, size 24-8 line 3255 [ 1040.613239] binder: 6736:6743 Release 1 refcount change on invalid ref 0 ret -22 [ 1040.652740] binder: BINDER_SET_CONTEXT_MGR already set [ 1040.652749] binder: 6750:6753 ioctl 40046207 0 returned -16 [ 1040.652957] binder_alloc: 6736: binder_alloc_buf, no vma [ 1040.652974] binder: 6750:6753 transaction failed 29189/-3, size 24-8 line 3255 [ 1040.653191] binder: 6750:6753 Release 1 refcount change on invalid ref 0 ret -22 [ 1040.665676] binder_alloc: binder_alloc_mmap_handler: 6750 20001000-20004000 already mapped failed -16 [ 1040.665787] binder: BINDER_SET_CONTEXT_MGR already set 19:17:59 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r2, &(0x7f0000000140), 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) prctl$PR_SET_FPEMU(0xa, 0x1) 19:17:59 executing program 2: timer_create(0x5, &(0x7f0000000000)={0x0, 0x41, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000040)=0x0) timer_delete(r0) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) [ 1040.665795] binder: 6750:6753 ioctl 40046207 0 returned -16 [ 1040.666918] binder_alloc: 6736: binder_alloc_buf, no vma [ 1040.666934] binder: 6750:6755 transaction failed 29189/-3, size 24-8 line 3255 [ 1040.855949] binder: undelivered TRANSACTION_ERROR: 29189 [ 1040.862305] binder: undelivered TRANSACTION_ERROR: 29189 [ 1040.868062] binder: undelivered TRANSACTION_ERROR: 29189 [ 1040.873720] binder: release 6736:6738 transaction 1633 out, still active [ 1040.880657] binder: unexpected work type, 4, not freed [ 1040.888367] binder: undelivered TRANSACTION_COMPLETE [ 1040.895164] binder: BINDER_SET_CONTEXT_MGR already set [ 1040.895173] binder: 6763:6764 ioctl 40046207 0 returned -16 [ 1040.895271] binder_alloc: 6736: binder_alloc_buf, no vma [ 1040.895291] binder: 6763:6764 transaction failed 29189/-3, size 24-8 line 3255 19:17:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$ASHMEM_SET_PROT_MASK(r2, 0x40087705, &(0x7f0000000480)={0x52, 0x1df}) r3 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8, 0x10, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x50, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="07630440000000000c6300000f630c4000afd80f9ef4000000030000000d63000000000000000000a3b56572af00bf58318af3736ff6101c7442314f7efb3fa319222f11e3d0f3985336b7503480bdd21d9862c2", @ANYRES64=r3, @ANYBLOB="02000000000000001063084002000000000000000b630000"], 0x30, 0x0, &(0x7f0000000080)="c9c521845bd84de74c23256f026e862bb7afffadd571f6a2ec77533ec94f74a40b17afcf07afbac775c9cd883583db25"}) r4 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) ioctl$KDDISABIO(r4, 0x4b37) ioctl$ASHMEM_GET_PIN_STATUS(r4, 0x7709, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) r5 = syz_genetlink_get_family_id$fou(&(0x7f0000000180)='fou\x00') sendmsg$FOU_CMD_DEL(r4, &(0x7f0000000380)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, r5, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@FOU_ATTR_PORT={0x8, 0x1, 0x4e24}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008801}, 0x4000000) [ 1040.895375] binder: 6763:6764 Release 1 refcount change on invalid ref 0 ret -22 [ 1040.917997] binder_alloc: binder_alloc_mmap_handler: 6763 20001000-20004000 already mapped failed -16 [ 1040.918467] binder_alloc: 6736: binder_alloc_buf, no vma [ 1040.918485] binder: 6763:6766 transaction failed 29189/-3, size 24-8 line 3255 [ 1040.918612] binder: BINDER_SET_CONTEXT_MGR already set [ 1040.918621] binder: 6763:6764 ioctl 40046207 0 returned -16 [ 1040.977383] binder: undelivered TRANSACTION_ERROR: 29189 [ 1040.983016] binder: undelivered TRANSACTION_ERROR: 29189 19:17:59 executing program 3: mknod$loop(0x0, 0x0, 0xffffffffffffffff) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001540)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') preadv(r0, &(0x7f00000017c0), 0x1d0, 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) [ 1040.988858] binder: send failed reply for transaction 1633, target dead [ 1041.002124] binder: 6771:6772 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 1041.014623] binder: 6771:6772 BC_CLEAR_DEATH_NOTIFICATION invalid ref 265858816 [ 1041.024986] binder: 6771:6772 unknown command 6491392 [ 1041.031711] binder: 6771:6772 ioctl c0306201 200000c0 returned -22 [ 1041.053239] binder: 6771:6772 Release 1 refcount change on invalid ref 0 ret -22 [ 1041.088916] binder_alloc: binder_alloc_mmap_handler: 6771 20001000-20004000 already mapped failed -16 [ 1041.103983] binder: BINDER_SET_CONTEXT_MGR already set [ 1041.109442] binder: 6771:6772 ioctl 40046207 0 returned -16 [ 1041.113807] binder_alloc: 6771: binder_alloc_buf, no vma [ 1041.113826] binder: 6771:6778 transaction failed 29189/-3, size 24-8 line 3255 [ 1041.129570] binder: 6771:6780 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 1041.129584] binder: 6771:6780 BC_CLEAR_DEATH_NOTIFICATION invalid ref 265858816 [ 1041.129592] binder: 6771:6780 unknown command 6491392 [ 1041.129602] binder: 6771:6780 ioctl c0306201 200000c0 returned -22 [ 1041.137450] binder: 6771:6780 Release 1 refcount change on invalid ref 0 ret -22 [ 1041.137806] binder: undelivered TRANSACTION_ERROR: 29189 [ 1041.137858] binder: send failed reply for transaction 1642 to 6771:6772 [ 1041.137893] binder: undelivered TRANSACTION_COMPLETE [ 1041.137899] binder: undelivered TRANSACTION_ERROR: 29189 19:18:00 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000008, 0x11, r1, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000140)={'netdevsim0\x00', 0x4000}) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x1, 0x0) write$eventfd(r3, &(0x7f00000000c0)=0x7, 0x8) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:18:00 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) ioctl$FS_IOC_FSGETXATTR(r1, 0x801c581f, &(0x7f0000000040)={0xffffffffffffff96, 0x7, 0xffffffff, 0xffff, 0x1800000000000000}) 19:18:00 executing program 3: pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCMSET(0xffffffffffffffff, 0x5418, 0x0) close(r0) ioctl$sock_inet_SIOCGIFPFLAGS(0xffffffffffffffff, 0x8935, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)) ioctl$sock_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) setsockopt$inet6_tcp_buf(r0, 0x6, 0x1f, &(0x7f0000000100)="b9dc4612c3b3ee21fc0541b0dfff80ccfb82e043afde983a42a969cbbcb798617c4551ac43e2190c57093823d72d6a86de80fc10e6e644b61b457bd25a91c5a0f76d73b2043be78f74748cde14de5ca7e2f692e55d255db9567a193c3ba4056445305f4f1b7c4f46c062f7816262e5a803412d0ddc1fcf417139d6db56109635c5d0bf04bb8db7ec04baf14ee85d79b89dac759992", 0x95) 19:18:00 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) setsockopt$sock_timeval(r3, 0x1, 0x15, &(0x7f0000000140)={r4, r5/1000+30000}, 0x10) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r3, &(0x7f00000001c0), 0x7ba27d3a) epoll_ctl$EPOLL_CTL_MOD(r3, 0x3, r3, &(0x7f0000000000)={0x10000000}) read(r0, &(0x7f00000004c0)=""/250, 0x528b39862573c214) 19:18:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000000100)={0x0, 0x32, 0x0, @thr={&(0x7f0000000000)="b518b307449f97bf46ca77ffc263fd338051f8cb335c94ccb5bb448ca22091d397349fbd811404794ffcaae3daff54fee883700ee4317eb993a6866e3ae51e495b76850764001c357e8ecad9eb4e97669ea2dbf4420bf57c11ae808f8d59f0508499634e90b1b015fbb04fd9d7851fd7748f9736067718a0523f1decc4e8f7d0defc4b776910f90c66c16fcc7cb7591ed299898263281116f9e1fdf20b243300b7a571eac229f3038673ee34c910b433619f4ec2efd1056180018e75010ea4c61e", &(0x7f0000000540)="1969ed73618a27b83447e68df021571e9f93a30a8b14fd873939ca169029bbc500959bb7f2520107c6164c44fcf8029752ac176329f2f98ef8cbe00478953ef3f358713de23f85fd725c71ee034cd8b668ae161b72f2bf220baad3841e9b2601df9f16c3bc4a3ee6ae6377b09ec9966a2498d5eeaa18c1cc6835d8a2e534a7957ee6a004e44a55861b0f5615eb48eed9452e4f90d98aa579a8f3fd512d146ca97c788ed1a14ac5b0b74f16c2ff65bb8ee7874e5fef5c885e78cbfe624e050b32c626dfd17c68ad20c400780f"}}, &(0x7f0000000140)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00']], 0xffffffffffffffa3, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='fd/3\x00') bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0xf, 0x8, 0xffffffffffffffc0, 0x9, 0x0, r2, 0x1}, 0x2c) [ 1041.268978] binder: 6791:6796 ioctl c0306201 200002c0 returned -14 [ 1041.278399] binder: 6791:6796 Release 1 refcount change on invalid ref 0 ret -22 [ 1041.296282] binder: BINDER_SET_CONTEXT_MGR already set [ 1041.301924] binder: 6791:6799 ioctl 40046207 0 returned -16 [ 1041.309895] binder_alloc: 6791: binder_alloc_buf, no vma 19:18:00 executing program 3: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') sendfile(r0, r1, &(0x7f00000000c0)=0x202, 0xdd) [ 1041.315906] binder: 6791:6799 Release 1 refcount change on invalid ref 0 ret -22 [ 1041.317398] binder: send failed reply for transaction 1647 to 6791:6796 [ 1041.317413] binder: undelivered TRANSACTION_COMPLETE [ 1041.317419] binder: undelivered TRANSACTION_ERROR: 29189 [ 1041.351848] binder: 6791:6796 transaction failed 29189/-3, size 24-8 line 3255 [ 1041.365236] binder: 6791:6796 ioctl c0306201 200002c0 returned -14 [ 1041.371627] binder: undelivered TRANSACTION_ERROR: 29189 19:18:00 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)={0x20, 0x1e, 0x2000000000000301, 0x0, 0x0, {0x5}, [@typed={0xc, 0x3, @u64}]}, 0x20}}, 0x0) 19:18:00 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = open(&(0x7f0000000040)='./file0\x00', 0x40, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_SET(r1, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x50020004}, 0xc, &(0x7f0000000300)={&(0x7f0000000180)={0x170, r2, 0x500, 0x70bd2c, 0x25dfdbfc, {}, [@TIPC_NLA_BEARER={0x4}, @TIPC_NLA_NODE={0x8, 0x6, [@TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_LINK={0x50, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x34, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}]}, @TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x6}]}, @TIPC_NLA_MON={0x2c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x5}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xe30a}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6f0}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}]}, @TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_BEARER={0xc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x9658}]}, @TIPC_NLA_LINK={0x5c, 0x4, [@TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8000000000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}]}, @TIPC_NLA_BEARER={0x30, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x100000001}, @TIPC_NLA_BEARER_NAME={0xc, 0x1, @l2={'ib', 0x3a, 'nr0\x00'}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}, @TIPC_NLA_LINK={0x18, 0x4, [@TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}]}, 0x170}, 0x1, 0x0, 0x0, 0x4095}, 0x800) r3 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r3, 0x0, 0x2000424, 0x1) write(r3, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r3, r3, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r3, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:18:00 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x6d, 0x2000424, 0x1) write(r1, &(0x7f0000000040)='/', 0x1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x0, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) flistxattr(r2, &(0x7f0000000140)=""/101, 0x65) 19:18:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) r2 = geteuid() lstat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r1, r2, r3) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0663044000003fb0"], 0x0, 0x0, 0x0}) 19:18:00 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x208024, &(0x7f0000001780)=ANY=[@ANYRES16]) 19:18:00 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000bd000), 0x80, 0x0) r1 = memfd_create(&(0x7f0000000180)='\x06\x00\x00\x00^\x00\xac\xd8\xfd\xcc\xeeq\xe5\xf5\xcb\x801`\xe48\x85\xa4\xf5\xd0\x1b\\\x04\f\xf8F\\\xb4\xba\x8d\xef\x12d\xee\xa5?