[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 10.878766] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 [ 12.034881] random: sshd: uninitialized urandom read (32 bytes read) syzkaller login: [ 12.213327] random: sshd: uninitialized urandom read (32 bytes read) [ 12.369241] random: crng init done Warning: Permanently added '10.128.10.1' (ECDSA) to the list of known hosts. 2019/11/29 20:35:37 fuzzer started 2019/11/29 20:35:39 dialing manager at 10.128.0.26:39017 2019/11/29 20:35:39 syscalls: 1425 2019/11/29 20:35:39 code coverage: enabled 2019/11/29 20:35:39 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2019/11/29 20:35:39 extra coverage: extra coverage is not supported by the kernel 2019/11/29 20:35:39 setuid sandbox: enabled 2019/11/29 20:35:39 namespace sandbox: enabled 2019/11/29 20:35:39 Android sandbox: /sys/fs/selinux/policy does not exist 2019/11/29 20:35:39 fault injection: kernel does not have systematic fault injection support 2019/11/29 20:35:39 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/11/29 20:35:39 net packet injection: enabled 2019/11/29 20:35:39 net device setup: enabled 2019/11/29 20:35:39 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2019/11/29 20:35:39 devlink PCI setup: PCI device 0000:00:10.0 is not available 20:36:41 executing program 0: r0 = accept4$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @dev}, &(0x7f0000000040)=0x10, 0x0) ioctl$sock_inet_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={0x0, {0x2, 0x4e23, @loopback}, {0x2, 0x4e20, @broadcast}, {0x2, 0x4e22, @loopback}, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1f, 0xff}) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)=0x0) ioctl$TIOCSPGRP(r1, 0x5410, &(0x7f0000000180)=r2) ioctl$TIOCGICOUNT(r1, 0x545d, 0x0) r3 = accept4$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, &(0x7f0000000200)=0x10, 0x800) getsockopt$inet_mtu(r3, 0x0, 0xa, &(0x7f0000000240), &(0x7f0000000280)=0x4) setsockopt$IP_VS_SO_SET_DELDEST(r3, 0x0, 0x488, &(0x7f00000002c0)={{0x2c, @local, 0x4e24, 0x4, 'sed\x00', 0x20, 0x1, 0x5c}, {@local, 0x4e23, 0x2, 0x7fffffff, 0x3, 0x1f}}, 0x44) openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f0000000340)='/proc/self/attr/current\x00', 0x2, 0x0) lgetxattr(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)=@known='system.posix_acl_access\x00', &(0x7f0000000400)=""/160, 0xa0) r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$TUNGETVNETHDRSZ(r4, 0x800454d7, &(0x7f0000000500)) ioctl$sock_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={0x0, @can={0x1d, 0x0}, @rc={0x1f, {0x0, 0xf9, 0x4, 0x5, 0xa6, 0x8}, 0x5}, @rc={0x1f, {0xf5, 0xe0, 0x2, 0x0, 0x2, 0x43}, 0x3f}, 0x8000, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000580)='bcsf0\x00', 0x6, 0x5, 0x7ff}) sendmsg$nl_route(r1, &(0x7f0000000800)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0xe0000000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000640)=@mpls_delroute={0x154, 0x19, 0x8, 0x70bd29, 0x25dfdbfd, {0x1c, 0x10, 0x14, 0xaf, 0xff, 0x2, 0xfe, 