\x00kZ\x8b\x19h\xd7|\x14i\r\x18U9\xc1\xd7\x10\xf0G\x12\xa8\xbaa\xb2\x94|%n\x1e+\x9f\xbb\xb8\xac\x81\x8d\x93q\xd4\xd4z\xaaZ\x0f\xaa\xc7\x97#\xe5g l\xd55\x15\xbf\xfc\xf5\x83\xb72\x00Y\x15\x92\xb1\xb6a\xf4\xe9u\xb2\xe7\xeciy\b\xdb\xc7\xf1\x87\xc9\a\x91\x04J\xc8\x0e\xff|J\'Nxr\x00\xbc\xab5\x9b\x85>\x99\xcaz2\xabKI\xdc\xe4\x9f\xa5\xd0\x0ewm\xe7\xccK\xc9\x8b\x8bE\x89\x03\x00\x00\x00}@Ry\xa69^\xdc\x9d\xa0\x04\xdf \aelO7\xf1\xda\xcc\xa2x\xc2\x9a\xf5\x18F\xa0\x80M\xf9,+\xc9\xf7/nt\x9ba\x14\x1b\x18\xdd\x18X\xd2o\x15\x97L\xe6\xb5\xba\xc7\xf2W\n\x7f\x14ZIL:T\x1bd\x19\x8dE\x9c\xb1\xb9JK\x1do\x85\xe9\xa2\xca\x9cd\b\xc8\xbdiQ_L\xb0\xb9 \xf7/F\xfc\'M#,\x84M\xba\xa9\xa2yr\'?f\tb\xdai\xfd\x8c\x9aoj\x84\x03i\x8a|\xf7T;=p\xa2\x98f\xc7\xefu=\x96\xcb\x11\x91\xce\xce\xbev\xaa\xbb\xca\xfa\xa3\xde\xd5\x1f\xd7\x03:12\xf2\xfd\rN\x84=A\xae\x9b3\x81\xa9~\xb7\x80\xd1\xe2\xf6\xf2\xb8\xc9\x8a\xabC\xe2\xec\xb8,j\xe1\xbb\x1b\x1f@', 0x0) write$binfmt_misc(r1, &(0x7f0000000c40)=ANY=[@ANYRES32], 0xff67) sendfile(r0, r1, &(0x7f0000000040), 0xfffb) shutdown(r0, 0x1) [ 1041.467964] binder: 6820:6822 Release 1 refcount change on invalid ref -1338048512 ret -22 [ 1041.490213] binder_alloc: binder_alloc_mmap_handler: 6820 20001000-20004000 already mapped failed -16 [ 1041.502491] binder: BINDER_SET_CONTEXT_MGR already set [ 1041.518690] binder: 6820:6822 ioctl 40046207 0 returned -16 [ 1041.524809] binder_alloc: 6820: binder_alloc_buf, no vma [ 1041.524830] binder: 6820:6828 transaction failed 29189/-3, size 24-8 line 3255 [ 1041.526938] binder: 6820:6833 Release 1 refcount change on invalid ref -1338048512 ret -22 19:18:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) 19:18:00 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) write(r1, &(0x7f00000009c0)='/', 0x21d) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x40001, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r3, 0xc0f85403, &(0x7f0000000140)={{0x1, 0x0, 0xd5b, 0x0, 0xfff}, 0x5, 0x8001, 'id1\x00', 'timer0\x00', 0x0, 0x7, 0x206, 0x9, 0x5}) ioctl$FIGETBSZ(r2, 0x2, &(0x7f00000000c0)) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000240)) [ 1041.527200] binder: undelivered TRANSACTION_ERROR: 29189 [ 1041.527249] binder: send failed reply for transaction 1652 to 6820:6822 [ 1041.527285] binder: undelivered TRANSACTION_COMPLETE [ 1041.527292] binder: undelivered TRANSACTION_ERROR: 29189 19:18:00 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r0, &(0x7f0000007e00), 0x800000000000197, 0x0) r1 = dup2(r0, r0) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000000080), 0x4) [ 1041.639770] binder: 6842:6846 Release 1 refcount change on invalid ref 0 ret -22 [ 1041.680231] binder_alloc: binder_alloc_mmap_handler: 6842 20001000-20004000 already mapped failed -16 [ 1041.725098] binder: BINDER_SET_CONTEXT_MGR already set [ 1041.730444] binder: 6842:6846 ioctl 40046207 0 returned -16 [ 1041.738632] binder_alloc: 6842: binder_alloc_buf, no vma [ 1041.738656] binder: 6842:6854 transaction failed 29189/-3, size 24-8 line 3255 [ 1041.739059] binder: undelivered TRANSACTION_ERROR: 29189 [ 1041.739151] binder: send failed reply for transaction 1657 to 6842:6846 [ 1041.739237] binder: undelivered TRANSACTION_COMPLETE [ 1041.739244] binder: undelivered TRANSACTION_ERROR: 29189 [ 1041.876508] EXT4-fs (sda1): Unrecognized mount option "ÿÿ" or missing value 19:18:00 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x2, 0x0, 0x0, 0x2, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000000, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r3, &(0x7f00000001c0), 0x7ba27d3a) inotify_init1(0x80800) arch_prctl$ARCH_SET_CPUID(0x1012, 0x1) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, &(0x7f0000000000)={0x5, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000007c0)='TIPCv2\x00') sendmsg$TIPC_NL_NAME_TABLE_GET(r3, &(0x7f0000000900)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000800)={0xac, r4, 0xb28, 0x70bd25, 0x25dfdbfc, {}, [@TIPC_NLA_MON={0x44, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xfffffffffffff08d}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x100000000}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8}]}, @TIPC_NLA_SOCK={0x18, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x2}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x9}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_MON={0xc, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x7}]}, @TIPC_NLA_NODE={0x30, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xd2}]}]}, 0xac}, 0x1, 0x0, 0x0, 0x8000}, 0x4) writev(r2, &(0x7f0000000680)=[{&(0x7f0000000100)="975ddac3f1747b63b23a043bc0eac8d5d33446a91729aa82", 0x18}, {&(0x7f0000000140)="e8a40290d9dd478c6eeb362b72b57b4d0d87dd9c758bd1e2fd3193d3782f2569ac1a24ae55d8be7802fd70866abe3d3232039f6d79f386c63e53f64f1448c1ad605fda5c6c19f525e0728bd7f06662a304c55acfe3efab18a15c34400e711f524af7f0ccf74e1998479f9debc6d212926fe7a1854e5ba9ee811e54892ac57dfb6ba8bbe7c40961b6bf8e3eded2d7f1a79ae656bed0166c76acb2316a6db27f4cb3d2c4", 0xa3}, {&(0x7f0000000300)="eeab475aaf537fa0a3b7876341dcb5a9c559a7bace58c8ffa57f26b1819c75e010873018d1bf421f4960e278663fb1e54d7faa06232d4478225eb95e36f909ede70ed7050de771f0a3ec4064b09a60b059f3f3260b492c370f55e07b965875d5621e133c7100f676556ea9d22020d238605b60e35892c5", 0x77}, {&(0x7f0000000c00)="cc21aa5d1cb3190c952411574640aa9f4132d97995f4d9e414b06ae27a8a52764a40cfcbadd4f0f1bc8bbeb4f142bfd92aba662a2cc52a3c94c667b90473f2b935c253c0934cc33d0295d4d34e4515ff4f2c27748c4d1183ae2e065650daf7e535093b39d5a6ff77e30278aabbf005735ac82c52915fdae0d73c7cb8625e6cea0168af6f5befd7eb2a79fc123f8caa959a9c624a2f1abd13d6995cc436771c60a247312980043d017c75431f53a22675d81c0bce2a99eb0fecc829fb9dd178e82501f67ef51ebf82d38380d1921dc663c8f72f28689afae2492fd64a72aeea10d954a7cff564d9d4b04da5b11f773af5f359e5f1b8e3dffa04c2325bd1c3abd305628bad3c0fbe9ba56f54b8a550ba54b64002dacb0fe0991216d0f658c5c67d1dfb80f111f2ce9dd6882bcd94b48e8d373408a59fe21b9a09e53641c0b1e5a87e2d4a3f0773519928cbf1da6e7fc1ff40135fc84b652ec06e95684d0374aec21a74da7c4d4ac513811eb570158e0c29e9d577b42d5b6d3ecad9528df27c9e65d33425986b8685bb5262146c1fc40271af5b37925e070779475fba0a835edef48d8b685a9948b204b27385239648098c4844cc80842af3bf20d0fe6ee5d09e911d9404cfd78b4fab9d2aa7fbd38e7912cf7bbfc69461956b3505eded84126a7a368c6e579f5746423df88256eb166572731a315d79babd808e7fa66eb1c4f761a675f55bd2c86a0f12d581747a1a248d4b6ba23d938a8e68a2c89d9931c7af74b2ec390cc7b21eb89e1ffe42e7fbb206e1cd95e0a26ae6c2c4e1d25705a3096e09cd8c7d7a01002ed67ae62cb7161f8e7a9e4e1d7868cfb27c805db72c4eb28d21eb707c7c6572c4e480ecae8dae13f0f4f3ed7071262edac4ec002ffb67055669b9a125891d4d2ac9898e43cfb256c91f395e515d96c31981ba1c19df117d3834031bcbdf2244090f1b330850995d2d20b4fff5a7aacc6133b8cad6fd8e2e3f96837ea22784a1d7c2997ab95eeb44f85a4ae6952fb26c26e81ae3095a40787b7b7eeb1bb66c4cc0e531172c792ea7051699d79e715d6a1cdc99bcb8cd077608b9a443b261b7bc39f5d19ff911d83acf7db14320f4bdd857d83cd11e46f203498f41e9975b520c62eb229a2fb7f82b776be214a1a7c29567e7756a70f0d20b8b5b889d8b457b3f96106a93f1ce4098fdc7efbf45615afc04f008d5b7f063e924f1054c8a2c37047421d1390207e7a369ce24c63b8b5dfe84dab5774574532b31eb75e5ff6340c40563efb994e489f53c8b725e4007a5b7560f00ca4ff5b45ad4f66a7966c5af2febe473948a99a011be4b93cb67310de2b29f7769367dff5b77a2fb304c3f6dbd4d7fe829df640ab818150d38abfe95c26cb014266d36fd50172d7fe2521cb46dbf89fc8702ce5db128d6b3104a22bde5931f9f3c9b8b582234907ef370e724621d9061bc5301d794bf4d8525c8dc5577dd0af43f84cab06a586381811bac446875827f38a4adc005d2c54e087ef9f1be4167d9101e4121726203da39b4f9ed05d25f6acb558756447fa68ce6164503fbcd16b7d845b6c5a13f72bd4a910ecc6a0ed9727d50d114f035909442df14baa0a63cbf6b6acab75c565608308deea9159da4d8f85e41275a0cff8155876a490288e73547bf38eef7ff0918efd94207d48dd0f52d82651443d4734488f1cf9461ac6b422ac1d94c2e32aabc0f48cca3d2c7338b26f7e590ef506b906ba1736e47823980182447696122d1b632c2c84bbf8cf53f58f51f8dc670518cd140e8dfceef79a51566144c95e52bf27eef6c66c7f5af52a88d35e88643e88f739b1ab38595d55a37bae12f172a42cb284d4c7e2c397685ae9e6f0ea8c4a24917b0cd186a5090668992e5253b8051b06abeea45b1a4737f068a4ce92688fbdb78ab126309e26c1b23995dfe5ffd24e93e47cd023df09fb5b0ea1df0951ff1b5dd3f4ee624424baa91c443d55e80767a2c9e31211d8bc8d6ee2362f52ec8386baad7508410fc120f49e9304db3b5959c0c9a02a9e013f27a271500d0ebbfeec85d51343e0cc596a6ac1de54f3835dabfcfb428d308837da44432a87cb5fd5670f89aa5cb27ac7caad19b4b10c2dbc5508fcfe13773ab71f315fcad3ca5ec9430f6396780a2cf8cbf8e4daa7961bcdbcaf297f018cab3620d30af07260be178f75ab0fd4e19666c1989258c9060283f19dbb308d800057dff3a9cc49a472c377b7626e20feadc4d9cf3e49cc026d544859c33653ad7f44c176857f0964d123362fa8c7cd0d9d043b01b91e26f1db707ef4b5fcf74809943296e2471f1bdad8249b21b9c45df47e5df3a7a9a8749f8a073d08983b65ca6c1834f3e8448a823ce7ff8258ff0638465d9f43044d45732a27120a3c456577067de65d14074cc59427bb2529dfd77f6cacbc0dddba2105e7c39596c1d9e4ce53714f67e32d685c9c91c9fe36fc8794542e90f0fe905d20b0587fee744ba69cc85740912c2a51cc15d1ad8fa18e4c05ae0b9b34deaa53bae05830938413c0e73c4ba41f461ee4ed50163bcc22b51c436f58dce0afb3658b59e883f2753d0154df292106eb67ce0ccb8aaba4f21505a3a869524810526bc19e26a3d3f72a29cdf1ca59212716231786115c6841334295199627e7da4857c7904b25266f343c58923ec3d507a68b306467b8a6513550a56f47be35054891b0078aa96ff99c87e55cd937eaa89434beb42b8239da1ee07ec0c4a163464c0c9f9d3383ee26a4194d6036c6341196b5d530d1b1d3206ce38c38b8a78c2cf9f72f04381c38054daee17ac7bb6ddce70c101145979a85241e09790c9d839549056fc43f5bbd0058c54421c310c710518cd0b76af5e4f6b55b77bdbce5d3a5f765bb25d69b5daa3f8f7b2d507ceb31ed6652a7763d43d764d01a41971d827449a232895d018e59534d541db3ac07786b033af259623e4f27b7c92f8c32d5b7f7857a61d487a9c8695fbcc2e9b92d2bdaa135049d9a4a5c01471299faaf23d8cd31f0d4254acb69cdee78c5eca1185a3af67f5705e6250b50caa31a2ac12c9e0db91f21f222e933e135a87552e17a8eb9cb5537befd1790e84a5ccf2c0781b6ab0199071deec89d879e2530475a206cab2d2fd5ccec5bab34411d8861efd46b137236442587aeca786677cecfaafe9b48d4df43af69c60c53422d3f7e6f5516417696274e4e3fd5fafe8a21bdf085d82fcb3257b3b1a4ac16810ba1b116251465d4a707c965322a5c2c51e5a409f9daf2bd09e2d10bc53d81befc27e96e5aa552f34e264d1cff2dcc33339b910f00afdc963ed4534b487ae0e7a172aea49a97c59bb3936247d679e5c47020601d6f0019b3ab4c1f542928146f0dc85e1e97d78f95918d45311e5e1ce8836e3e19f542bdaa92171ff16d8086015dd192dd40cbcfc64057daf85b620cb5a9cc4b21bc945c1a7499dda7150e3984ee01d7aaf1dcea7b598bdb82f431bab63c17185d3ea7e9c287ba63763ffbd01ca7cb682f3468c472bd7b0ae34b8fe78cd35c4c36e78af643d69e0ccbe8d42b1dd5cf7d04b0372d08dc59fd1f536294489f06675907f94b003ab1a988284eb669bf4ed31136c1d4bf5875eba1e858b553e14267f527cbca3b0588b9ac959f1dd8550a8d2036f3d211c141ff091112ec7329b3d3573b31a1631483cdd7a2233bc5bc402914a449b53c6a7e20105b91403519649365c4ec24a6432e89573e8bc55d722d1643c35675c4e971e76d0e58b79f9c6e454950853dd24d17ba9918733e273a2a7bb08e3ee4f033ef189e4ac0ddda2f017d9a55bbdefac8a9ca09378319d5d5260f20d9a419d67c4921776f8e6df647c7cb04c6dc8e1f7ff71615eef588dd4036c64c35fbe9da96bd053ee00dda58d2847c80896f6f33c9c3613feeac5a9aa6fe1d78d4f5340565d8c0e5ffca19c39328a0f7836a0282408b5714a04bace107cb1df90fb30ae40758a06225bfdceba9f6a9037de1ff04851552374d1c99d2dc53324c503b3e008f2b0068670e05959724b57bcb7fc8a16560abc505645519a29823386d8cb8478a52d1fdad9d11b5f76a30aeecc404f7941e3fd4cc62125bd6ca7ab87a2ab0cbae1c93cb818ab817332637102eb6137fa7ba8dbcaa8007b3b785cc9feea3788c089a24b9b6d4b671c2cb298c606ad523c4973a51192ba87f5cddb618322b47928e2af190732d4789f645336e30f367c5228b9d4aaf83fd7bce95e652dc46721facc5282473fbde0c3b7e40bb9ef3a67be1b6ae62bf661f382a7561bd5c4935bf9b94bbcc91fb51f466f22fda0d210fa8af437fe5f4395f07d56ad3a2c47de55c1e1c1e4b466af1e90820284c90f985829e7aced05df5cc84b70225ed6c3264bc8f9008adc734a97d2f289a19c7468f149e8bf6f93c921bdb55142975b2f888950b627fff37a9bce41019f12b21b88cf2f933eb0a4c63f6d104ca7b7770c1736d7d7fc0283d81c6039e4ebfa2744465c64457b9296a9f631d21c0466e0400c7e4c1a6c39ecf86f331678add07d190168d1fc661d6dcf2aa62b1ebdfcdc625973fa1f4a785e25950b1d3e0438b0456c19ab11782202c487ac9b70c9906c4a6b8413709f8aba3571399da03df36e80a28cf37675e40a7b2231826a73ecefa83e3da6b0a44f9339d303e39a81fb7692b43fe6955adf35fabc1371a6613097e27078bf1c0baef64623f96df907f9a8f429d555324320d40cf38321fde6c5e387ad41c4f93a9aeee385eaf192392af5cdb762e7fe0cff74a11cf406b4c917f1f0b4bf4ed6f71f6c35655af03f60bbcdfb58ac9206277203ad49ab4bf2e0300ee3c9c944ba99600ba295fa0d7bdcdf9697fd60882cfb70d34c754a266c08b1feda244f4e154b0202760250a31e74c11eddcb23d456d7bd9031490a5c98ab34a8489d7a0eff1c41f63fea8a1dcf29acc81db1d3b5dd1d963f804a5378c5e98cda5b5227fa754e303bae46fbdfffe1cc7bce8266ffbc4b6a32bbb1acb1fa6a3cdea509621596c1105256e23e5d34033af29dfa7b871955b5e24dc0c8d0bffb041e2b0cdd2295af61110a735b77c5dd453fcd5ec2a179f1b5a6361ddfe3cb5f34bd0f1623a2a8b58b5f92ecb73b0509a0b41dee6c5c2ee066914fd6079247ae0eee8828b11c33bbd51e2ac1626429b169ea02eb3fb385d457630126e3b19d7a8d02ab51198e54eadbd9b3ccd92d4d76aa3fa63bf3b0f0a79f40686ae06b2fd9b3a3bce3c55989b7d7e41ee4483caf0ea52566cb6e380e85dfcb2434b7a1e6b5d0f0a7671cd9fc55ca372b008b0bfcab5e4f3118cd0d4dafc10836adfbd6c586a1b9e05489aab1dfa06e5be0843764bf10d021b7b76c7607e4d931df1917e466c10c884dce816cf53862a2eec7255fcbe755e00eda5f7bb32fe07dfd0d5d1b31df9c4c10f59bd192b4db7859dd07d5f7ab4a8a44b7ef9ab7b22699b60fcb41554a90ab5172334103abeb186fbb8021bfcdb5609b0999178cc00682c36f22aff2f848f35b951c017e739f6452baa2134325a1a3c70e467613f0d0da3d3309c659494c5a7aaa5cbe33cb9d86fa93dcb89722812b81a74cd274bfe8cd37edd714125a31ece8ffeceb8b9682c6535b73a45ace805b1ecac466882b780113eafd06c6ff95da251945302df115317e25f702a183cb4954f922006f597880d74b7dec2cb94119fb5c87a7aebb639d30ba77b3a51d39b641dcb5a522b3ede4a506f04015bdebf57106cdb8780a5adc8283378ca5859ed8ab212558298669acac4b60d0937330f35a1cd97c", 0x1000}, {&(0x7f00000003c0)="ca071add87c8fafd4e1fc6d2b868d23426cbd2a2f061d2079db23e2d3dcaf2606c94960ead0dd1181312512e7fab36669cc421b6ea5d9e73bec3b0a05b28df16e8c020a425e9e595436ee2af71b760c15f2d237a9d186150ad80e9a3f6d724fa4436b5f8e60b9817aa1c1c244d74da", 0x6f}, {&(0x7f0000000440)="dd5f3ced5532974f244f015dd451d58472f3e0b4c7782058452ecd511ce559cde5a322b34957a90c3afe7f3ba7563a647713af70b0018019d99f198790f23b1430c3718fa42f1d62e24e0ddc480c445a0499f4966b607d0cac4c2f46ef23ce7e9bea516649d9", 0x66}, {&(0x7f00000004c0)="666c7c07d2d12de2b6ffe53a23b764a9145298442e8f932469ed5c962c05f4841e7b2260b16937b8470c2fe3a548c0686a893dc6e01cc6dde0642881da51d7ca77b259d72d15aa0336620132f4bf541fb53421a4243f86ac7a746f1a5965e293bd24b70dd85564ea8081d2b37e8199222c538a085c14f61e3bd5058632a6380ab4422693d91b3d34f8714963ec94656f845ba8febeb15302f64e31", 0x9b}, {&(0x7f0000001c00)="1c4f5d27f85ff27176e7fe1f0aa2b5cea1e83bdcc264561444a622e6d9fcbad3b57446ad40f08138146ff9e74754ec1eb853b0116f0c81936d6d3d6df8bc0b7c2b7597d3e52517edcff1e85a9411d0b1c5aeb5c3ccc41543323119ac4fc858487df997d8c5c9b57729f23f441fe7a4f8e74001ee98f508e5bc2ae97dff7b1449d1a9d94243ad75adb58b260b7028df80ff16848dd49ae188b5b5a573c671fda1a4480f1844a06410d73d91858161381c2e8d709a6547bbd31c9b434b1fec2765c621d72e3e7c80a6c2be391ff90ef2048707ebe7aa20ba85a0c5bb14f502a6d99e729feafdfad3632fd4a503d002d4526c0ac31c145bb9a5ede0255a4451009fd392ac4f4e086b534762af031f49af56ba4bce085e5ffbb7922cd15cbd7d60787f414464bbd84d1735e8cc0bcb6f4029b565e6fe0e024fae5b8e0d114997026c085b4988366a50b848665449050f6727994fc20bade7e07eca2e2dd6b0c6a91fd514b013971d9999b62512ce73c7e8b08dacc6e8f4aa22825ccd14f38d7791b133e5c03c95ee306c5dd0da592e00fb2e2270c361d335e98add78fcb6afa04642634e2361d5e1df3b8d4eaa3bdf26ee094df1775607686ee3abc18ef8ce5b7db5b794faeda13719e8b6d29a288643a38c0fdb746f726d0b14ca2cab95b62614e689a6820e485c8af23ee8d1eaf89a4b674208fcdcb1dd1699410f38cd85ab54ac1ce4bd1cf3427064a82342268c381055be88c7cef37248f100c1d61e1d79af91e9786f851637b560a113aea40f3cfef99bac95cf6c18ed433571bed191fd16783369a70d91e71d8ce354ff5775352c67dc8db7f187f41ca4ba3eb585e549788477f677bb6ba0585765c94d377865944b0810f17277ed32de40d80cecca2e9a9e25d45907d876e236f256b45b4879964904e4f7304917829dda9a3dd216397d27a3ba43a986ea22b87bc6d391c87f510bf11911f025ea25116da7faf903386e6b03e5ca3c1fbce098d5eb06aedf735365f5b88392e3a91dd5139f4f9aa39b8d7435e91db71de81ac19ff1371cbd96a613fd0e3357a929e53fa7e35c975bf53befaf5220417d15eeeed7d295b92fbdc782398c7e2264af168cffeb6f6112b39dd77795b6064a74190bb039e1d02c107d3799d5601aa6d1bd56255c27a3a7b6159d6c3a9793c9407b1c17da748ed3664f8283f786bb684b8c0a6d08ae43a875d5fffa89dc05faf24763066a42d4cf959f33cf45ffd61b6757ea8337250bb5d9de148c4c74ad4bc40567c70ce4d75c0b5750030cd2670928253ec50068fdf34ae69ea54d6d2e9a9ad0ca032fe443e27d60177766c6f1906668ede6a99c8457719f2620a22ca80dbf84dc377f756ec0ece9fb17c9cdbfe7423f3d65eade94257124874ab6f5198113167aa6edf87e9a9fcab0e5f94af0ed0672f8399ca8e6bd03d80a62216f09398864738e521f3cbd49ff89e126a828aaecf89ab066ca6414ad727e17347a1f5a7d98cc5f9a14f6a5b640adb2eb0529735688e4375cce97f640f707de1ce4a87630c3fb3ef646203ef21d57a569164870e0dabc2b50a8fa3927126c6640137afed8af342eaf2f3b7cb9cb9388c157d07742e44725dd88604e7f2789ac3fcb160dd1c7f8fd32db3547b4d279c0221be1c538083ad885dd76d572838bbaaa19634f26b50893c457dd331fb2c32c5c3ff422b73e8a09b9b5ca8d5b01d80def223191e8bdcdb734e115e9ecbca8361114a496409dc5b5436c409c5b8a0fcf71d0a635ca7932931946270ebcba286c42e63e3003b0f115e4c00fb718c66d6a28a2d0da10beeebf0d2d70660e0fca23731194f45f9ad11a884b23742cb5036eab63c7e48a85ce85b614aad7681268369ac65dc97853ab6baf35b892322a7596cfa223118e1727d56e788c2d9d54f41511748dd15b706bdf9a8ea21579e2ccaac6aa945d5fceb18fc109d8b800aa4cf9e56378291465af209e1141ee1a9042293fc7a244914e948107adb570ccb7c05f0c5a72e7ca27ec5525d582eb5d513fb357b5e521405520154d14b1dc25f50682406681afdb31221142080053081fad4c08613ae76a1a44f44c8e855f2d8fd11e0dc53e98e8d34104dd3f97eec80049f5abbe60689ba864d1991bc84bf4ab8d1ba2d9dacf5a093e32fb173971f45b5f76d97081d800ceb421f928a38c182f3ed4301a323643fea5985b9184e206342f6c4f1c1f53783bd2518ff70c0f5d28cdcc3c6a4b0a23c7eab9644a3a1bfcf05d1e2cb34870dff2fa99642dd0585ce20f6fe0c0902a848651c47e55369006a7b615841bad1636cefebdfed64cec1502c4f352ee548056f97e1759261e852b7fc1807304bef5c1e0c54a3595b6f72ec7422d2f683bf8cc7585f14f9ea3f567d395dd43b5d0a2abc666e39c45137508b4f7a8ca9f26c5fbfd8170bd484dd9ef915c4696bb645a5e105fd1417d84b91e9ba76ea4d8d97dccb240217dacdc0586b73c11e924d30f60e1d173e012864bc041c16b118d849971d681eaaf0ff13ace8066373505280084639c028ad84a5924b887bbb6ce9338168bd86dd6c4b5ff8ef03d2df762ab1bf411b5d97a707b719eae6b4081f3b35ff13df116bdcf9367996cf73e9de2a01683565b04008c59f6d5255ca0056ae44b21d107de5a73e4e81fca4c3811b09ba0e973455ff1eebc449fd0cb2927190f0cb107e88709214b78a118706f571ad3df05257f342c04fd879894b65b47d0cd36486d4c747fed27e822a45d12d0527ac90ff44bf46adccc414a5ce8a751d1862c1316a500713e5b8d57d55fbd525efd8593ad8c427a95004e833c8b41aa0ee478c00e30fee2826c9e4a61c4e736461d6acb613347cf321da8bc4716496b5c0b9e374c37f64962fee39c00f51821f6aec5ee91ebcefe60ec162fd503a79db6b50332a775de0b8a2c5278d1048f1df0b6fd535b8024fc5c23e38e600e4bf235fb94ee36169319115e4372e8a317ffe15c4e07550f8a31851a88132688991878b2fa1fc188571b39fd4e52359b36108643e51ad6f20106fd00fc185d9e7d5244e7de9f8e0ca1f076d0c278cf3c1b46466d88488359787e1531a9a16fe5acdaa324f6a7f0dfe47f671ffa77f6b2e20f9041ad284207b1a24f4583cb31143ed2617dff5060b8c94aa06dd3e800726dc2fee7bcfb11d4a4d7be2b71901bc9b1aca7df547f11c5e668981b2bce45bcfe456804a65985586693997a9b668c8ff350713ee9df515283e67328857b522459fe3cfeb7649d30d33c5dd8079893a8c0b848bbaac26f01a9164c3adba88c1c9a62021113139178b65c90444aed203fa868f66d82b0937dfdd1d861aa9acb72f86fc6455b75bfa9f6a5a05c1f853354b5a4847bcd25883fbe9a23c0e908795ebd9f4079375dbbc4132f65932206d9f15204a3bf5970f244c9c5bcfd8fed568a96e0fd5fdcf0546886126ce76f71e40fbd0ff9a65ec639991648127dca1698ae838f7ab9a74c02f5df70d85ef51fd496b84df3dc637e302161248738644d186a26ef6e01667396c0aab806e40ca3b42a9986d20b98c4e499ddc62237cc89008b20cb7f87e57afe46f2ea661fb4bf85a004cf139e4d14a5fad853ba819d3fc49f6046ca3a4ede2b46bc60b3b472e164f9762a846912cd099ea21297ea2fdcf751fb1fb5ce4f574fb27b3f179bbd1733cdc6a8467ad12144905b38c82f8eacb20776ee856038e4e4db4c30ee801ef2b014de547b647ca8adb6f359a484f9207b4b75ab53496a5f10573e1f8639f0be0b20fc745443abded39acf9e5cb80bf30a690e42baa112b5f1164025e99f8cf0fba27dccdb914e1206e7829871b0595715fb0f9f6b48aeb4d5c4cb9c629a90f19e32c6fb4275d868d55911196e27b02abb0aa73f90d8f6397131275f258451c2ec96bc6ad74ca0f57f37b02089c95ddbe0cf70e0f35a541c1d5c17f3f7ccd83c6fad66c4f0762ed559e2c65a096097ab7267af9411c0c7901b569d27993e4dcf540272c1c3ca8aaf97f4905ccd869d7353d1bc7412416423a2ae75603d087a4ba5a9fea3fe0a4d601d361b145b436902d432132eadedd3577aab23f4b363951b3ba657e72d6f408a3667c1bf5874fc70170a121a5232c819d880f25031ab1d8dc83b03bd67fd0cda61ba6e8a5962e17cdaa682fe8668573d5789f65fe3a7a62b33b3d104af3d51a632eee8188794395762f311441137070dbcfc8d22f491358cabca9f931b396d37f4945eee5d4ca20a505cd2067479d3932ce98976ac902d8a1b0d0e4bfeea49e87e3bf7e45cb471a74d8376bacab33cf55e06491d08f83a41eb9ede6a8652208db634a42a70c2e271eaf23de17d98c331cb38539fb8ff806b412ab4a370743ff7b17d7b2460fe8b65397af1e0c3293d206f41ad9741da29519ded588e80ab0648bd807498980a927bd7c6757e2ae3844ba70f2181340f02eea3d90226cdfa01795252fede7650a359ba9bed22217b4e6bd0f3c77473cb55616a8d3497846500d2b77a938a3a618715dfc45bb98bb6555c8dddf986251779154aa04fc978578a9ccdb2c2be8f71535833a9a25765e82135817e1fd799a587ea6b40478da88edfb5c4af5531a7edb1b1d82175f2dd85987e8f32b3e4284e0aae2a4cd0274a1f57a62dfc87e62fb88438f3294fc9ec109f3affbe61e183e8a46c49ca4f514c18c643dde09ebbcd62504f3dfb3d4ab23406f55282d107c401b480a4b1ee80575500998bdc52c1c669293b75e969457b67aeb129d9dda0a9b1c078fbf6e4c82d631fbc58206236609eb50a200ecd4ce8d4c724a5d5736b64704602293e8a65f459b9dd2e6d692be2cbba7556536e13e7948b1dd0ef7a981cc31ff75c2c5cb0ecac2ae560605095fb113ea933260246d9e888a2802ddbd092b5ac2dbedd6759c3d9167292a8f154c98f1a4e475dcffcb74caf0447f0a77522248c8eff8a91cfc7a672589d433e774b96159ef47d5b9abf70a8b835b6ff87dcc47b79eddcdedcf0e95ffa38febc0d460acbe555ad4a5690a25cae2f245c6a8dd5e3b8ebc52eff063eb7d229e7d7e876bd3f07605b0e60885426823f6b03924c03eefb19dc8f58841f6cfa8ab0712f54670b04dc76b762f92ae92d821553fe51f3f445488434682fc4502cec21bd3a551a590dfb72b0ae7c6a597dc2a23d6a2f9ae0a1a8ff78539e09627e594affe42e47e231f4671f08fdb88b8416810c222a6337fca00bf6df88268c3c9b4b13db96a82959714d0d1fda29cd99270df7916f2462dc978bb482f2df314623f4c673db253184f4335b923d4825bd81b32a2563cb7dbe2749839df7b8c6015746cf1dc6c57e472aecacb24a1512424b65b8b243a1f77f2c2915dfffc0436033c9403ae864d95a3e48956a924645ecd73184e225c01f1586a476c3ae1a3e2a61f1e2ebdce02d16628d1d94e72874385048be718dfea7ab47a8e8b7ef6809ea31959caa80fdb5c71c8fcf6cde1c9efb2d3d95997d5e163650ad9e018250d1172a0afb82b6d62be76f984d2078cfff4feb4e034122fa87a2d84bc3fcc742ad375e605d0bcc7fea1d9ce64a2b88a5ffb4002a51c4e6e2c786e2e2e7775efe5117606843d28b539eace50a50724636d8b51678ecbd8c5721254f56163a83f9e626b98943572f252f83eb64d89d57ba03d61b97602be422275ac27f9950ecf725532bebde0df11e41d411965d6b3182d696f0d2deebe1e6bdda74879c995f75fa72a39bfab3c3814b2aa62e70eec88863c48d0f9ad3f094929737a6a25943a9b8d895c9854d713f0f667256", 0x1000}, {&(0x7f0000000580)="5d1f861b08670410696f2ca1f35de4", 0xf}, {&(0x7f0000002c00)="127c8fc00a07a39d9c29a342a82897213ea1311c796ffb77a2a3fb6bc0563e17d6f9ea4bdca449446be39a032ea3dfff003b867589579a8e17ac9e97535f2fa12837c33679fe6201e7fee7ab4c50eec5eca261f3a90fbb7b03fa2c3fce4bf4a08965725aa52bf1e6a4fd9a45e0a1472cd32db36795c57f99e730197280369663c5d6d3b242d7e5651c97ff0593a4dd77a9c8f7f472f20fc6d78364b876a6ba385c201a7c8f72c6541cc2e2879708787c3cd5370d0870281be1df0875e592bdbe71e104ae75940b3f2e2881a677c32d0f217f9a2d69d8265ee2b65ab162cef9ce86b9548275f9211986cb9339dfa168673a8cbfefe919effe37b0f6f397e6d65f77ccea262eca8eb09a194ea5a8f94d9ccc77344103abff23c9c63e8342686bf75408e26c04de4856b5ea3866fe069c2bee087dcc709cc35eca0f595db248e20960f21e72516985b1f0a4c9327f7cd368f270f634c477a60e498fe69e9ab559d8f7823f0c74a6c4829893c9991debe9f0cdc7fa0cd804422836519b9cc731735f56dd29361e6bf16708807e3aea4f35e64f13da14d53c5f883e685bfccdd65114d50a2602c0f2dc2d63bdcd8f411ca56f398772df62713a4c36ffa959e5965990dca51809995c0fd501eb307abb1c6a73d5eacec13acdb5308f853fbc2a71a953c9abc3f25c8e07aa49468ef8091cd1d0ea1d1a7f6798217cdb0565e426d7c7bc92256bcce0085ac30fcd0d612419bd6c504aabd5081587692521b5e7051df4bf406872e80585f62ac9f8362d4bcacc308463a2b65d9970e08d5c8c91aaa8be75c0b78ecb3eb0ac2ad120b0876d10686924685a2382bbd9b253e302ae6dd9fce5e48130003b67144337edd28ec732d6987a299fb87b701d662594ff8aef5b02c0e9b712d7b02148ad0bd155ca40a731749add53b28db8fa0814a618d2991af05e1e124a5313383e47862514a74cbb9b3eb637fdcf127c6de0278ffc9bda36bc2fd5abe1180a5457df4ad1458afb2dc22dbd900caecf19f5f7061b5db0b15280304aa99c10992032d2c78e8ad26008e8531bc09f36e56c55df2dadff059ec4552ef10599a9f22eec3d3ebd8cfcec9e530392c932743d09243ca31842f2f3e2d82f4e55f821691354b691a7c82daa322d153fdb95dbc02be3d8e023aa99fb459952e9d9e618af7eb2f6ab21956c33130ff90180a778e42daee3dac713486e436fdf350e8f89ed116c73cba189aaa7bb76c85d19c334ac3b8ade09767014f733292ba05c95a397c4c6d3505efafd908b87f0c967848374747f13bd652f081322b09167b94fa41c126aeaadded9974e6d83e3ce15460ecbb94688d76dc4ae5da69492c1f5447276d6fe0574f1281a86c3268af6d0b7b91d4c7c8e30e56d0dbc6e8c190be7c62a19c080fe7784564800e739cf4324bd714df8a8703a238b57a8b21cbe5d42c36028c29ab89dfb3d402244338eb664e4fc1a2c7a233de7177292462f30a8abd3ccd14cdf2527d392fe0f5e56ae191c1732ee1f44e43bd063f39e5485f6c102cdf26ac7d52d1f6f1bb4b6cd16847003594eb0d0fa8efb1005bb43fad0a21e6c4c87803ff1beb0e82938622bb0c029e1e4979e757a919581888fc89b7bb631cf01c8baa26553d740a3bcdfc363ae8e4312f23d07a4542fddf0a5a64f0048a85732c234209e50336dec9d187b8bd5fac1ddd260f6c4bdceaf8c47704a536764ff158276e0fc7d76a9fb8be1343f0ebb60aebfe2943c249a737b18768884104209a768da66fa876086b0adb4ede327f75e9954e313c895a48f57f062f14557e28e78d1aa8c3f2f964ecbd81243f1d3f55b11d5dc96a3c1489a961776df73083a987cef50720bc5f48272139f5573edc1b559a2e5c644e541858344518f8ea057b52cb05321f10c73c6a3c4fb87a7a1b66039b35fbfa703db1e75ba780bfb07890aac4b7c9c0e384c880df25a97fd626c51e08a91a57b94d7f3db1d1b3a5afe1521034eaaf32b0c385dae33c1f5b1ba91c6abc1f39d7b457781d99e0279164c87755bc271effe5075c54923b8b64802c84fcf16f0e303791847b55be1875bc1e3894acbe3cc69905e585a3402e713b0812734c1bd01bf06f3e7bef3be0a5fe06b51044683a9678d8294710ba4fd794d77c68d1bdc5a79b8ec908ec3d0647f4ae04703b6664dfe75737d27a55de5d4146c299c438af014169c5afd287ea7d6b3c939cd88acdb9c17b271b41ddb9d696ad8f2529a3ccc013cab618f2e822b6f7ed487e0736266c5bb6a97cd832b8a5fd1c415277aa9fb912b2ffe1d4c77174505e47ac16175f97844fe195f97feac9ab26c6e06c677f7c04c2063fa9f3889c7a60d401eb1d670cba2676af2ea7b71e9741a2c54f16deed766dd9c504d8747eb72bd5fb81589c9cb9ab59336906b19fd864fe0c30b936b7dfa617b808d1d8958676e15d75056e1a2b46242801786914884a3c821e8405e5dff11e7e722cf7d9d447f82f0ee642255964697a39db722b8ee237d43414d28fd976a733a175ba44522a5a988c13b7babad25d92da63e5b3a7a0bbd1963ac2b0acd25ffc498f0b14d391482ab1324876e8ac098e6de5cbdb5911377f9b01ce800368a2e8a2ba55fadab73805a2d00365461c35b0f441c655266dc6edcc3872bfb694bc187307471e241603ce6d106e92a2779fad6308f68ea3b60f5509df819bac1de9530d57672b5d44ae95d563983bcb4cf927799f5ab77895c67e203781a560c27ebae437a0911402a47dda7125efb4a2d81604cd42fe9a2d3f61317d530cda7b92a4eae9c67218790fc2b40a8a2a4c9826e6ddb251bebc5b94f9f69f6d17579a83d5f9b52e18f5da6a616ccdc6b6b965cbf1aa91781382f0b2a44e38cdf68cd182035a617cd6e40637e3fb5304c78735cb496f3cda3a70e7275c078a43ff5c3f5db340e2e991d1d045688fd2f16bb69257f34c77f0461ce6048446914e38d62717e8ba5e8bb9e20e217bd7d59847683cbfb3a2e281fad2572009b378779ef41f1521edfa99baf33addf24431185a16ee77267e51648854e6afc8070c21a00c782772255d8661bb3752e7dfc7994306d3392b20c73dfdc8dc69d8399233ac067165ec1f9c564294b103cda45693dd6c0a4f56edaced9dbd65551c187a3a48a2a484bcdd7631a35cd1d945889104e74ccc018c14d5a36198df597c3a33768eec42d7c0ea565edc1f905d70176d9c174dde39a28da0d3b55a98afb9883bbb3d24832ad0da2f103f4f58fc340cead587a1d604eb0a1bf1554be20278ad320ae46d9eedd42b37c260a16234ac6165a47f3570575f3bba0761ec0e5253fc95b8c15cd500da103441d48e1515137a98c6a7ad3f9151c43c7a1a9c19e26580ba5571be1f6051395d36e4252cffbc2d6b23227141a1ff95c3be316bbf1c743d16e1c53c66eac0a579664829ad11610a4f730a5c15f69557f128df72f2b6edf9ae579cabb9cbdbd586b218b4f0e21ca83d0789c83c225a3dd5f17ca06b9ed00617165a722822c25e34bb01b3b123b23c771cecc03241f7c5c404e5595c36d3250a2cb105361f1ee37bf0f0a647652eefc27f31dbd57a4160351dc761d60e8da7a912fce9cc891dda2e41f7c7ff068a3aae2b6feffc993f9e2d2daa5c7eca2db16ff7bff3348affc4c08e09ce5bb4c673375c578c8485cb867cf68ebc366c2b3bce8d0c09b956511469c2fd4c567fcf11b34c723728d6bb6b9847c4c530c9635c388f53792f32fbc341136e10d40dedc89571eca77958cf8e0387a7db4c78f746715a8f61cf04e2d27f658011a127ac472e72a857945a3738a5bf833e3e2157f24888592173fea0f3e3bb1aeda46e9ec391e5bfc96b7d6ebe6771946fe50a95852fdbfb98dd5e0044c790e4b78e5de3011e612d48e94e9123c2cd1ff853893ace6e271954f7b477454c35c02cbc4416aabe4d33943e613fd61179c9dd102f9eb1237e75a331c199edb677a27875a3a2e44b867f07391376bac7cc0f5d1d1b2ef464f6ce0474a966a5dfc07a8c25c442beb657447c04b09fc5782226e917c7ef09e9c638aa54556021d559061f19b67398c7e5cada336bd401e82f2d95ec0ff7faccf070f551f9a0ea7bd7872dc174d64e21b031398e0a4d07c4965f40135cbb1fc389ef8b954d84075074390a0ff8da6ceae0900fc92e40acd9e1519e63f514320fffcf8d687e7a6b8a7a4d984341abf0c8f02588c2d5c2ed6dfe5724c019ff59290393cf29bca6bbe55ba6b15f912800b8525d4d4acce3d402f8fca3c3f28af9f2d3ad9433b9f40a9a0ae6bd09c4837a3168832f4b8d0c787e1ba8b2e3aa4db4f25af8ed500a36c6982a3ecabf2cd7dbb8ad36b1d59bff7fdf33281e1745a9b9faa5f89729fb71bb75c97fb080df57960151b700566c6f3abac529d6b308f94cdb775c7a8b13a41bb678d87e4e36b7b1792ba21e14a5b5953f9cbaec2da75e2cabc4cf876351460243dfe72cac664aa6162cd07d9e8197ce08263405e7ef263635d1b365b47ddf1d85de54baf4e9dff26c2b06640150d3f0fddf307f663b2498f9e6ea59562a42aa6fd73da80e2316d78e7226e85413da12b34f4f8e51b69dd4701c6944cbbea913f0dc0f2b32add284db15ab1d27f94aba439d26e33a56d7996b37c41c423daf6349930aadcb6039b97cab3b31fe6ae299ca1d3914ee61c6dc029a9a072dfc70e02388f95d21726ddf9ab214646acec8ae382c8a13c554b1f7a7b446041fd5e0c700c3eaa67c0a46c82b27eee1e5bb2f347885b1d349bb9db5cd2aa6aeb4cda1ab608ae1d62ad9a3a79a0f0b9adbcae9c5957045f89decf7db2ffedee3efae837c1ce215209fc08ba9a31adbf8aaea1c0dce433d0447cb6abf9cd43145270537678e82b269da2a9dec9d7a5db8264433474fbcb76c82e3e3b9c8a4c56ab96172a94a03ee4a25e9c3fc7eb4c12db53a2c3ad99d6d29b8062de3c7ff7788e1f4fe55ea4a6d00f327f4cf94b145f75f18b66daa402c2287edcda60eba91406aabf09b2e8c9736dc04c3b279fb378d4a92da89549b217e92df9239a93c2893a078d66d1407a58c568a528fcc28236cdcf0d9eede7abdc97710db96d33e714e21118abe09eedde9a4fd556a59f4f180d103b9e3b00d67ae99070449abc8bc12abe9c5b94f6f42cb97cd35df2e4049f23bb1461fc7194dd580688e960292fc6ba5128171efc43b052575b8b07856a0a47fef1e62af44f03c66398a764fabb1f5f41c9581c73e03bdd39f616c0153d487a1964ff23cb8597562c3777953e9e4d8cbda6ff9c0283af5a33a956ce56ac2ea007f06b24604f00bf184066fc14e4c348efb3c601ab0ca199002ac3410a87d061a79c3068c1e5054e0196e2aa14816fa653e264c4c0f0b210c57e039d1151e92a13eacfe7a5efc0d7200adbda964449da78d3d4a5092433fa1b9b720bbd0247ca78a8b89bc53860732f46ed2ac357cff1b8604dabaeda5e07749a5a6ac8e4ba9376bcbce4b30d218308c86b0a21e1143be7076f376caab230ed2b070e4d70aaa8d8e838fc68884213d6ea93869c84777febca169a8c0766f57ee38294826f7672a6db0c99e79e80069d76d6064be5ab08a50a62f2689fb6c36bd01a5ae3e9da7b123511e1789115d6961552e86b7f289555341a07d1e9e844f067b11886f84b093b59ff57a0610d8e29b05b55bb44ea29893fb23946b258fdc7d3db98a9d46e72e9af8fab347c501d4fab2491841ed941b51e151893e882a7f8e05fba4fef04d4ea8856608f36b8e04f011a8de967fd80423e7f6f268a921e", 