0x8, 0x200}, [@RTA_TTL_PROPAGATE={0x8, 0x1a, 0x1}, @RTA_NEWDST={0x84, 0x13, [{0x8001}, {0x3}, {0x800, 0x0, 0x1}, {0x8, 0x0, 0x1}, {0x6}, {0x4}, {0x3, 0x0, 0x1}, {0xe6af}, {0x4, 0x0, 0x1}, {0x2, 0x0, 0x1}, {0x1}, {0x6}, {0x7ff, 0x0, 0x1}, {0x2}, {0x6, 0x0, 0x1}, {0x800, 0x0, 0x1}, {0x7, 0x0, 0x1}, {0xcde}, {0x43, 0x0, 0x1}, {0x800}, {0x3}, {0x1f, 0x0, 0x1}, {0xfff, 0x0, 0x1}, {0x4aa, 0x0, 0x1}, {0x3, 0x0, 0x1}, {0x400}, {0x7}, {0x516, 0x0, 0x1}, {0x7}, {0x2}, {0xfd1, 0x0, 0x1}, {0x2, 0x0, 0x1}]}, @RTA_DST={0x8, 0x1, {0x4}}, @RTA_DST={0x8, 0x1, {0x800}}, @RTA_OIF={0x8, 0x4, r5}, @RTA_NEWDST={0x84, 0x13, [{0x7, 0x0, 0x1}, {0x6}, {0xff}, {0x8001}, {0x3}, {0xae72}, {0x6}, {0x7}, {0x3, 0x0, 0x1}, {0x8}, {0x4}, {0x9, 0x0, 0x1}, {0x4}, {0x3}, {0x3, 0x0, 0x1}, {0x16ea, 0x0, 0x1}, {0x5, 0x0, 0x1}, {0xc2}, {0x1ff}, {0x4}, {0x8}, {0xda9, 0x0, 0x1}, {0x6}, {0x80}, {0x1, 0x0, 0x1}, {0x40}, {0x9, 0x0, 0x1}, {0x10000}, {0x5}, {0x8}, {0x4, 0x0, 0x1}, {0x7, 0x0, 0x1}]}, @RTA_TTL_PROPAGATE={0x8}, @RTA_DST={0x8, 0x1, {0x40, 0x0, 0x1}}]}, 0x154}, 0x1, 0x0, 0x0, 0x41}, 0x40000) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_mreq(r6, 0x29, 0x1c, &(0x7f0000000840)={@dev={0xfe, 0x80, [], 0x20}, r5}, 0x14) r7 = add_key$keyring(&(0x7f0000000880)='keyring\x00', &(0x7f00000008c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffd) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000900)={{{@in6=@mcast2, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in6=@remote}}, &(0x7f0000000a00)=0xe8) r9 = getgid() keyctl$chown(0x4, r7, r8, r9) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000a40)='/proc/self/attr/current\x00', 0x2, 0x0) readahead(r3, 0x6, 0x9) r10 = socket$inet6(0xa, 0x800, 0x7) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r10, 0x8983, &(0x7f0000000a80)={0x1, 'bridge_slave_1\x00', {}, 0x7}) r11 = epoll_create1(0x80000) r12 = syz_open_dev$mice(&(0x7f0000000b00)='/dev/input/mice\x00', 0x0, 0x50440) epoll_ctl$EPOLL_CTL_ADD(r11, 0x1, r12, &(0x7f0000000b40)={0x40000000}) r13 = openat$selinux_access(0xffffffffffffff9c, &(0x7f0000000b80)='/selinux/access\x00', 0x2, 0x0) fcntl$F_SET_RW_HINT(r13, 0x40c, &(0x7f0000000bc0)=0xa03639bdcdf5823d) 20:36:41 executing program 5: prctl$PR_GET_FP_MODE(0x2e) r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r1 = inotify_add_watch(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x21) inotify_rm_watch(r0, r1) ioctl$VT_DISALLOCATE(r0, 0x5608) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) readv(r0, &(0x7f00000003c0)=[{&(0x7f0000000080)=""/30, 0x1e}, {&(0x7f00000000c0)}, {&(0x7f0000000100)=""/242, 0xf2}, {&(0x7f0000000200)=""/46, 0x2e}, {&(0x7f0000000240)=""/124, 0x7c}, {&(0x7f00000002c0)=""/202, 0xca}], 0x6) syz_mount_image$msdos(&(0x7f0000000440)='msdos\x00', &(0x7f0000000480)='./file0\x00', 0x467ec6f6, 0x2, &(0x7f0000000580)=[{&(0x7f00000004c0)="38ec3c4e57a66e7d8c296d066be82400a8cf06544446cbd94c5e422b8f146aceb082629555fb4cde80702995ffaa638bcc7ed97deb8a9e31", 0x38, 0xb4}, {&(0x7f0000000500)="cf4f310816d5f39d39f02c9cc4eb8b3d6e38ae25246e095aa2a76a553effeda9bb8343c30113ec3fe7f98a08206e664b2ac9910872d99d106de09a305428607a095b50dfa0f1728df6f9e0aafaf72cb93637024a4cbdab7ae49fac5f24b7db0d8475498bb02ea1", 0x67, 0x4}], 0x8000, &(0x7f00000005c0)={[{@nodots='nodots'}], [{@dont_hash='dont_hash'}]}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_opts(r2, 0x29, 0x37, &(0x7f0000000680)=""/83, &(0x7f0000000700)=0x53) nanosleep(&(0x7f0000000740)={0x77359400}, &(0x7f0000000780)) ioctl$RTC_IRQP_READ(0xffffffffffffffff, 0x8008700b, &(0x7f00000007c0)) timer_settime(0x0, 0x1, &(0x7f0000000800)={{0x0, 0x989680}, {0x77359400}}, &(0x7f0000000840)) timer_create(0x2, &(0x7f0000000a40)={0x0, 0x29, 0x0, @thr={&(0x7f0000000880)="b89fae2106457c615ee4bf2923ff89c41269d7f4aaf52f4cf025348d29183a9ce6240106a1f1d356202384c9a7b45d98af1a72aa558ee56f51226dacbf170c388c819ff1e2b2cba4f35c15498666307e11de3cecde1fd76eff8e460ebe5454207b2c9b03a5c6aab286f314ef4337e3562f455c072a01c95f1825333adcff7581be1a8a4dbda348c5da9826d90e431929aecb0e48dd074128928fc43ad8fda3ce5d4364ca69f931a79f330daa3e5fa18c06a161ef007cba2465c81dc4d22ba6aed08e45c9efc1300a85", &(0x7f0000000980)="239604a102c297fc6825c3fbd6ad40b74261201857cad211a7c5dd3d4738a3007817444788d4e217bc025ab60bb2add633c16629657b5712bc51daeb39d079bbff6261ed4bae755256bb869b328fe413e415a670f3505953dd10c00d1ddb1a138db65e26954211a06451dceeebb16fbd0293f0acf05689ef377ffcecda39466e558e1e607cd34d793e41f4f63408c6e4fa09c9c6d40d2b1a6d4f496d6daaf1d2da3c2ed20b06cacdc2ee"}}, &(0x7f0000000a80)=0x0) clock_gettime(0x0, &(0x7f0000000ac0)={0x0, 0x0}) timer_settime(r3, 0x0, &(0x7f0000000b00)={{r4, r5+30000000}, {0x77359400}}, 0x0) r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000b40)='/dev/vga_arbiter\x00', 0x20100, 0x0) ioctl$sock_inet_SIOCGIFDSTADDR(r6, 0x8917, &(0x7f0000000b80)={'team_slave_1\x00', {0x2, 0x4e22, @multicast2}}) r7 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000c00)='/selinux/status\x00', 0x0, 0x0) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000c40)={&(0x7f0000000bc0)='./file0\x00', r7}, 0x10) r8 = openat$null(0xffffffffffffff9c, &(0x7f0000001f40)='/dev/null\x00', 0x500000, 0x0) getsockopt$inet6_udp_int(r8, 0x11, 0x1, &(0x7f0000001f80), &(0x7f0000001fc0)=0x4) r9 = accept$unix(0xffffffffffffffff, 0x0, &(0x7f0000002000)) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r9, 0x8982, &(0x7f0000002040)) epoll_create(0x4) munlock(&(0x7f0000ffe000/0x2000)=nil, 0x2000) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f00000020c0)={'veth0_to_team\x00', 0x800}) r10 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000002100)='/selinux/mls\x00', 0x0, 0x0) sendmsg$sock(r10, &(0x7f0000004500)={&(0x7f0000002140)=@l2={0x1f, 0x1ff, {0x9, 0x54, 0x7f, 0x0, 0x3f, 0x2}, 0xf2ba, 0x9}, 0x80, &(0x7f00000043c0)=[{&(0x7f00000021c0)="8c993b76918200dad1d1ba193bfbce3fb3789c38d69f1b37c60365a6785f25ea2eeb78a9db173a545964c46756b07a3efa91fb2d950d44e2942817a2f8fbcc6d67cdee6f4efefee1b3977f18b5853add3533d6a84f6d21ec942537642cacc184e3f727fc5917a5f252dd1dce15678f7625bc156c95dcc9b967cf5ff63b5f67cf0b99128c6481caf7223aa386747c4c104556d5e2", 