0x1000}], 0xa) getsockopt$inet_mreq(r2, 0x0, 0x1000000000023, &(0x7f00000005c0)={@multicast2, @initdev}, &(0x7f0000000940)=0x8) read(r2, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:18:00 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) r2 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) timer_create(0x0, &(0x7f0000000080)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x1, &(0x7f0000000100)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, r3+30000000}}, 0x0) readv(r2, &(0x7f000058c000)=[{&(0x7f0000000240)=""/151, 0x282}], 0x10000000000001f4) socket(0x1000000000000010, 0x2, 0xc) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCMSET(r4, 0x5418, &(0x7f0000000000)) ioctl$TCSETS(r4, 0x40045431, &(0x7f0000000600)={0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x1, 0x2}) r5 = syz_open_pts(r4, 0x88802) ioctl$TIOCLINUX4(0xffffffffffffffff, 0x541c, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000300)) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0xfffffeec) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r7, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r5, 0x0, 0xff67) eventfd(0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, &(0x7f0000000200)={0x0, r8+30000000}, 0x0) vmsplice(r6, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) syz_genetlink_get_family_id$tipc2(0x0) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 19:18:00 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r0, &(0x7f0000007e00), 0x800000000000197, 0x0) r1 = dup2(r0, r0) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000000080), 0x4) 19:18:00 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) r2 = syz_open_dev$mice(&(0x7f0000000240)='/dev/input/mice\x00', 0x0, 0x10002) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r2, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x68, r3, 0x14, 0x70bd2b, 0x25dfdbfb, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0xdcb, @link='syz1\x00'}}}, [""]}, 0x68}, 0x1, 0x0, 0x0, 0x1}, 0x4004) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) r4 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x400, 0x0) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_LINK_STATS(r4, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80010800}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x28, r5, 0x800, 0x70bd25, 0x25dfdbfb, {{}, 0x0, 0xb, 0x0, {0xc, 0x14, 'syz0\x00'}}, ["", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4000}, 0x20000840) 19:18:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) getsockopt$IPT_SO_GET_INFO(r2, 0x0, 0x40, &(0x7f0000000040)={'filter\x00'}, &(0x7f00000000c0)=0x54) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') sendmsg$TIPC_NL_NET_GET(r2, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0xc00}, 0xc, &(0x7f0000000180)={&(0x7f0000000540)={0xc4, r3, 0x2, 0x70bd29, 0x25dfdbff, {}, [@TIPC_NLA_BEARER={0x14, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x81}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}]}, @TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x1000}]}, @TIPC_NLA_SOCK={0x1c, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x63}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4}]}, @TIPC_NLA_BEARER={0x74, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @broadcast}}, {0x14, 0x2, @in={0x2, 0x4e21, @empty}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @remote}}, {0x14, 0x2, @in={0x2, 0x4e20, @multicast2}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7fff}]}]}, 0xc4}}, 0x4000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) 19:18:00 executing program 3: r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r0, 0x0, 0x2000424, 0x1) write(r0, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) listxattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=""/29, 0x1d) [ 1042.120120] binder: 6871:6873 Release 1 refcount change on invalid ref 0 ret -22 [ 1042.130318] binder_alloc: binder_alloc_mmap_handler: 6871 20001000-20004000 already mapped failed -16 [ 1042.142388] binder: BINDER_SET_CONTEXT_MGR already set [ 1042.149699] binder: 6871:6873 ioctl 40046207 0 returned -16 19:18:01 executing program 3: r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r0, 0x0, 0x2000424, 0x1) write(r0, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) listxattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=""/29, 0x1d) 19:18:01 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000000)=""/11, 0xb) prctl$PR_SET_TIMERSLACK(0x1d, 0xffffffffffffff1b) prctl$PR_GET_TIMERSLACK(0x1e) syz_execute_func(&(0x7f0000000080)="3666440f9bf50f0145f341c3848f0f8021c4c3654c69000b3e0f1158101019c40f4ce02f662e66653e660f132704cd0f72e1930f2902") 19:18:01 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x40000, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'vlan0\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) readahead(r2, 0x800, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) r3 = openat$keychord(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/keychord\x00', 0x40300, 0x0) ioctl$EVIOCSKEYCODE_V2(r3, 0x40284504, &(0x7f0000000200)={0x4, 0xc, 0x7ff, 0x2, "7a9275d48bac96191d8a53b7a5c7503d8651a709a157d8ab1ebbdfa65eb4011c"}) r4 = open(&(0x7f0000000100)='./file0\x00', 0x141002, 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f00000000c0)='/dev/net/tun\x00', r4}, 0x10) ioctl$ASHMEM_SET_PROT_MASK(r4, 0x40087705, &(0x7f0000000180)={0x2, 0x138}) [ 1042.173306] binder_alloc: 6871: binder_alloc_buf, no vma [ 1042.179374] binder: 6871:6882 transaction failed 29189/-3, size 24-8 line 3255 [ 1042.224386] binder: send failed reply for transaction 1662 to 6871:6873 [ 1042.224435] binder: undelivered TRANSACTION_COMPLETE 19:18:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x101002, 0x0) setsockopt$inet_tcp_TLS_RX(r2, 0x6, 0x2, &(0x7f0000000040), 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) 19:18:01 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) ioctl$TIOCMSET(r1, 0x5418, &(0x7f0000000040)=0x2) fallocate(r1, 0x0, 0x2000424, 0x1) socket$nl_generic(0x10, 0x3, 0x10) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1042.224442] binder: undelivered TRANSACTION_ERROR: 29189 [ 1042.292149] binder: undelivered TRANSACTION_ERROR: 29189 19:18:01 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) r2 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x400) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)=r2) [ 1042.375390] binder: 6906:6909 Release 1 refcount change on invalid ref 0 ret -22 [ 1042.414833] binder_alloc: binder_alloc_mmap_handler: 6906 20001000-20004000 already mapped failed -16 [ 1042.448793] binder: BINDER_SET_CONTEXT_MGR already set [ 1042.448804] binder: 6906:6909 ioctl 40046207 0 returned -16 [ 1042.519610] binder_alloc: 6906: binder_alloc_buf, no vma [ 1042.540625] binder: 6906:6919 transaction failed 29189/-3, size 24-8 line 3255 [ 1042.557048] binder: undelivered TRANSACTION_ERROR: 29189 [ 1042.562981] binder: send failed reply for transaction 1667 to 6906:6909 [ 1042.584005] binder: undelivered TRANSACTION_COMPLETE [ 1042.593252] binder: undelivered TRANSACTION_ERROR: 29189 19:18:01 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r4, &(0x7f00000001c0), 0x7ba27d3a) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) ioctl$TIOCGPGRP(r2, 0x540f, &(0x7f0000000000)) 19:18:01 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) pipe(&(0x7f0000000040)={0xffffffffffffffff}) setsockopt$inet6_mtu(r2, 0x29, 0x17, &(0x7f00000000c0), 0x4) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:18:01 executing program 3: r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r0, 0x0, 0x2000424, 0x1) write(r0, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) listxattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=""/29, 0x1d) 19:18:01 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) write$binfmt_aout(r0, &(0x7f0000000180)={{0x1cf, 0x4, 0x2, 0x5, 0x3db, 0x8, 0x186}, "9b049be588234a6aa8aea0a67b2e422a57d8143d43407ed5bfb7f725c1363bff5b72c79257faaa94a6255a611570ab127279c7af58020a61fbb97f515c577baea09d20cdeab94b3eb01958eb52264b85053b42e282d78c36ad4b248f10f70bde3ba635bdeb10b27c63ee57e20db2791dabeab4ccf7531fa834c508c9a448871f23fbd10cee97f32a0aea1c54044db6b0c7c11f8c4b1e850383e1acdf"}, 0xbc) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) syz_open_dev$sndtimer(&(0x7f00000000c0)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) fsetxattr$security_selinux(r2, &(0x7f0000000100)='security.selinux\x00', &(0x7f0000000240)='system_u:object_r:systemd_passwd_agent_exec_t:s0\x00', 0x31, 0x2000000000003) 19:18:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x30000, 0x0) ioctl$KDENABIO(r2, 0x4b36) 19:18:01 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') fsetxattr$trusted_overlay_redirect(r3, &(0x7f0000000000)='trusted.overlay.redirect\x00', &(0x7f0000000100)='./file0\x00', 0x8, 0x2) write(r3, &(0x7f00000001c0), 0x7ba27d3a) read(r2, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:18:01 executing program 1: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) symlink(&(0x7f00000000c0)='.\x00', &(0x7f0000000140)='./file0/file0\x00') umount2(&(0x7f0000000340)='./file0/file0\x00', 0x0) [ 1043.090830] binder: 6940:6942 Release 1 refcount change on invalid ref 0 ret -22 [ 1043.109733] binder_alloc: binder_alloc_mmap_handler: 6940 20001000-20004000 already mapped failed -16 [ 1043.132773] binder: BINDER_SET_CONTEXT_MGR already set 19:18:02 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='fdinfo/4\x00') getsockopt$inet_mreqn(r2, 0x0, 0x27, &(0x7f00000000c0)={@broadcast, @empty}, &(0x7f0000000140)=0xc) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:18:02 executing program 1: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) symlink(&(0x7f00000000c0)='.