0x94}, {&(0x7f0000002280)="ff89f3c12c89ffdfe6d0abb915aeb5c6d2483b6f5808ae71bc9a8331c338d5478ff8609b8cb7c128efdb76ad7d5fd8de5ff6e4ff97f4c013ad3c6a3946d5135c2745791ce56743090b63cda0ab4c499cf9aead2e482b4096b0ba2b1cdc133f39b12d1dfd3052195221c73c526bd0c212e7801732054c17136adf40b3540ea505caa12fbe69f7358392407faa4f3701251efffbdb35c37a3bfcc5fac36c05493c820f4cd06afb2a2d71b494605bedde8a4e443d2134eee93f9fce44379861e4b6a7ed01c43209eef78ae7dd463bec898f56f4f838cd1f1da8055e59c494f84ecf7db018d2de48d7a7fc0b8b335edf4cca43007b8291d3e7952a393e2c6568af30bf7478592c582cef831041658bc14b7a22df224d5b46490698c69460cf428ac35d67436ebe2a7c7977c6556b375831d6ed897244e73735f2d5c897607348f3992cb7cde42a8d487fce508f452c78c0f7dff521a9c8e73c53a6a79d6142e46733b1d2c3a43c5596ff2cf6cbf434220f46ee5d634ccf21c3f8dcf40b55bcf4a09a966b44bd79dab85e876f1d4fe3b62d21b8127a6be705b44fe2c540d92211f4810041415c4e0a8642c08527b9b04ea4ef4520f9839819b90074c8435463f58a277ed86601a5a0f77ecb390abac81b62be8879a71aff2dd72daa0384161cdb08c1555a599fb12c4408d6f1d7029fab33a328e17480288fc315a18e06b8c86b242e5e6b171d7a8d9f54fdf728ad7b636790e456f4910fb1920924b7e7eab4f8e3370f4816867a0707cde990ee91b9e7e87d163a85118425b9f29f34dcc2011422ea3dbde8687f469f05fd6fdb24c5f412eabc675b5359a7d959c425257205338fbf80d3b64d33c8c722235160b30ff7aa3a7cec411baceac75399b0278f2d09699e3e4ef8ef039049b3d453a188b495d3ff907b6bdcb139ed669af2a96325f7125566322e60d22b0ec0b3b066eb256baded2fad6f8a878fa037fceca104cdef88561d621e2ad6b16bdbc7b01bae24260872a8950b6b4ebcb3625d0bec5ec96e202d60b737101234b06a6e29aed44d1e0126c050358f632b6840ced1b54307e9e8b5b274b1df7c52bc35ca36ee61a6a7f672739b8d4c0b64cc3f22422fc00f5f1a0e7de51a269afda81df102fd22d63d87392c0781e3a697af0c2c4354828907b6652d2e0d645a5cccb6fe2a673aa14dde65eab93f7a3b66dcc93e3c9c408c7424d25f35c087ac85965d69068ab03350aeb29fa32012937cce60e9b8b130f599bb08a1bf5b004629633f1aef1b5fe75edf5727b093e02739821f7b6bb414d0a72effb65d60956afab8bcb62a38d6dce5eef24a87dcf7470f7eb5675011a8cf8d9f5fc0f251ace01e8ecc2dc8e1d626dd3577b380aeee4b99aa48cfd305d8a3c5c09fdeed538445061b3bd27b5bd015f68fd83fda231f16c7849330ae03d0e5429f016702ac8499e96d28c5f58a6592acd92dd6acf84af8355230fd0d8a525631cf744bda9c32ec03e297782dfdf8db721ea28724001a53722b532175181afedeffdd9385a73210eaa086fe0445f42ebdabdf46a1af35f31d716e4404e330a6c57c3cd102d6ba08dabad9c166ea17a4f304082853c6cf393e8eba1550f03fa91688befab52a9a199b4ab8f0d8496a17dd16d14227d1e025001b0373f6b11c730a491d1410191227c63e808e56907909e392eb6612b1b93d43537de1db9c3d0a6ba56fc501d50fc00f32a206c80421a07ac71c4c020efe96a771287c55570edf8f7c74c6ac70b27e954d7e9b715bba6d76c5501a49ca05bd336db62d7bde81c8274bf60b6e3af54a25873744969a283c922fceafd78c33133a206a1567f958541b02f690f5d6cffc64111ae119bcaf785fa3780a5645ebeea06640a3658bc666fba07e5abe35134e04dc997dcf4a6638ff04bf2ec9150a5d782b6e57b3474ddd16725e54f8812b88b0523ba4336589d89c38f0d85e4fe21ed419dd1cf127fa76be0282ee437a60cde15c80bc1373c67d3150b4c57b98d032c9a876fb445bd372cd434400508c2b3cf2b6192ddb31526a516f34d6548b547804907dbc2a971ded2db5f12027995d3ed3a1bd836c8cd08eb81d4413e513688b8e6f1c5ab7f8f9bb5b8269dba7025527fae68c1798b43f6dbee7a324598d97eb01b4c9ea4f862c629b757bae7adf340075f023e06651bb66b719967de7668204c9daef88553f6ab5dbf1f0c100836c52a2064e33f63d1f368a92b6763fe32269a6ade0ede7f15f7438fe82655dda8bf20adc38bbfe35a0bcf6d4df597ddd4bdad3980d47809f2fa8d7016cc1db4daff3cba1f164e218daf9b644490a4d427961dae150492f86bcbba81083cb74903be6016c910b19e9026c956189a7ee5dcdd2f8357df5d52d71a57c0fe43a6dada9bbd34fa67b413989901dad89e6af857f48ae60fb1e100cd718e78e4037ac0e932f33de52e4a6413b11f235de45e6f7d29ccd8eb60e73ac36e6167617fa3d802d03d6475ff4a32210d7d22cc590ac88285543fd5a83c8b52849b6dcfbb43d6bb45d2a8142207bc88f0ff486dc8d5f341c7853f2d2ff7ca35c260c27de9752f62691366be0b78c77dfe57cf73df3d0ff1a14c4ca83a48a051dafb2fe5863e6f162b7b625485249a15ed5398918cb2f6397bf5fc109b39a7ffec808ecdf4e94732870610bdca3e2a9dbc2d8a6b0434e0f61e91435b6585e3b6df6fcadd43ee11c3ede72f5c26905deff1b5e201ad911607fdc4c410ff696df50fe0d13bc48dd02acd2af91b24d3f3b6671aa3b3dad50770b21e641a759c38f17a0037c018267db0d309bea052e849ae57450d8669f868f2d684811fa430ba0b7fa13742322bf47c4b4f84d4bca823a296737cb3c93930eb3f6ab4c43a4507695de1a162c161cd7c51a0b5d2b35b51b207ab9ebb2504092e4b8eea83e6cb798b6bcc5e6a70327bd73f01a11753f8c4c321443513ac4abbb82b40152c698b086323a68e5d3e5f5252614fb50e11b59ca73dc965623b1f07edd636b7f0f98d87504fa4bb53793aa64630cb082a16f0555e6b5e29e69c6b41677f14b509432e24c5fb7b4c968b1c7ba6103f06369ac967d71f888b32313210385e58b53e3aa5a64533719e18678b39c528ab884fc0e2c379c46d3ec6d392629dc806abdd933ec6fe43e7216fd18fbff6bd6c3d7a689719d89cee44c864ec4e13ce811eb3335b541558d85d3a3db2fc2752ed5da1c132d0e0d4c5b9d1c12808d1abce9754320f7f4dfa5761b05a9403cc9864652c884ddda07b38ba4fcdc9b9c20737b067b3b428d330708fa225f5ed4c11897408ce4aef3aaa8f2a32c8dfbf959417ed01fe9ebc233488b5b4b7845d8bf58fc60476abac05e04662d76806e1e7a6a1255d4aad181132ab8920a611da5dc08e5ae9f8a616885f880274396c8c7dcb7ff82821e13617bf2dcc136bcbddaa8ae5d2b0821a9c131dbaff2bc38b0e1ce25ce7407f3b2b32d23f6e1160a0584bb3b0ad4a52c4cb8398dc032acb5dc4a5cb14bc237968d2b00a532b23b01ac4e9a3e8b4660bbdcc831bde4225a4b275de9800c793004c5df93857bb98a686a03bfafded4543813b45cb4aea0adb43baf9ec270e4d1b3f37d0d1a6017e5f9152c60ca4e9cc3835c5e6589e1b3c955214b5eb0c8edab8b14f47a0a2f8d2664b8a9ccbb5d813500d6270184e06f99a8ee8c3c0a2a9184988566edbe1d16c5ecd4bfae518fca9aa12314296b13c8eedf86f8cf6ba53f0597e1509f781a93439357333885c73d8b89c5f1fccd156ae24bf3025ecab0241b562318254adf282b6b533bb8f7c875c10e6b4576bf441786e2773f8fa90023c4b8a7dbfc99c183d8b25dd7f5ca75b08f60be258fc4791a930689e3e826bb1a6d7ea250b28443f8c6571a3f570c34ed323deb73e0e3439c79f0182440e58f207843083b80e5864cd321068861d9e37526c78236d71c389fcdac6bf0e94a02c17eae9c67ec7695341960518d3957466cf2feeb90c3e007ce510b22f2acca8727d0aff2419cd7a0deccc5558c2221876e771d289dc25f56b5dbeb45f592dda690b6eb412cb58758834ac86a64bb11e446a5b1a793b3495b39294579ef7c98c7d2ea929503baa08619722f1b4f7e15bd6dc4e271e8032a1d176fdf2f78a7b48c4379cd16f9f904c737c9411fb41af50b3c08c94acec018ee0cb52664ad7c37c8e85eadd09f8e011b908fcbbb36978b0a478d7e7805e062c7380346d0d741071f4a5b61e2d24f4757847bb0ac65ebcdd55aa4cee7284933ac868f8e