\x00', &(0x7f0000000140)='./file0/file0\x00') umount2(&(0x7f0000000340)='./file0/file0\x00', 0x0) [ 1043.138497] binder: 6940:6942 ioctl 40046207 0 returned -16 [ 1043.144409] binder_alloc: 6940: binder_alloc_buf, no vma [ 1043.144441] binder: 6940:6950 transaction failed 29189/-3, size 24-8 line 3255 [ 1043.144749] binder: 6940:6950 Release 1 refcount change on invalid ref 0 ret -22 [ 1043.151986] binder: release 6940:6942 transaction 1672 out, still active 19:18:02 executing program 3: r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r0, 0x0, 0x2000424, 0x1) write(r0, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) listxattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=""/29, 0x1d) 19:18:02 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f0000000f00)="659bf8", 0xffffffffffffff2a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000100)={{{@in=@initdev, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@initdev}}, &(0x7f0000000200)=0xe8) getgroups(0x5, &(0x7f0000000240)=[0xee01, 0xee01, 0xee01, 0xffffffffffffffff, 0x0]) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000280)={0x0, 0x0}, &(0x7f00000002c0)=0xc) getresgid(&(0x7f0000000300)=0x0, &(0x7f0000000340), &(0x7f0000000380)) fstat(r0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r8 = socket$inet6(0xa, 0x80a, 0x800) fstat(r1, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@local, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in6=@local}}, &(0x7f00000005c0)=0xe8) setxattr(&(0x7f0000000900)='./file0\x00', &(0x7f0000000940)=@random={'user.', 'cpuseteth0vmnet1ppp0+\xd0system,,!proc,$\'}\x00'}, &(0x7f0000000980)='{\'wlan0', 0x7, 0x3) vmsplice(r1, &(0x7f0000000ec0)=[{&(0x7f0000000e00)="e81726d3585526a4010f4d47b531e53ffbd40e3e0fe59f71307fbb212c82693b4041e0665038e1748ba82f81b2875c54a238fe53ac0ce065dc0d6dbd4505b27cf85e16958ffed963ba683d6af6308eb8a8397b6e0c23437396e4847d1701a4fa59a35fd0709271787866bfee27a6ba7ea2d8a68fedb51fd08d99960c672570b152b81b84dd19d9036da326e535", 0x8d}], 0x1, 0x9) fsetxattr$security_capability(r8, &(0x7f0000000880)='security.capability\x00', &(0x7f00000008c0)=@v2={0x2000000, [{0x69de, 0x81}, {0x401, 0x400}]}, 0x14, 0x2) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000600)={0x0, 0x0, 0x0}, &(0x7f0000000640)=0xc) lstat(&(0x7f0000000680)='./file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000000740), &(0x7f0000000780), &(0x7f00000007c0)=0x0) fstat(r1, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0}) r15 = getegid() write$FUSE_DIRENTPLUS(r2, &(0x7f0000000a00)={0x3d8, 0x0, 0x4, [{{0x6, 0x0, 0x67, 0x9, 0xd7d1, 0x5, {0x6, 0x8, 0x6, 0x3, 0x5, 0xfffffffffffffff0, 0x2, 0x10001, 0x3, 0x6, 0x80, r3, r4, 0x3f, 0x3f}}, {0x3, 0x9, 0x7, 0x30, '{\'wlan0'}}, {{0x1, 0x1, 0x6, 0x1, 0x5, 0x0, {0x6, 0x8, 0x1, 0x5, 0x7, 0xfff, 0x9, 0x8, 0x3, 0xfffffffffffff001, 0x6, r5, r6, 0xffff}}, {0x0, 0x10001, 0x0, 0xfffffffffffffffb}}, {{0x4, 0x2, 0x7f, 0x0, 0xffff, 0xca, {0x0, 0x3, 0x94, 0x2, 0x9, 0x9, 0x2e44, 0x9, 0xffffffffffffe0ea, 0x6, 0x10001, r7, r9, 0x1, 0x80000001}}, {0x0, 0x5, 0xd, 0x912, '/dev/net/tun\x00'}}, {{0x6, 0x2, 0x3f, 0x6, 0x6, 0xff, {0x6, 0x8, 0x2, 0x1, 0x75, 0x3, 0x40008, 0x9000000000000, 0x2, 0xce, 0x7, r10, r11, 0x0, 0x5}}, {0x1, 0x0, 0x1, 0x2, ':'}}, {{0x4, 0x3, 0x7fffffff, 0x2545, 0x8001, 0x6, {0x5, 0x5, 0xf277, 0x9, 0xfffffffffffffffd, 0x100, 0xffffffffffffffff, 0x1, 0x7, 0x8, 0xfff, r12, r13, 0xfcf, 0x400}}, {0x6, 0x8001, 0xd, 0x3ff, '/dev/net/tun\x00'}}, {{0x3, 0x2, 0x9, 0x0, 0x2, 0x1, {0x5, 0x40, 0x2, 0x49, 0xe4b9, 0x7, 0x6748, 0x82b9, 0xdcf, 0x1, 0x7, r14, r15, 0x800, 0x8}}, {0x6, 0x3, 0x5, 0x6dd, 'nr0\x01\x00'}}]}, 0x3d8) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000040)=r1) [ 1043.151990] binder: unexpected work type, 4, not freed [ 1043.151992] binder: undelivered TRANSACTION_COMPLETE [ 1043.152129] binder: send failed reply for transaction 1672, target dead 19:18:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = accept4(0xffffffffffffff9c, 0x0, &(0x7f0000000000), 0xe08b00c4cc98aaee) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='clear_refs\x00') ioctl$KDSIGACCEPT(r3, 0x4b4e, 0x20) getsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000040), &(0x7f0000000080)=0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="000000830800000034e69615cf706f3ed5cbaab323c70f54cdd4570756b8e190f8608819749511b12a45198927bf401cd5018ecbcd85cb47fac1778d0947d577daabb71d66a998366eaf1b8d5492d60449c4bdcd89f2f75cf9"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) [ 1043.152237] binder: undelivered TRANSACTION_ERROR: 29189 19:18:02 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$FICLONERANGE(r3, 0x4020940d, &(0x7f0000000140)={r0, 0x0, 0x2, 0x10000, 0x1}) ioctl$sock_inet_SIOCSIFBRDADDR(r2, 0x891a, &(0x7f00000000c0)={'team0\x00', {0x2, 0x4e24, @broadcast}}) fallocate(r1, 0x0, 0x2000424, 0x1) socket$packet(0x11, 0x2, 0x300) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x301800, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) socket$nl_generic(0x10, 0x3, 0x10) r5 = getpgrp(0xffffffffffffffff) getpriority(0x0, r5) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:18:02 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000300)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) connect$inet6(r2, &(0x7f0000000080), 0x1c) r3 = dup2(r2, r2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x131f64) ioctl$BLKSECDISCARD(r1, 0x127d, 0x0) 19:18:02 executing program 3: r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r0, 0x0, 0x2000424, 0x1) write(r0, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000001000), 0xfec) listxattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=""/29, 0x1d) [ 1043.305511] binder: 6972:6973 Release 1 refcount change on invalid ref 0 ret -22 [ 1043.336570] binder_alloc: binder_alloc_mmap_handler: 6972 20001000-20004000 already mapped failed -16 19:18:02 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000000340)='*securityvboxnet0wlan1\xf0)cpuset*)-:-:\x00', 0x3) fallocate(r1, 0x20, 0x2000424, 0x2) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = creat(&(0x7f00000000c0)='./file0\x00', 0x20) ioctl$EVIOCGID(r2, 0x80084502, &(0x7f0000000140)=""/194) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TUNSETVNETLE(r0, 0x400454dc, &(0x7f0000000040)=0x1) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000002c0)={r2, 0x50, &(0x7f0000000240)}, 0x10) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1043.367785] binder: BINDER_SET_CONTEXT_MGR already set [ 1043.374245] binder: 6972:6973 ioctl 40046207 0 returned -16 [ 1043.390417] binder_alloc: 6972: binder_alloc_buf, no vma [ 1043.390437] binder: 6972:6988 transaction failed 29189/-3, size 24-8 line 3255 [ 1043.390583] binder: 6972:6980 Release 1 refcount change on invalid ref 0 ret -22 [ 1043.390770] binder: undelivered TRANSACTION_ERROR: 29189 [ 1043.390812] binder: send failed reply for transaction 1677 to 6972:6973 19:18:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000), 0xfffffffffffffdc2, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) [ 1043.390841] binder: undelivered TRANSACTION_COMPLETE [ 1043.390847] binder: undelivered TRANSACTION_ERROR: 29189 [ 1043.588065] binder: 6998:7000 unknown command 1818587951 [ 1043.609902] binder: 6998:7000 ioctl c0306201 20000440 returned -22 [ 1043.642693] binder: 6998:7002 Release 1 refcount change on invalid ref 0 ret -22 [ 1043.671723] binder_alloc: binder_alloc_mmap_handler: 6998 20001000-20004000 already mapped failed -16 [ 1043.685985] binder: BINDER_SET_CONTEXT_MGR already set [ 1043.685995] binder: 6998:7002 ioctl 40046207 0 returned -16 [ 1043.686076] binder: 6998:7002 unknown command 1818587951 [ 1043.686091] binder: 6998:7002 ioctl c0306201 20000440 returned -22 [ 1043.711498] binder: 6998:7003 Release 1 refcount change on invalid ref 0 ret -22 19:18:02 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) fsetxattr$trusted_overlay_upper(r1, &(0x7f0000000000)='trusted.overlay.upper\x00', &(0x7f0000000100)={0x0, 0xfb, 0xbb, 0x3, 0x4, "6815956efe9becaa1f864f07752e913c", "dd1e7db07b9c1c839d18a1245aeeda7fb1d8357df1a628aaaed7c40aa7da3565d9a37013735da3189a362ac843473570b7a849419747fd3d586a9fdac3b37cb20e7b1476723bbdb748904dec81516a338f17b8217c3e79a4ba658a8eaec051bd9302a3c0d14f6f494abebe59783eec5f9a1b5751dac0bb04c66bce31f27e61d2463f0de58cb0c91abf2e4446e54c244494a246ef9f664fd7b9f862ef26c0bd13c9856e2f1590"}, 0xbb, 0x2) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r3, &(0x7f00000001c0), 0x7ba27d3a) read(r2, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:18:02 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x0) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) timer_create(0x4, &(0x7f00000000c0)={0x0, 0x2, 0x2, @thr={&(0x7f0000000040)="8972e0da6bf27d39059fd8581a", &(0x7f0000000140)="9cd6f6badd90f2e1e0465203f13f2deeec632b88541777ef7cbbf706925ab444613aeadca6b0f06f4530d4c4af8ee06742545e3b5f4888cd4a352517e7684aeaaa57a0330f11511e4ca3d4443ef63dfc4732e499819c3b447838bd390542ac6fd56a050dcb5b64e15353304394a18673b50584ca0c7e3cbb81e7c10722b95bc1c467a9a8cf6042c7d2c16292080a26838f24c02f65f5920382776de841f846c05e53d3454159b3b604b44bf72744c9ce9c9e38fdf59db383856736317b7591a85fd74cd20cadb15ec8a39daeb55aa9a07b784b1b01"}}, &(0x7f0000000240)=0x0) timer_getoverrun(r2) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$sock_linger(r3, 0x1, 0xd, &(0x7f0000000280)={0x1, 0x9}, 0x8) 19:18:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) 19:18:02 executing program 3: r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r0, 0x0, 0x2000424, 0x1) write(r0, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000001000), 0xfec) listxattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=""/29, 0x1d) 19:18:02 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0) ioctl$UI_SET_MSCBIT(r2, 0x40045568, 0x19) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$f2fs(&(0x7f00000000c0)='f2fs\x00', &(0x7f0000000140)='./file0\x00', 0x1, 0x4, &(0x7f0000000300)=[{&(0x7f0000002000)="92aeff21ef585db361bc5df4cabeca899ff68166748d603f5595eaf8f6ceba0e3a35da7007eeff937b0958eb9951df230c2b1b34b223d62c599204b8290f33a646a303531d58fd847fbe5a9f27a147dac840bd3cefa253fbcbf5225eac2fec66469352d6de02813808fb0b30a036c4720352e1b28adbf55eac2455130eae49849ef7394bc8945f231a26131304e9bfa1435bb9c3835e67222ef4e9d306dea6f871b8b9b9d18c84ec43a6d28fe6521cfb72fc1f773103ad47926e2dbdfc3c4780f6aff53a441b005df690da6300e64c908c9b6b2bc610849ea5a2271f8a4736c6176def08805ea017ec5e3fdaed73b34e714db3f6d617ffe1a06829864e6fb59f94ae63f0c6aae3e583191c571350f3b6b30b14be1016fe173104940484b874ea5a2c901872dbb3d0f1a84d067dd3e79411a7d900563c3b3753e694d641d02e78f4a854476f7062830c5b008ef4678fb77090568efa2c4200a8b82c778e8f3c40a613c4b9aab6173e47e164cadb237f5e173450814a8c7ecff18a10cda994483d32a7880d93110efaca8352d6356ea6084955e3ac6fd06f9b7ad0833c2806c6ca9256ba5cd71d59a78003620fcb3385652e8e02fd83bc8a7526cd299648dc3fc17a14aaa1289930020ef3b836bc8c8d0f7f357c20341f9518617dd16468c264a650984374df84b020fb4af67b7a49abb75faff1f5cb2c135fd3557239a1c341ae5e9b3701733869723a4f2657e82ef4341513d1516eba65327f06b3b36cc2680378af5072bb5268fe06513b2e2d6a6a06ccf5efa9b3d74c1ab1b6ff32baf2e27adfca13f9ceaa24fb275ec6f7689df146f660f1e829b1f922fd059ee1ef39a2226570b145e758dfa4bc06adf6355819dc37287939470af56cd431da5a999631b994f2a5586f4a20fad94976aa1f89b755694ddc3a306a3d688dcf3c7ce66914edab4ca801056d54ee5ad470abde6fe08f0b5092aafe2b19259da2610f3fb89accf88165e1ff04f5927031fdcacc0c4e42135bc7357d1ef8dd266406c7e406102b07b98144b59343af3e7591d54d2863a8020a5cc7d246a7df15e51efd5a21421d6f1869c28250185605a6e5598cbdbfb4ab7e136805217ffbe1680c239330afeae30b4d166d6f175cc25a6ab39ab852f49ee4db178340f00da12d71c67564318274bbfe700754ee3879f091eda56d4053c892c1e910cd8cc56451e515671d3c85f55a50b7920c977c3b195db231e3f0562d7a2fc15ce57011a9500a31aeaa437409c740eb15fbdbe7142238572e802b42606df2fb95ab8173e06e1fb77b4e01acfdbe954cab92ee4ac38e5d30e37620847d01daa32d476dfca7864bfe3b1aaf86a2d0093c6016696007026d3d32be16b2004902af6d7ed4e61d81ffa75e154a81ea9b695b468b18c361793a3b358b0f5981ea65f015242fbd80c2b1b9dc13f2f6febd6634e42cee27e277f4e931df8670ac7215ec7f0cc63f242f3c2d35cb7f3ac955203c0236238def999ec9b021402e20602b8136028879da93bed276fe5fa28de258bb9b3361ec5897a9eb10211b903165b1ca9c1ab3c18eeb2a32b1e61b9fefff9435217a40c7148ba8cd435c515298c6acbf71f83e1683eecdc9759ae668067eeceb13c4e47663e47f389c19b10f69f870f3c361158d9d1454f24911fb0a0d7367c1a5b9a7a9d1a76687546c94f80ceea6befda4b5eb4f616f4d6a869985f52e47c1fb0dec2903557d815754f7e6af1b0a514756823e92e15d06d46378aaa4a5a272f98d78ad30932b1e30156bb4cfc6d69ac684f3a6929df521a54978baa62aec6a5d69138a92f06d9029bca2fe469167655ffd518cca438634a2ccab7ff2125315f0749e367122fa093a830e9396908a9d5afa1349f2f56183d0c04d47e7a1a4e01579b1c6ee6b690bfadaa762aceaa92b01431277d17695030c523f8ba99a28331ab571b8687444b7f0719bc71e02689956a176212f21ae3cfdf346345ee6dd192f89550070eea26781c78f854de2956f2b04d285a4d4abf59dcd9b25cb67687747b19a8e7d2f02f9608964c49cce5c788f327f0bfbb6bccda491f28a525da639ca9421f005ac14a1305adcc7ff24f0a4a76c1f957a0e862c2c9ac800aeef071f4c233e9760cb388b87ffa6d81897a1371e7b00591c504ba76c32c168726412822db4cfb634f0cdd897c5cef5bc81cd1ab2cb66bb10deefa8abd94345ce50cec87bc95e588e3781b9f3b87eacc8f4c2c093c55bbcb870c9581e8504f92effecd12973bd74c22d31960edf1ace324d92ba0545373288a024451fedd0a51f131e8d57f06bf4efc660c7e293c3ecfdbf86a73fe1f495e8a4a17a836fac641c3e3e6ad0792f65bbceea5e5d3d2167948a68131bb7022f942ec01866e16a1c67a59d31a28df02a1d4dc0bb16b85dcd8a7d320592fb732979a861b4e07c2954c430047ef3cff99396a483002af6e48b51fe1d183209aaa4ded276893b17c3e245ec1004698ce2827af9462245ddaa32f91ee3ca8162b0dcacb4bd819c8209b34c7f5947f1c525d10182d8a014012ace5719220f27e2a01f18a43e385e314bc3240443c9279ff469108e5f47fda2c0f261d8a1151efe07f13aeb3e551c6b6323526a67bc4e0c728c4fe48efa6e8939d4bf059ab2561c195011b84ed6e0879ac0f81eb8ef2319cfc923f6304e02c2eb173787787e8aa97c353876fb02938e12b5fe51d4771cde1765b7e2addcfd920242f5a7dc9965e3c3215a1c52ba1fab850908396b7e8ccd7ef09afe3abbf30e43170710d09f75b504c1a1b350cc0e56430767b3b04cbb03b4db9dbe5f52267b4347572cca5a1f69f128b445e081f3712a42712e184da187091b92803af750cb9c10c5db5b3c083b12875726efe3efe102769a61962a7c1cf02e0bafae1d0b0146a682a9f8e87970d12187bd507d31068b7c2cfe52eda448d2a5cc2c466f923bf84be814a8ea3547356f7896ba8ce2c5a26ee169f8ee395c9667bc7277c554c3447bbaf4a285384e658fdc9b8bfb2c30f2ab38d288c76726d34e40df90e69bae7c5641c6386bbb8ad4e0a7129fdc274507ba67054ff447e9020a6dba2feebb123bdaaac112683d789ad0d6813bcc61028b3142e179050c2358864e8bb3619a3979b7579af370c3c3ff0791bf4459a9c4b3622a269d278fe0aaf388017b335fd14241c6ee5bf02eaf999c7f3f38e3c1d2df5f8596979ad44ecfacf79fa43ebf15d8bfccda413304a3b69e4a5399a0d9bbe804b5620dfec9f86530d417e2059c4dae8df3cc672825ef456ad76c648e9934560ad68627ebb8720468c50bbe7a731691dd7b491684f64fedb17842b68286551e3d37f918117718c9af69beb900698cf89b8dc4347a50ea39431c7af414475e7690fb133b934b5e206611b43b9ffc56fe4ac45be2afa90745ebf37e17ef17e772a15a848f600bb0f4e46e07599c7ee8376993081b6ef24fda3cf6ab0f4c5a1e358d45117d6075b004eab4647ba9559bd64b37dc93d0222573693e9d6293e834fa72d5108a1789938d22fdc20d461c95dbebeaa3a428d10c16e26983040ec1728741939b6678cf4515517f2d1b3675c314d507622ffc7e977029c94a59c3e9441fe0f93758ce018394519d840f8daf1cd2ef14850182b3ceba07e424e4f05ce0551540a419222cd9cbe22937be8a0adc7bad37a1e14754a99bb8ada68db2eb9e59030b9396b70b006a8032b23a074d2365e3199335204c8a9f21d658a2a9e16c0392fd23efb096411844f2ca9700158e04f939f3fcb5031d7fa82461316da688d32b48174986f77cad121739edaa2b0f335bb5036fc5a7401f6c7b29933