1ff7f7578eb60b469e6766bda57a5836cac1d29d10974121053a1730d842858402d5ae2f4deb69d87baf59cefe4eaad230272cf31ea8eecb66d6f4ada942eaf5abae3e84197e038029ec35f69342cffe5abc303811e8e3ac7824fe81fafa2af3223e0d2e9ab8723cfdbc223e18e11d46ef04a470b2fac9ca9f9ee063270538857809262bf6b6fa992fb4ad146141323e72d9b9ca348a5647f0fb8c9c534f6e937b7a00460368f8d8d7ecf232b7447b2889fc330535c2434ff5187ed97360dfb8ce5bbf44868fd58e2f388cdd2eb4f88ae513fe0c01638a82c1f90aa1ca0a6f16c48aa23ccb0fdf6fcf177efbf60bcb5b7a095d0944abd32152de9f64b23acf6fb20a309bf2f0b1c8e70c72285bd7f1e3cad7eebfcc50c4778b1426abd52b5cd0755a6bd3c1d450e9fd02d4d9b3b0f4e25bf89f23e0dd4c27fd0a74d3e9915533b5194ee70d8c27911b195b38a5709a043403ba73724cbbeef30ad079920d32e7229aa1c058892cebe8f90a84cecd1c307c8417f0a3c180f473d4d95bdde58e8937d84fa73230a966318b15769740658a13b1616d97e9b5e629f295b5e2b24c54301fa440f2043a49888dd22c7b2014c3209e9b87b57b8621759a4b49e89330c11d1bdada96ebad847baa9fd65dbe294a1d896da48b2c417c21e281e71657fa717962abc6deecf520857c9990ba3d398b6643a05fa98ff25057d2429c1266ebfbd322bdea4cbe79ea1a4be3669b7b7cee24cdff3bd8fab9fb96a724603411fd5690470eb6a82bfd95161a16423b65f717070de6751b4f53c9efdd649b11b6f6c5ba9d00bf6e3b3e2ef94c52cb5865420198a1e72342b25a0eb9644c08be34ffb9fc2b5a49297d925a565ac875f3eb43fda9f437b25799ab3125002ae2c753521f052ab365dc0d99fba4cda3d7aa87b8beb163cc6e4f21fc0f3d2638beb88136113851367beb9b69ded25fe828f8b1b0a7106158b528d5b1b36d860ecc27a51437012dcc364027b883dd98d9642a06da1fc6c18c8cd55fb54c225c0dc7db9543a15443b4645a85c57030cff7e32849966c4b322ce0503533e61b1219ede029d0b505668aa4c7a167ca3c4904fae18e8e74f70727f2ad900d6e02992457c67b344a4ae31186cbae89e934228553152d9be3698e530f1932adbf8e20bce14cab7bbca2a949b185fabe22e16dd85ba7dd1271ce18a6456a425c910d98b1040627d4f50bc93dd913f37b411a2c8da8dfb017c990eaeb269aeef51e6f7d059da050bbb95814c8f987a783a934f9d9dd92bc36ae17a44e94432834970618a08c69ffba6dd7ff4bdafa76b21729985edd2f52866a14f3c4a8c7a7895de9a2d87b352a99d341b221b03f54c19aad770bdd9a43d590bb191e70f7c01b2b57b7f3b649b89011f81669bfbd7ec6e7d838d3a50841205653b5b14c4d0f6bee62c584d995759dc78cef731fe48b7ebc74ee3f940df5edf153a1ed3f204dc2dc648893ec8e1150ab90d2e2bddd5a148919a26f8115f0c6", 0x1000}, {&(0x7f0000003280)="879db20c2aaaccb50a9caa0f9e1546155532fb0f53333c28b1761e8536e1ff4208f240774b15f5230aebc192d9e5938b03f303e32c77ddf0fe4d808216f8c20b0416d3ccef12e93f8dc2b9dd07a7119fa1945197830b3886bf41029867c3c63e89e348db7172879895eb948981f14b1863bccf81572de459e4f8f1ab01530fbe228d8c55846c7c75a11d122e0c82966e3dee265a02e0b7b117cc66792842c87964794aeb86e79ad75ad231ed62dbbb6f7ffa7d91bbc0f9", 0xb7}, {&(0x7f0000003340)="3d02774175c484b9e0b98e030d10f68b273e5359a88a319de7b6ee3e4e4bee7c8a461cae28e4a59bf4963eeb4283ba6639222dee1e20d72e66d8d0a0753decbdf26831166d1c5eb71d93a737e626694b1759911b95881be122777c5a7ac39833e5417cea4873f5a5672ff66e45551692a0ef3b3c4789e7d094a841885ff91eeb7a4f07d0edba7db08311522f100147c5c9b4cc60dcd491cfc45db523356f92a2ef55c1713665aebac6ff57122cf4670bec7d540a6c10f00edd06fe52df5ff43dc9a7fb4f0af25dceff2b1364c6955dea20c6a10c1d4c97358108979f98091d80cd2af89d6d8295d8dc1b78715dbd4fb81c213281579072ec21cd94bae174b5ed8e679b7a800a03c223b129c2d99988f89df86f4f40c09e7f2f93d0b79b6cee26deada8674d6d33f8457114d7e026c623a7241a5e614995e4f0b630eb634e6055a90fb2e9083d90cfef8204285768f43675827a292cd6db1c35e37a806fb9cb718c38afe5d146d469f18e66df20fe9c2ea8830808dabb92da31e6eb6a5c84e924888de08fdd35c8071e5785a610f2e6acfccafa97a3cf785b0b979a6bd17f835cb58f06a018637244dcee0882d93f0b3db18e6a07868b97aaca1a33933bde6b8691235f534c75033186291cf375ea4bb5cfa28c8edb0de560b22ba2f055c5e2de6c37bf641821626b02701a81de25ccd75ed5d10a3c0e16e7705f27b1f81cfe525184e4f9bfe073bbc7923f1b53765f4a761059e792e4c7d3447adf0d1bbd9279a39e4c7f0e624d2bd4b4004d2d3c890154eb303fd68b5c5a524751cc89f8f32c9dd067e2d8c6c3dfd0779dcbc3bd2191420beb6e5887370e61aa42fd24e6053238edc4efedb18fbcd5c3e688906645f2afdf91586f02e3bb20e0ccb42b0f7b2775c53230ec7f57877070d12eed17eb2346b57cffafb5632ee0eff7fae4fcb0d9152ee168b4018696eeb3cf81923bca9bb547ab9b28344594bb594982457273f17e2d78b37b7b31ffdac08878e851700b75cc5fa6dd344697d9c7b17ced94d5c504d6737a4958be6972045bb3f29d8aab9339989b38a9f126c9b8944ff070c8bc2c2046086febc9dde6c77154a55f27ead0a58e510ab0ef51c2c5e41f7b47b329f1726063daefb2c6ff57dfa5a378a8b34044ab69cba698ce336c5498564bbd572b4d889dc26c633876cbb9ae89d9b10f4ed051be724bb2e4ad64317e3f78abb0f9de856b785c495ac08a6c1c97acdea22ba83c04af8c30bf50a67b82f47f8c24a05847dec6a3fa282d34b8addbf233234b8f24937a8264483da15c357d4e6d9433f99e853c408452b1e4184f62d833265b8f570e3e901ebc7968333f3a5dad57d3652c7ce1fc9e372322386a81e1a01b748736536f0d5563e5c62be5fdd276f899565c3cdba53b64ef5e6ec16fd340d290ff6e1649c2b3c9010d702d3276f9403b99d9b1feabeecd14d13a6d8ffbad794a9728cc94069594f71a5bac3211e6b80d2ff9dbc70de1757adeb95a0ac7fc83cb7e003b70bf5065f1a248346a855715eaffa9c38b2d129a3f4eed32be23221c2cfd57c4acd853d3989d7cb1cb882b029433c9119fe6067976ed8085f49fc221c052c517503f2f8dd59f9787d92a26824177274a67fdb7057450f4a8bf7e81e10fd0981e6922fd4d707e0041a6ce1fd0f3b272fc5a3e6234bfda6d1ff39edfb0a01e68f70c744ee6fdf4e23c36680b6b131f7e45bfce4cf48060f0c4a67f505d3765be9c7ec5b8be17f0d76479fc0816e1a7b823d2c794c6d3b7f418fde8f5bcae16560bf23ed41b53e75952be1fac550071672218cf58a27cd08e0268fd12af87e63401e5443faa275e537fdf02ec2ca7c34ba347c6067054809344fea31c5c856dd5d60f0da5bb3d2c5ba6eedf8c015a3ef84a932f28c2694d553ad1f531eb4e839ae16d7d53db52d39ddda386df4f3c7305c7af75b63a9b0af12111f273fba82285d3c18e38c83f5b0dfccca8c8b49420b59f0702062fe5b4453a0082de66c7ece1f2f0ffcceb72c8e84bf37dd6ac2f976e5a8acd5a7318292d8a1a57de6da04471e5470c220f99f158ad989e4ed98e268ae05356cf0f706a1079e8150b36134f242ed2f08d9c9bfbe2e54333a4f1b57e44843f79ede5f2cf9db256ac2054a6053b32a5370fd1682fec71666b7d29b64c9b924c779185006b37bc2bf14508e4587fa6b2368cd20ab010c9601655e615b46216fe847b63cc5fc8d561801e61b3dd16bab09d29eb3680669016749bb6b2e1aab07c4b71941aabedca792eb21d01c854410d47f929d0da7a88b1cb366d842734998d5b4a68ac8c412dd950002ae6643f9ace4509ae54f6b72432f7ab812aa2fe4ce1a304b3a7f8b517c3c92c9432945c265f5867f8d12de8b0c05898c86670af6d2003990c395ffaa76e159903a9875c1a33dea1f31094daf812465a72a16a5610cb4e8699fd1a764d4d5ac00e2b543dda2083e4a4af08f2eaa