c62215619d28bf654cb88b796af6d70640f9f9aef81e797b5afdb3fe1854060a8d947470f1dbfa3fbf6f574b449ce83fe42658a3b380d7c45a15d7435359d9e358b234f42f03997ec11d317849d9971c020fd4c3102a504a3f06a16ebd2baf97d3800f557b681673b20d61dbeb57cabf4fd63fb767beda81c92018a2510e1deb951627ffc15b2ad91635dc142085f5844c29e221b049b9447d2c5764b21611a805cea3c0143ce3cb5962456935851e44cc8c35d26de4cc79b5bc29fb5d4cc5313c235271b452692ff19b2bb7338b85e3ef78ff9f65e644b15a0dbabf0b0575931356c99db7f61deb528078544b4e3dca58338654f745e9b3fd5e52d2654cebb74ff494d6a54ce14e7de71f0882b3429fdc85abce4de0605473e04ccd310a381b8c286309603bd7ae313cf425096c1df5dffd8910b6bff6e4d023ce0673360be9be5b506e5bfc86e87f59542e33c8f391c1dc38ce24a0ba88a3bec100d2face5ccdf558a92427f057953f554ca504e634f180f4b2c334a51896093405b5b17109428f7d5d187060532b01f2488e71e28fa4e2c4e69a0bada7f9e79402bc50d6e1ab649dfb5b76a13648ce717f6783d988f4471bf446373cbba4c064d1fddb214ce90e7a4575d361bc91eef133c39e359022f94253ba147a845cdd3b99f981ca8ba1f4ca53a9b778778ef6bbdd5276fe1630eb019d17c61a9335fc4c032ea4196c743dd3c71e30b16a740406560d88fd50897652c66fe8aef61717d92c6e1cdde0a69cbecba07ceb69c885748be9da8a49747c67f6a89ff737e00937866b2c82e86e5d303da23b48666c9b04ef8a0210ae9aa1810bce82f8e15c81502bd0ccfcb9c3d74dd5f6d41607313f283bf7ba011f46c79450c7ada35b45492d6da0ab0f63d965f1f69ebd745487ed548892adf1652fab2320edf034ca690245459258553b31e9d6e3ea237a6ec52b5feddc437cd8e17037ae25abb0d04cea2d2e9b072bad19039c875c5cbaeeb906ac5039b89a612328c5e1f440653adcaa915231e189daa65af913bee4ed90ca38f16c2fef1616b594168a9d62fbe593d66b7df3741ef3e4d4bb25d9fb8163f57b5581884cf8e5e8ba1031abdaba7716ae0f53a2c2ca2973ebf80718c908908132cf1cb7f3f0cd59a63c24b1f53e357773447f916f6dad903e1a1ffcb68b49c8585d72c4a8e6db2be4b227838bef45c4cf7d6a3c65b960a32f883658afc166c87b99e2df236cd94f6fa58bb6573889f77dfc59463fd59d37b9c1048caf5bd498496e36d9cea0df515286b8a685a2548845f3c7beae97afb080197f2d64d8a413cd20891e95fa27177ab7fb94a4ac2e1d962c32d8aaa04ace4a295bd615f3461fa236d233714c1d3e0db65fcc016540f7fd1c5211bac1ece09075de5254a3803cdee32fd424612ebd6b31832f5c9ce7786e3badbd06c0b17b439f61f13ea944b40545c2f1ccfd134b00d8f16d06b736246a5d536cb999d1f462ff86151d974c6617d1d2f1e852fd22c64fb22b935d656dccdcb8ae727fa2b223f9e5dc2a6cbd3c235096f69f759e98a1db21e60759c136046b8c26de156b08ffabc06834e66349db157af329b642d705f5e82ef795d88ea19807ffbd141365fe3b4608a1b0f11f6c09e633d0794a19afb0699473d73bedcfcfd9535ca70f3c818038e3eefc0eff8d357dc9df5d2251419bd8021646352573f901460b4fcdfe6540aedfaaabed5d45c223ece9b9f702629ae1098961389f4d0fd77d42e525832ff4551d4055ed3e4c85af00031fe19813b163ce871f0c8282248578395fa318844f2bb6a9bb5202d84c17f139efb221a2f1b50da21ef62ee133e0da1d7a0616d798354e17f5704cc0ba970c071abcfaba44f3d67a4863f6f77a13b48bb2f9581bd9fe971924279e6f290ca7b4992536d8ae8748d80ff0939791540b05936a7343c7a52", 0x1000, 0x3}, {&(0x7f0000000180)="3c91fc40e15192157ab12bc0d01593eb84dbd533a3edf1d1eb12798271b4dbe4ffbf08a7db9a222ed4b46e7387453eb9b45917e097823cfbd202fcdaf943b3284824a27d2f3feb903b4d324b0de6ce761e383300051d987f487d38d1ea0bf5", 0x5f, 0x101}, {&(0x7f0000000200)="6f61834936b49af0853b286f1a0c3672", 0x10, 0x100000001}, {&(0x7f0000000240)="62e22467819e8aadabf94de332204445d97a2d071a192eec8a73b32d9b30b331b7260771dc08fe3c062c7d8f83f0b24b29174ae0c4b0ed7caf0f82e9855b37762263aa813dd375436b368ed7d5922cc51cde3fb4d7098a7587a0a7542da175e3825aa606499aef94b23f09c85da1cd61378760478d63a9fc5f21cb405e96a9310f818de6b5c4524bbe4ad9fb9a9eee2ad62f1b861149f36653", 0x99, 0x8}], 0x200088, &(0x7f0000000380)={[{@prjquota={'prjquota', 0x3d, '/selinux/mls\x00'}}, {@noinline_dentry='noinline_dentry'}, {@jqfmt_vfsv0='jqfmt=vfsv0'}, {@two_active_logs='active_logs=2'}, {@alloc_mode_def='alloc_mode=default'}, {@alloc_mode_def='alloc_mode=default'}, {@grpquota={'grpquota', 0x3d, 'nr0\x01\x00'}}, {@noflush_merge='noflush_merge'}, {@six_active_logs='active_logs=6'}], [{@fsmagic={'fsmagic', 0x3d, 0x7f}}, {@appraise='appraise'}, {@pcr={'pcr', 0x3d, 0x2d}}]}) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)=r2) [ 1043.939113] binder: 7010:7012 Release 1 refcount change on invalid ref 0 ret -22 [ 1043.969707] binder_alloc: binder_alloc_mmap_handler: 7010 20001000-20004000 already mapped failed -16 19:18:02 executing program 3: r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r0, 0x0, 0x2000424, 0x1) write(r0, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000001000), 0xfec) listxattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=""/29, 0x1d) [ 1043.979907] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0xfef6f213) [ 1043.979921] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 1043.980063] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0) 19:18:02 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000000180)=0x3, 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:18:02 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0}, &(0x7f0000000140)=0xc) r3 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/avc/hash_stats\x00', 0x0, 0x0) prctl$PR_GET_TIMERSLACK(0x1e) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r3, 0x6, 0x21, &(0x7f0000000240)="842dc89d6ce846b68afde13bac9f4220", 0x10) fstat(r1, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchownat(r0, &(0x7f0000000040)='./file0\x00', r2, r4, 0x1400) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1043.980068] F2FS-fs (loop5): Can't find valid F2FS filesystem in 2th superblock [ 1043.980110] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0xfef6f213) [ 1043.980114] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 1043.980120] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 1043.980125] F2FS-fs (loop5): Can't find valid F2FS filesystem in 2th superblock [ 1044.005770] binder: BINDER_SET_CONTEXT_MGR already set [ 1044.005779] binder: 7010:7012 ioctl 40046207 0 returned -16 [ 1044.146417] binder_alloc: 7010: binder_alloc_buf, no vma [ 1044.152165] binder: 7010:7038 transaction failed 29189/-3, size 24-8 line 3255 [ 1044.165879] binder: undelivered TRANSACTION_ERROR: 29189 [ 1044.171716] binder: send failed reply for transaction 1683 to 7010:7012 [ 1044.201024] binder: undelivered TRANSACTION_COMPLETE [ 1044.223803] binder: undelivered TRANSACTION_ERROR: 29189 19:18:03 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000300)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) connect$inet6(r2, &(0x7f0000000080), 0x1c) r3 = dup2(r2, r2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x131f64) ioctl$BLKSECDISCARD(r1, 0x127d, 0x0) 19:18:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) 19:18:03 executing program 0: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x400, 0x0) accept$unix(r0, &(0x7f0000000140), &(0x7f00000000c0)=0x6e) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r2 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r2, 0x0, 0x2000424, 0x1) write(r2, &(0x7f0000000240)="e26737f525ca4794202b4cd1", 0xfffffffffffffcc4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r2, r2, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x400454d1, &(0x7f0000000080)) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 19:18:03 executing program 3: r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r0, 0x0, 0x2000424, 0x1) write(r0, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) listxattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=""/29, 0x1d) [ 1044.363295] binder: 7048:7053 Release 1 refcount change on invalid ref 0 ret -22 [ 1044.377106] binder_alloc: binder_alloc_mmap_handler: 7048 20001000-20004000 already mapped failed -16 [ 1044.388888] binder: BINDER_SET_CONTEXT_MGR already set [ 1044.395163] binder: 7048:7053 ioctl 40046207 0 returned -16 [ 1044.404446] binder_alloc: 7048: binder_alloc_buf, no vma [ 1044.404467] binder: 7048:7058 transaction failed 29189/-3, size 24-8 line 3255 [ 1044.404816] binder: undelivered TRANSACTION_ERROR: 29189 [ 1044.404861] binder: send failed reply for transaction 1688 to 7048:7053 [ 1044.404895] binder: undelivered TRANSACTION_COMPLETE [ 1044.404901] binder: undelivered TRANSACTION_ERROR: 29189 19:18:03 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x4000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) ioctl$BLKROGET(r2, 0x125e, &(0x7f0000000000)) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r4, &(0x7f00000001c0), 0xcdfcb08) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) 19:18:03 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) io_setup(0x9, &(0x7f0000000040)=0x0) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/net/pfkey\x00', 0x80, 0x0) r3 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000480)='/selinux/mls\x00', 0x0, 0x0) r4 = eventfd2(0xffff, 0x80000) io_submit(r1, 0x4, &(0x7f0000000600)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0xd, 0x800, r0, &(0x7f0000000240)="b6ebdc2b6ba856e393a77cecc5daf35bb84ef81c36edc9db3c7c0b30cf4397ad3c94e3765da7242313da1edad0e69ba5040029a7b11f80ee683749785b86adf7e327fe6a4af84a136e2b63256393a03709158b13c6aeb33120cdd57b846a59ed243933092c8ddb35d6d0b6d70efbb22e93030ed3f0656b40ebc40c3b84c3262bbf571e31826975019a04fdff0d2f3dbae8115904a0e009c810fafa7a457cacf72e78e2c80f36adf06dee92a6cac9306cd3af3eb4cd65264c483674c08816b8a28cf5feb4b2eea3c483384bf6ddd34a34b62a2dd3b30946d71c80a26d2b72c7cbb154e5528f0b68ee2d11ca234a2f63d1380e92d662d376ab1738", 0xfa, 0xfff, 0x0, 0x0, r2}, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x6, r0, &(0x7f0000002000)="f8a67836a43eeeafefd5bb6b8109c3b65bc0a9d3cd3c2cdd64c691c5b10a476643eb736e2cbdaba61230453d8d65256db54e2d425f2087fee28a567f51127fbb1de2ebe938262c17f18ce996b93a6a91b2a3f11fc44e74cc8c54bd600048869c26c41629be876483a409fd074d6df19a8b2719666bec235d78de78ff30b513f17842b7811d5bb3f70e85b5a50d50c3032848132e445bcb53fe728791649035741ccf75edb1a42f9205c31d497907065069f008f9ddeb786ef25c40e0c96cfb441887e65968585dc6e489bb8c4f96647d7e4c08d4402706a1bf4f8dede4f8670c8d6c876e6394b4df4ce3d1eb544f14c40d4d9f21f6263ebd76c3e8aab0fd85a6a282d21f7ce0c2edf0a1113f4f25a3bea8098b4bed35b0451eab3b4c80630cd88f6b8024cfb6b5fcf2916fc7daecbc0441e30c8af650957da7ebdfd57fbc0c05998da485bf901a3eeabeb5c228a8f513639acfb1c32c82e566e9a91f838216a60dbdd3c1625cfcb16070cb1a08256b9976449fe60f5a2c6983ceb0ae26cd5c5ad1d5a075ec18e407857748c2f87ac9821cdc671b15bd92bc0d99997b54c081e4d1fdc397999d48f08d327bb31f40c60c44d2a684e964d2c29514970dafe547f214762b8cbc031738c6118dc24a3f6d96481587f388a51345d73e8d5b6c585e757778c64d51ed1f3519a1189c2392e9d5fa1f1351379401888f8b989e507a9b5dfb820d2737afc8cbb274779a9954c109deee79b0f2c71579181e75c44996fdc03f4a77b6beb401619904feca58e85139e95a8fca543287ee0a8467d19b5098d33c35f2ee7b3f2e70db1e2ce1f2269489756500864fd2010c47d3c86efd9a09eebadbd073efb2db71bb21542a2846397167b691a1fe8f396077f2357c24508caf84e9b3cca4bb013f99c80b3e144c3b11a8ff1700957417c691dcf69ad57735e66408c5a04242d58449f63052b6be523487c31c88e60d6ad5444a937cfba5dcedd05bfb650b4ee777cb931be57ba17fd3192edd9779e06190163e11be785d30e5d80097a44e3c9d22ca8de49aab305c86bd8ba70ba81d401da7a0337d2d590605a46f0dc4f66626074cacd411a657cb054d047bea13b01ebb27f25441069599da90c447e1094f8df902d3aac55aae137b0c471fb7dec455c0b127f1e3c3c0f4dea671c8f25f0812d4d1dc70bc20b015a620dc57e915bafca533c4c9dddf78cc370c48847c6612c0f2ae59131894a158b1f84527bea8a0f8fa1df66ed48e341fc8dce7db6157b48b2bf2e6ba1069e154cd929073aa1c3938a92b799e8bfa2051d49f4d85d790b0b20285479e1e42cb8b998033b989ccc4273b6df215b3d4cc655ff25a857fe5e2becb4510649ba1673e533270420abf38b76a457c4242b2d7fb51a8b9a3c9b05de7e7075f00093841e04dc2401bad62e1f8aabc6409385b2d142d83812340a9f00dce4f235452bdf4654bd74af3f728c929bc1be3ba84f6ee49df7b799137ee2be8e4cdb5b59f81742be2ef17b8d0861c9465388f2e161db9238bf4d39471a4fdf96e62cac41575ac96effeb9c3ff866190a15f697bc037bb0d11282e038f98dd85af19aa5e6231a082ab2585f976437b8bd811231e5cae916197fc6ffce572a90192ff1bc1c7bddf6e09226bb22f93dea296b05ab7566002b49003857fefea4ba914c7575a91b18eaac7399fd4d5aa92bcfad54eb59cb94cb9457451a7a93ba836e25cc21d3efa0e3ecd1684fc830e1e4336be7b8c89eb2d16c33de53ce6c5c077513351ba568eede8a451c0ba383ec72479c3fdfad5816e28445587e15def376542a1ecb6bff7ad619cf1a00a094e13c55218e2a050f899e136a6d2afff450f40f44f36c8352576c1630d58110a1750bbff22de732efdb25a04e287bc060c243e5ff21c2ada477a40e0169bde3d8ee51ba10f9547f16e7cb23a5e0c7dba66ad68dc4d347b211802c15b15a3181740b699ada16eec65f7cb7a12706d6602c6d1758eacbbe9780bc20d6edf1b27daaac869b3b9f0ff8487b2bd147aea5e1138a5b374732016d80676a8d56c5a6e94aae6f0dcd890353a0a7ec6b610be1c3be76a856b53e8664a3d12fdb28b9b0f4f4a33a253d8cb96ab731ad61bb4f1e553379a4a351d788bf56a3ffaa954b0905820fe6aa2cad2dcb576e0c288f2d7984ae9f1caaac0611c3ca00c07a8780f10ae221672d234b7a08b8c5d0c54f7761fefec0ddf0b627d7e41b737ec13a6e9dd6f37fc7a867091797b0c20c76a1db122c168ff37c25f22e7ac6fddff1c45fe351ee705cefac3fc5585075ba8c46239dc882e9cb36bc563e804e6d3c789855203a6838f6983c007b8720f62e23cd4a7db0643299a6662570d6dda22ad6a2a283ded1f5b36ae1edbd206322f4d0141738ccbd8a437cc7d7d0574311da1bbcd3eeae473c84612deeee14d941387d00370ea07722f95098737f267da8c29eb3c09355fb77342968f714515db9faaf922878182f94bc5a16f9a92548ae123f98767217832da31fb90d5cfecf71fd0fe2ed4a07aa3ca1231fa25638e4421a7fc27c6ac42dda6eb9ff876fdd6885a527bfa1fb94c5658f9cf9452f59b99cb2a22d8f3f92e0d30449d87ef076a6fcdfb29f9e2d0a230af4dadd82be70769f5c4192bd7ea61898c78fac059f8681a982155a4265b25554c476fe67abc4d3369f799646c432a9bf3eecc4e65b3e19ec80a6e5c355248b5c484b9ba893ddde8d1c5f095e6b2f356fe28bd44d6860a2034268ff2e72f49115dbb29ca48b51981730f639d20b11bb1f4454761c56f74f0e35800c74bf85191dba594475910f950556f9d731c882abd0cdc3777749dea32559f9958a30cfb312c02ef5178ea51d7e80d89154a622b4b63ff7f926f1f1a0648f59ee3e579591ee54ea41ba6add562a0f53d599c684a6093a7ebc12f5f6e0c0ad7b7ba440193ac62113f885fc03be8860ddd17096f037ff9acd19a2bfe68b570e7df14bd4631c85866611613e571aa6a774fda893bf0a19a52187fb4e05ee72c7db6f0c322d3525336395cdd96997521419a65b4d47e3cc71f7c27870548aa3fbeee0f835b2f387bff5149cca76b188bdbb05739a589442f4bf44a330549feb03ce3a1b7a71af28dc188df2c82f5e720516c8e2805164ee0587e2520cebd742937719c79a8dfb7645f0baa4aca5648b86dde53caf17ce0fb5f669cffcb205c329144444f23cb5458723f8f85e2770ddfc0cac296902b5767da20ca247f1d8025ea4ffca2153bcf822f7dfd98e35038a804c3ddcecaec2265f82c93fcf441e9ea70f8ad43a3db7af69d2e22b4973afa36f614c1efa3b807eff9a0b1ce759cda92803065988c684f459a1c6c2d80894ad9696e463536780bfa53f637e5ffdd907a68a5247b03dfbbb3cb4c3de343247f8f28a57d9c06ff793ef32faf5ab31ff3c89c3bba1f002bd63597b4cf1c229f14d46296e208b169607c1886405037163814b5d59328dbd53892dd2320323a6e3ec2c967ba8c1831a76b8881e1d8959c8e0976f592e94d5a6396503ff9e16d01266cc29bdedfa444d2a530ad705e2b681e5226c913a513a74065b419efd9ddb4f22223262af6427ac97c15b716158f02ac346fb3b1f1dfa2891291a5697f3d009090888770adbdc72f15c990426c0cd43490a8cb0fd51f5cc7c8f93f86a3f644975887e415366e61e7572e15a2c09fc9909acf4eb7ceebd5e509de4b189c1f4d84e71b967ac7c4d7cb4fc52c8b8b4886d140774d54bf8f545e599f6f9ce4ba627d85b8c1428dc66473629f8d7c9d524f2f5747e3e97e30b3628a7d7c8f70959ca501a6b44429238024820731dfcd85d70ffbb37754283a7ac1c6de2e9925c2e180af63905ecf197c6f8bab5dd80091229bbc79b92bdc5f6b84dda4e45f78710bbdcfa3dcaa67678922831277c6ff2a1741e55bd11f390fdcbfd2f67a7a17c943f4fa037e02b82e58d68c5aff4df522db652e05c4ded11134088a05f5e4980b7722fda0fddbb6072e82e191b6c6383cb229c7022501188d752b8e2074da0cc3548ca16efb9601520057262e963f51c45277289ccc333801c2ba5a97bd9a8437aca8516491e547fa423cc02aa96f97b9a0726f3718389002945afaccc2c56edc802ed504551b1eabb1b95686326b9126a34ced7e6505e668405b1090c14213d74d85256c08d38d3737a25b2b2f4b040c6f2f26310b4dd19173c6bf9f735f5f57cfb07969faac8aa1457515bc15139902535ce955870b62aed4303bd7e9411b2511b1c361f65631dbd9a9780d543e139765d35a0a5dfbaa933ebeb937e193e89e3eeca47b3ddad1a26f58d85937cbb12e0257a9cf96a6de8e67ebb4af7a318864619e2f95c050f702b89f900ce7ce7935998199f232e729116bc4d2208a98343a631eec63e005a55d601a5c3c91d30575e1a7b36b82a0a9a893650c401e701c06b6759b4fc6c275b2cb3fd012add32a87e4e018041683c4ea8355cd669328ac984a30fbf6a7c6f65732a9238b0e2fd1431111d7a1132b3b7a7279b3960cd662d6bdfcd4d1949c7448509889253382e2dd68e7557423d7be621d4181a643cb6b5191574abcabd312a85dc28bec2afea7e6281028c6bdb93cdfff9f148459f9cefb7fd914ab9814d2c72136cfc95486936a5468f8a74b7586e43d6427f59cc4d3af3c667a0f4f871e2bb7c1c5eb17ae19c0ae3aa01bd066144b64363606f25c8d93afb2bb392d65c05bfef29611877ac2aaff1d17e9c19cb062879644756b5f3f84f36825759d9a4fb234eed749e78ac24c7b487abe821915811d3211d7b6a89d4969dbaa326e3bcf027f1fbf0b8d1392f76be47a602e98d4aaba5544c5f646dea2aae28015e0cc8bf36c65e6842ccc655ec1123221f7c0536b83c1ca98661bf226cfb280d238147d3cd299a84ad55e9bb54ee699a004cc9d3602ab2f47c0b8ba8e86b94ce7596bd1019fdd6b2b15db850bc3018f63f43bd6a602588e4eb199db2715fe147de2dc64ed99552547f0ea2071486d577ab07e7d132231c7910c685ee0f07ad4017ad8adbe87998f5640a1d143de6298865d201991f27660394a7706e97128a39ac85a075ac179f24b1a8c5fe0ef980843459014948c3aca7f52a2a0d45bc37f0e3ff278890b00a398b37ef6a5584d738270482d8d71ee26b8ddd02901381fc4b89853bc85daf58b49a267d7a0a112aa40d94dca37ed33ce393d1577f4969a7a3bb1259b8c494b622b946f7b782343d5b3fc09def6b83f85711d6006c97dae7512279c1eb386dffd5b6c6c90d3cd831e0373e2bd10a1ded9c7baf264512ae93660637a7f6876d2bddd1aea409e6f9ebe626a1e5554576d44fe53c173cf3bbff7362aea92084f26e39d7d82dcec39eca028a91e56d7674deb321e52c1de6e1d3eeb1624c6ceabac57fb14ee46c6c845eef8d8393bcaff093fd322abf2639b291e43596fc876547e638b38f25d2ef99aef6154043a06f9d5fe4c45e888deb90443a058185735ca5c031f06e60cf43c546aca83c6d7b6ee33f5405d872e320cd25dc20a8f73e54e36d93d67f690d73bd93a941ead9f20bb11fc7ea530fb86525d4cd8a699a9c82a834555b400c07712ad843bd7618823228dc0ce8ad4f46fe148b8724e4bbc12e58f886dfbe0ac8111f86cf82c3c1e3be698b7b30409b6faaf77b58c3e43e43c2f61ea67da4dead036a54965f837243abebb98b423f98cea80efb39e2ff512c2b93df170cbb92035e16ee0eff77d5615c91abf4ab86fa8ac9fb9bfd83d265a29711097c190b9080fc407be43b8", 0x1000, 0x80008000000, 0x0, 0x0, r4}, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x5, 0x9, r0, &(0x7f0000000380)="cee2cc1424131a732d0e18d23db9f2d35c1e1cee37655ad14b117ff31fd62b796791ee108865c6fd6e1155e4a331845f4f7d8a35e12ecb0d95a458bae32321665caf7024b46de00200df7302ef2607609aae5c160a0511ea1e5ba19268ba2d3502f50397f854d41b3a91bcc32e50eb9423c526744c80794cbc54cb29ba7bd92d000b48663d24e1e5a1d6b0044ce8c2f83171e1591bdba9570c59b88eda087ad16ffd9b277c5241806bb1e0fa8b94c36e8520e62c249f71b02e55a3b0a80decca013faf0ed1d1829ee35780", 0xcb, 0x1ff, 0x0, 0x2, r3}, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x7, 0x3, r0, &(0x7f0000000500)="37b80e01f46cec6a3e769766b9fe9247ec6988162377f2755c61b7fe113865f1b27f4a9601ff535fce36c1f094915a2048513b41f843c8ee8afd9518e5a5d725be8c02fece2b8f425d0a2d1edefb83698f51ace0d4926637b4e7b229ac9975e4bf3aa816129cd99cef41c807292d003698fba2ff93e3caef61fbfaaabff0f79206150a7e0549116fa45c40890607d9c7190683fc7bb3851f1a17d5", 0x9b, 0x7, 0x0, 0x2, r4}]) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r5 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r5, 0x0, 0x2000424, 0x1) pipe(&(0x7f0000000640)) write(r5, &(0x7f00000001c0)="4ea607440faf9b81ffc62b61875b0ada656199f06e0bc53aa1291da7d1841c6362b650d04be215ba0da05303ad0d717a897bb0d2905e7ce25b36a72f8732d3fc94d9f39e390792695ca49f3f76a33f4a857c7baac3597eed414e6135672de8434c7497", 0xfffffc4c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r5, r5, &(0x7f0000001000), 0xfec) fcntl$dupfd(r0, 0x406, r0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0xc, 0x12, r5, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) write$binfmt_elf64(r5, &(0x7f0000001040)=ANY=[@ANYBLOB="7f454c460500057f09000000000000000300060004000000ba0300000000000040000000000000004a0100000000000006000000090038000200ffff0700faff07000000010000000000000000000000ff03000000000000080000000000000006000000000000000000000000000000000100000000000057e57464090000000500000000000000da00000000000000060000000000000081000000000000000800000000000000f9ffffffffffffff642fdc6e551ad1d639588980169d6f4502b822c58900710d665757524ee7b2c789492977d4faf8d994bdd7d4fffe1d3dcffcfd32de5af5b94ca22d6644fb8c9b017f5757ec9a1955b9d39a584c4ba4fb5804e5eab31b0948a7000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f91a2e05e01d3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000cfd064f36a47549c9407a3828955069655df"], 0x509) 19:18:03 executing program 3: r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r0, 0x0, 0x2000424, 0x1) write(r0, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) listxattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=""/29, 0x1d) 19:18:03 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x420000, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)="01", 0xfffffffffffffe94) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r0, &(0x7f0000000040)={0x2001}) 19:18:03 executing program 2: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x3f5, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) 19:18:03 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000140)={{{@in=@initdev, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in6=@mcast1}}, &(0x7f0000000040)=0xe8) ioctl$TUNSETOWNER(r0, 0x400454cc, r1) r2 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r2, 0x0, 0x2000424, 0x1) write(r2, &(0x7f00000009c0)='/', 0x1) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'eql\x00', 0x8002}) sendfile(r2, r2, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1044.623112] binder: 7069:7071 got transaction to context manager from process owning it [ 1044.643003] binder: 7069:7071 transaction failed 29201/-22, size 24-8 line 3109 [ 1044.654892] binder_alloc: binder_alloc_mmap_handler: 7069 20001000-20004000 already mapped failed -16 19:18:03 executing program 3: r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r0, 0x0, 0x2000424, 0x1) write(r0, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) listxattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=""/29, 0x1d) 19:18:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) [ 1044.668927] binder: BINDER_SET_CONTEXT_MGR already set [ 1044.674800] binder: 7069:7071 ioctl 40046207 0 returned -16 [ 1044.681578] binder_alloc: 7069: binder_alloc_buf, no vma [ 1044.681594] binder: 7069:7080 transaction failed 29189/-3, size 24-8 line 3255 [ 1044.681804] binder: undelivered TRANSACTION_ERROR: 29201 [ 1044.717808] binder: undelivered TRANSACTION_ERROR: 29189 [ 1044.779129] binder: 7089:7091 got transaction to context manager from process owning it [ 1044.829922] binder: 7089:7091 transaction failed 29201/-22, size 24-8 line 3109 [ 1044.841197] binder: 7089:7096 Release 1 refcount change on invalid ref 0 ret -22 [ 1044.875835] binder_alloc: binder_alloc_mmap_handler: 7089 20001000-20004000 already mapped failed -16 [ 1044.889035] binder: BINDER_SET_CONTEXT_MGR already set [ 1044.895578] binder: 7089:7096 ioctl 40046207 0 returned -16 [ 1044.901530] binder_alloc: 7089: binder_alloc_buf, no vma [ 1044.901552] binder: 7089:7097 transaction failed 29189/-3, size 24-8 line 3255 [ 1044.901897] binder: undelivered TRANSACTION_ERROR: 29201 [ 1044.920996] binder: undelivered TRANSACTION_ERROR: 29189 19:18:04 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000000), &(0x7f00000000c0)=0x10) syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000001c0)={r0, 0x0}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$selinux_avc_hash_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x20000806, &(0x7f0000001180)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r1, &(0x7f00000003c0), 0xed5f0dd4, 0x0, 0x0, 0x184) shutdown(r1, 0x400000000000001) 19:18:04 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0) write$P9_RUNLINKAT(r2, &(0x7f00000000c0)={0x7, 0x4d, 0x1}, 0x7) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:18:04 executing program 3: r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r0, 0x0, 0x2000424, 0x1) write(r0, &(0x7f00000009c0)='/', 0x1) sendfile(r0, r0, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) listxattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=""/29, 0x1d) 19:18:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x36403, 0x2) ioctl$EVIOCSMASK(r1, 0x40104593, &(0x7f00000000c0)={0x16, 0x6d, &(0x7f0000000040)="4e2f3224191eb75cf8ede5d0b4e228cda3efd94afa7a8365231c265b45ad1f6c7c9eeb0fde363a7612982fe837499fe75a38bcdfb233d1905ec341a4b08592e7aee71a4a0da6c670a607dc12c1adb36826ae2a2deff00f44bdc09e311bbf5f0fa328f4c25ab5c094a1948a3341"}) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000140)='/dev/zero\x00', 0x2022c0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x23, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0763044000000020788c20e6e33c5295ece6f8041a3aa5949ec9085de785d03048da60"], 0x0, 0x0, 0x0}) 19:18:04 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f00000000c0)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'team_slave_0\x00', 0x3c01}) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$FS_IOC_MEASURE_VERITY(r1, 0xc0046686, &(0x7f0000000140)={0x0, 0xf4, "dcb381fdb5de5cc951626e1e46c64d4209bdd7ff7cff0438ce8cee67454b576b28d8343d6705e91a070b27d5eb018f5727fb24cc890053f17bc6791aa3691bd7fb6a61bb84e6981e76b11312531ed1708ec82a4c2252bada046e0076ad5f171683146c9ad444152df3a7de6d91cfe6a9fe2fbb442ec0fe1129fda6924f797c127c1511ba176ceb3efae68422ba833b2809448e6f66f1e15351975a0a4d4bd9af62cb50ee0cc8a9422a3c2110216ff5b2a5b7b7a6ff84e5be99c8b0cefdf5fb26524db7ccee23cfd51606889d85adb079dc91adb6db7aaa7e049ca7d595c65bb749416bcf344b21df7199ffad034d3eebe462298b"}) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:18:04 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000480)='/selinux/mls\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000100)={{{@in6, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in6=@loopback}}, &(0x7f0000000000)=0xe8) ioctl$sock_inet6_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000300)={@empty, 0x6f, r5}) write(r4, &(0x7f00000001c0), 0x7ba27d3a) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r2) getsockopt$inet6_buf(r3, 0x29, 0x2b, &(0x7f00000003c0)=""/169, &(0x7f0000000340)=0xa9) [ 1045.191573] binder_alloc: binder_alloc_mmap_handler: 7103 20001000-20004000 already mapped failed -16 [ 1045.200519] binder: BINDER_SET_CONTEXT_MGR already set [ 1045.200529] binder: 7103:7116 ioctl 40046207 0 returned -16 [ 1045.200642] binder_alloc: 7103: binder_alloc_buf, no vma [ 1045.200661] binder: 7103:7107 transaction failed 29189/-3, size 24-8 line 3255 19:18:04 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) syz_open_dev$rtc(&(0x7f00000000c0)='/dev/rtc#\x00', 0x0, 0x40) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) fremovexattr(r2, &(0x7f0000000040)=@random={'system.', 'nr0\x01\x00'}) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:18:04 executing program 3: r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r0, 0x0, 0x2000424, 0x1) sendfile(r0, r0, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) listxattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=""/29, 0x1d) 19:18:04 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) r2 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x400800) getsockname$packet(r2, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000000c0)=0x14) ioctl$sock_inet6_SIOCDIFADDR(r2, 0x8936, &(0x7f0000000180)={@mcast1, 0x66, r3}) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000140)=r2) [ 1045.201570] binder: undelivered TRANSACTION_ERROR: 29189 [ 1045.201594] binder: release 7103:7107 transaction 1699 out, still active [ 1045.201598] binder: unexpected work type, 4, not freed [ 1045.201600] binder: undelivered TRANSACTION_COMPLETE [ 1045.217212] audit: type=1400 audit(1553627884.075:78): avc: denied { getopt } for pid=7112 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 19:18:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="080000d06958e5f72cfbee2f7713c5801f8d0000000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) [ 1045.348566] binder: send failed reply for transaction 1699, target dead 19:18:04 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1045.416451] binder: 7135:7136 got transaction with invalid offset (0, min 0 max 24) or object. [ 1045.451816] binder: 7135:7136 transaction failed 29201/-22, size 24-8 line 3349 19:18:04 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) fsetxattr$security_ima(r0, &(0x7f0000000140)='security.ima\x00', &(0x7f0000000200)=@sha1={0x1, "39c7827a7426cc7c15533fae67bc5f180ad8b61c"}, 0x15, 0x2) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f0000000500)="2fdbb8b58668132228030000000000000000000000000000", 0xfffffffffffffe5d) openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/member\x00', 0x2, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) ioctl$sock_netdev_private(r2, 0x89f9, &(0x7f00000002c0)="6759dad96aecbfa4c47e6cfd63485360642dea65b62f5d8f9790117e3b9820051f5da35263a02828748d65c879f5bc956f6bef45c602a27ada70a055125876ad86f9c5a63434d9494a9437f24d547095755e6f1266f476032b76bce397b04ff20999e6b0b338985afeb5e544e3847e403ff7dcd9b5bf69a7cca40e965c60daadb187946616f56a160abb6dcf3d7fd86d60eb504a22f60a09a030997523dbea38d50eb82d3616058a3ff8659c63ce3262c0e77da934dd4573f27e6e04933d8ab1199eaccabd816354710f62c54f6be6b2bf45ba8e8cbdb72918") r3 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000400)='/dev/keychord\x00', 0x10400, 0x0) ioctl$EVIOCGBITSND(r3, 0x80404532, &(0x7f0000000440)=""/88) time(&(0x7f00000003c0)) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x84000, 0x0) pipe(&(0x7f00000000c0)) creat(&(0x7f0000000180)='./file0\x00', 0x1) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='pids.current\x00', 0x0, 0x0) r4 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000240)='/proc/self/net/pfkey\x00', 0x4002, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000280)=r4) 19:18:04 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) read(r0, 0x0, 0x0) prctl$PR_SET_TIMERSLACK(0x1d, 0xffffffffffffff0f) prctl$PR_GET_TIMERSLACK(0x1e) syz_execute_func(&(0x7f0000000080)="3666440f9bf50f0145f341c3848f0f8021c4c3654c69000b3e0f1158101019c40f4ce02f662e66653e660f132704cd0f72e1930f2902") 19:18:04 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000040)=0x0) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r2, 0x1, &(0x7f0000000140)=""/187) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) ioctl$SIOCSIFHWADDR(r0, 0x8924, &(0x7f00000000c0)={'vlan0\x00', @dev={[], 0x2a}}) inotify_init1(0x800) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) r3 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f0000000240)={'syz', 0x3}, &(0x7f0000000280)="e1af955f79ed565490064678b4bb9aca0098107f6ecbaa53c7463bbe84c6780b3c1efba62a507238479784ff21adbd7cdf81acd9d6c25b119df39f435f376d226d9462d6ccef4dd21052a62f8d32", 0x4e, 0xfffffffffffffffc) keyctl$invalidate(0x15, r3) [ 1045.463480] binder: 7135:7143 Release 1 refcount change on invalid ref 0 ret -22 19:18:04 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) readv(r0, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/255, 0x443}], 0x10000000000000e0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x2002) dup3(r1, r0, 0x0) write(r0, &(0x7f0000c34fff), 0xffffff0b) [ 1045.514853] binder_alloc: binder_alloc_mmap_handler: 7135 20001000-20004000 already mapped failed -16 [ 1045.549012] binder: BINDER_SET_CONTEXT_MGR already set [ 1045.558189] binder: 7135:7136 ioctl 40046207 0 returned -16 19:18:04 executing program 3: r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r0, 0x0, 0x2000424, 0x1) sendfile(r0, r0, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) listxattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=""/29, 0x1d) 19:18:04 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r1, 0x0, 0x2000424, 0x1) write(r1, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x4, 0x11, r1, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) [ 1045.558228] binder_alloc: 7135: binder_alloc_buf, no vma [ 1045.558256] binder: 7135:7143 transaction failed 29189/-3, size 24-8 line 3255 [ 1045.558518] binder: undelivered TRANSACTION_ERROR: 29189 [ 1045.558605] binder: undelivered TRANSACTION_ERROR: 29201 19:18:04 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000003c0)={{{@in=@multicast1, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@remote}}, &(0x7f0000000300)=0xe8) ioctl$sock_inet6_SIOCSIFDSTADDR(r2, 0x8918, &(0x7f0000000340)={@loopback, 0x7c, r3}) clock_gettime(0x0, &(0x7f0000000500)={0x0, 0x0}) clock_settime(0x5, &(0x7f0000000540)={r4, r5+10000000}) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) ioctl$KDSETKEYCODE(r2, 0x4b4d, &(0x7f00000001c0)={0x7, 0xd6e}) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') rt_sigtimedwait(&(0x7f0000000000)={0x6}, &(0x7f0000000100), &(0x7f0000000180)={0x0, 0x989680}, 0x8) tee(r0, r7, 0x6, 0x1) write(r7, &(0x7f00000001c0), 0x7ba27d3a) read(r6, &(0x7f0000000200)=""/250, 0x29e4ba6b) ioctl$sock_inet6_SIOCSIFDSTADDR(r7, 0x8918, &(0x7f00000004c0)={@dev={0xfe, 0x80, [], 0xc}, 0x5, r3}) 19:18:04 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) readv(r0, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/255, 0x443}], 0x10000000000000e0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x2002) dup3(r1, r0, 0x0) write(r0, &(0x7f0000c34fff), 0xffffff0b) 19:18:04 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x4000) ioctl$EVIOCGLED(r1, 0x80404519, &(0x7f0000000140)=""/213) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) r2 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r2, 0x0, 0x2000424, 0x1) write(r2, &(0x7f00000009c0)='/', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r2, r2, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) ioctl$TUNSETSTEERINGEBPF(r0, 0x400454d1, &(0x7f0000000080)) 19:18:04 executing program 3: r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) fallocate(r0, 0x0, 0x2000424, 0x1) sendfile(r0, r0, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) listxattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=""/29, 0x1d) 19:18:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000240)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="901f65f8516d3ad1ae35c35c9a255cd515a5df5bed5b474dd3d5dce03b0b5b93a80ce3d99e50002d9d7f81fe9886b9286747d04e"]], 0x0, 0x0, 0x0}) r2 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x8000) sendto$inet6(r2, &(0x7f0000000380)="b10f010c8ea649ae7234751b81553244a39c41edd23d70ab2f992a9fd8b7e2cefebb157d2433c94132df76ad0abc2475b51a9de8739da8603b6a70fb986633aa508d8df8796d3825883d6399420ca0b6cf3ab563facba8d04085cf7fa9fb82be340791d1ab469727aedcc5", 0x6b, 0x4004000, 0x0, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(r2, 0x29, 0x41, &(0x7f0000000040)=ANY=[@ANYBLOB="6d616e676c650000000000000000100000000000000000000000000000000000e9000000cd83a5ae00b6b862820db6f29728b5ac6d4473d18d531a712a469451923dd7c7be2d5f5b5f4475c7b2ff0109f908906d8145b29314391a0b51faff069d7faade6047bcbe29df126daed75801b0d0ad11545385067a33629d020b01232faa7c7054735620d03429b2d94afff08490df155253bce4bfad0deece5c5c091361008b1a2a0eda8fc19d9cbf2f2b248a0884806ffdb0e7a79d113d1de36264d4ba9e0aebb35355fb90d4218f69a792bc3cc64e986703bf5efc64c4f4e8d64fad09009e2ae32c7143388df9cf0ceb6eabc1ed03323992c2027ea4f962fc33e23e393f290b955b352a56bfa56b"], &(0x7f0000000180)=0x10d) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, 0x0}) 19:18:04 executing program 3: r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) write(r0, &(0x7f00000009c0)='/', 0x1) sendfile(r0, r0, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) listxattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=""/29, 0x1d) [ 1045.709113] binder: 7179:7181 ioctl 8903 20000240 returned -22 [ 1045.720329] ------------[ cut here ]------------ [ 1045.725090] kernel BUG at drivers/android/binder_alloc.c:1105! [ 1045.731068] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 1045.736427] Modules linked in: [ 1045.739760] CPU: 0 PID: 7181 Comm: syz-executor.2 Not tainted 4.9.165+ #28 [ 1045.746773] task: ffff8801a5a14740 task.stack: ffff8801cf748000 [ 1045.752823] RIP: 0010:[] [] binder_alloc_do_buffer_copy+0xcb/0x500 [ 1045.762485] RSP: 0018:ffff8801cf74f518 EFLAGS: 00010212 [ 1045.767935] RAX: 0000000000040000 RBX: 0000000020001000 RCX: ffffc9000213b000 [ 1045.775212] RDX: 0000000000000386 RSI: ffffffff8221c34b RDI: ffff8801c7b4c8d8 [ 1045.782476] RBP: ffff8801cf74f598 R08: ffff8801cf74f870 R09: 0000000000000028 [ 1045.789744] R10: ffffed0039ee9efe R11: ffff8801cf74f7f7 R12: 0000000000000020 [ 1045.797012] R13: ffff8801b0016218 R14: 0000000000000028 R15: ffff8801cf74f870 [ 1045.804277] FS: 00007fc415210700(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000 [ 1045.812505] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1045.818410] CR2: 00000000004ce130 CR3: 00000001d13cc000 CR4: 00000000001606b0 [ 1045.825682] Stack: [ 1045.827822] ffff8801cf74f7f0 ffff8801cf74f548 ffffffff814f79e6 0000000000000008 [ 1045.835893] dffffc0000000000 ffff8801c7b4ce58 00ff8801cf74f5d8 ffff8801c7b4ce00 [ 1045.843994] ffff8801a5a159a0 ffff8801b0016180 d13a6d51f8651f90 ffff8801cf74f870 [ 1045.852073] Call Trace: [ 1045.854657] [] ? memcpy+0x46/0x50 19:18:04 executing program 3: write(0xffffffffffffffff, &(0x7f00000009c0)='/', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0) listxattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=""/29, 0x1d) 19:18:04 executing program 3: write(0xffffffffffffffff, &(0x7f00000009c0)='/', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0) listxattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=""/29, 0x1d) [ 1045.859768] [] binder_alloc_copy_from_buffer+0x37/0x42 [ 1045.866694] [] binder_get_object+0xa2/0x1a0 [ 1045.872768] [] binder_transaction+0x1fdf/0x5840 [ 1045.879095] [] ? binder_transaction+0x1141/0x5840 [ 1045.885586] [] ? trace_hardirqs_on+0x10/0x10 [ 1045.891643] [] ? check_preemption_disabled+0x3c/0x200 [ 1045.898492] [] ? binder_inc_ref_for_node+0xba0/0xba0 19:18:04 executing program 3: write(0xffffffffffffffff, &(0x7f00000009c0)='/', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0) listxattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=""/29, 0x1d) 19:18:04 executing program 3: r0 = memfd_create(0x0, 0x0) write(r0, &(0x7f00000009c0)='/', 0x1) sendfile(r0, r0, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) listxattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=""/29, 0x1d) [ 1045.905250] [] ? __save_stack_trace+0x7a/0xf0 [ 1045.911393] [] ? depot_save_stack+0x13c/0x4a0 [ 1045.917553] [] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 1045.924306] [] ? __might_fault+0x114/0x1d0 [ 1045.930193] [] binder_thread_write+0x593/0x2110 [ 1045.936518] [] ? trace_hardirqs_on+0x10/0x10 [ 1045.942575] [] ? _raw_spin_unlock_irqrestore+0x6b/0x70 [ 1045.949501] [] ? binder_transaction+0x5840/0x5840 19:18:04 executing program 3: r0 = memfd_create(0x0, 0x0) write(r0, &(0x7f00000009c0)='/', 0x1) sendfile(r0, r0, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) listxattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=""/29, 0x1d) [ 1045.955994] [] ? __might_fault+0x114/0x1d0 [ 1045.961901] [] binder_ioctl+0xecd/0x1720 [ 1045.967608] [] ? binder_poll+0x240/0x240 [ 1045.973317] [] ? __lock_acquire+0x5e5/0x4350 [ 1045.979377] [] ? __might_sleep+0x95/0x1a0 [ 1045.985175] [] ? binder_poll+0x240/0x240 [ 1045.990879] [] do_vfs_ioctl+0xb87/0x11d0 [ 1045.996588] [] ? selinux_file_ioctl+0x103/0x550 [ 1046.002969] [] ? ioctl_preallocate+0x210/0x210 [ 1046.009179] [] ? selinux_parse_skb.constprop.0+0x16b0/0x16b0 [ 1046.016603] [] ? __fget+0x208/0x370 [ 1046.021853] [] ? __fget+0x22f/0x370 [ 1046.027116] [] ? __fget+0x47/0x370 [ 1046.032289] [] ? security_file_ioctl+0x8f/0xc0 [ 1046.038497] [] SyS_ioctl+0x8f/0xc0 [ 1046.043664] [] ? do_vfs_ioctl+0x11d0/0x11d0 [ 1046.049619] [] do_syscall_64+0x1ad/0x570 19:18:04 executing program 3: r0 = memfd_create(0x0, 0x0) write(r0, &(0x7f00000009c0)='/', 0x1) sendfile(r0, r0, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) listxattr(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=""/29, 0x1d) 19:18:04 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000600)={0x2, 0x2, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x200, 0x0) write$FUSE_LSEEK(r2, &(0x7f0000000100)={0x18, 0x0, 0x4, {0x4}}, 0x18) openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000380)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') write(r4, &(0x7f00000001c0), 0x7ba27d3a) read(r3, &(0x7f0000000200)=""/250, 0x29e4ba6b) [ 1046.055307] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 1046.062202] Code: fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 0a 04 00 00 4d 8b 64 24 58 49 29 dc e8 0f 0a 10 ff 4d 39 e6 76 07 e8 05 0a 10 ff <0f> 0b e8 fe 09 10 ff 4c 8b 6d d0 4d 29 f4 4d 39 e5 77 e8 e8 ed [ 1046.089168] RIP [] binder_alloc_do_buffer_copy+0xcb/0x500 [ 1046.096458] RSP [ 1046.100634] binder: 7179:7213 Release 1 refcount change on invalid ref 0 ret -22 [ 1046.120834] ---[ end trace eb1f792c4556da0c ]--- [ 1046.120840] Kernel panic - not syncing: Fatal exception [ 1046.121129] Kernel Offset: disabled [ 1046.134829] Rebooting in 86400 seconds..