40e974cae3b9a8b2c89f602ed8fa3a264c415b3c14e9daea63cc65d64f3114380757c130718029571076ccfacd54fe010461b1d471e43a8079b5d8f79e2a76d24375c5928639e3f75fe2a0c32fb74b648b1738c4bd451e1dbb6429353a3c441d2699700096b01e9824563fda22a9864790c314acc08ed9cef5066c57b73feabe92684b28f69ea6c1165e976fa5edce285c37bbe54b9291adecc0572c6000b202fc67ca7ee32088760d4b55e2ee73bb5c74f5330eeff780d59865e41df029ea3f750cb86d22adff056881bd1452667b9a6f243e64c01521cea74deebdfd73d9d2d4e64d676af4e0b90e9183cfd02b6ebea85410295263e179f0416c6f40b1643f6160e542fe1f345dd27b2c958f442f36c82745f388f2d8b8af87568cad6da961f3a71444b30a8277b01afdf86917e2c9b5ee31d5878fd4aa2931706c00483e77e5e1fa943d2ff97ffd6aacdf9895c9082306d70a94c917030029bc60715e1b8e9eda2290b9058905ac99c3562f1561aeef2be3d06449ea6209217cc2c8f9cffcff735e896689b391381d66631b22f2a9d2f2e690b0e0f9ca39d37f4260a273df8daa99073b7cf279e5930d1d18fd66da14e282f8504ecb9248abfebde9578522a6306051298b0f459cb1a78edcdcc18d2a96dcc4f276bec374fb2ebacbfae1885dc5fc80e809adf7734dd8b78200417ee2e784b3bb54a1c519a976d33b427e9e296066ba493721fbaa3b7bdbea923d90d22aa40e98b08539d451f84f740a5034b044bdacfe8fc4e8e2305aec7c57d49acb93e1bcca74bdb051cf5c07461899072f5d18487ae89c998282c15203652d0423e6d4bfd81ac201be37a59d5eb74009e1a7c1bab43d8bdf926058955aab7457dfea06377a83effcd212600297434d7906a05c55508d90fae8d61c3a27b6fac45ea147d07da10a2d470104f49d9205461f98856cca94e849bcea96af09ac170ee6c67f565c498aadde0ec837596d1a8d6384e319b87ee6ffe8887621677f9f25e5cadd30eff34a045bf9096ebec78b63e565cfc3539937c5221c5ac4a89a234dc009bb381379a78ac7ca6a48c844134dd6bd6667d433cabf106f8c6546f6aee3936c6f56b1da1cba519e597c05d4d1a29d8a97d6ac87b5edbb91764aa5ffa4bf58feb97db2204e6c26d0fe4860562ab971090b4ca1ab3dbc51e59f2c32a4c7416b3f866aac6c628cdaeee2120367a48e650939d2df1c78a47ceadd24e18dfe0821379b5abd9cf62b66f8ecf5f3041d780ee43eb9420cfb9017d00ad91a7a1d03674885e3e52527ba2c59321c72563ee0b6594585006710f797f3d0ad9a569a284ce6a31a35e197e873794b17fd152aa5d90957285bd54f3737a154f74ccb0bf9a95755475392d0e011554b4f2b376c9e99444443baa3947211b26c1491b1616e56cc0670b45d6371a8a16ebb772c69b0f85910e6a505e39d2dc4e783362f1e282059b5b6b6afd6135b1f2d75bcdc195523f3cd88d1c12fa97c091d3648c751fc397a4f8a4d6b5b3ad8da4c32359787f285557f91876017c1b9ff887058b1c51d9105ccc6a143705755c8b8da7ea142f0a1d1f9df91de580cb856cadca430f876b91917c28354465cf6652a513f31b2be5ceed499da8275e86bb1d5694dd79ed91be090f93dffcd5d6f63d740f1b3813c507f80f0cc71beaa4cfdab35819f6a52d78b192d9fd278df3f3d813f64da607bd00ea15757c1b13a48cc1ea5c3716cfa9fef40c1ac3bd22149a7a3ec4a9a34129a05bca5c4f48dc9c63d9f72f625fbcb4fe124c1e4b4d0eb7316b709b696f78106ec38c1059ca7205c4f4068578e2b507767bf6d203fb3c19bf60c40e040ac81bd03736e359d9fbe9bc13084e55bf1ff2ff124ad8c1bc57ba27577dbfdd43b4761f93da32385308d5733aef4cc58d5480c308d931b2efaef9c243840b47bffabcaf76d910a7bf280c6e23e0fc12d94d65d1128bba9ae98b9ab11c2d0a175d395f140efc45a494201ee6cbfc040d3f11bad165c96ba18ee9cb96a0a45cf78810fe2272d42a47bac1f330e9019f5b8f4ec7be6da3d5d2efe99993f0fbe9d262dcf5c015de83a1876f5ba1c6272cd52e291a36b695ef45dfd282335c201a9e0f96beecea882cea7dbe9f15480ce6657ad9b5b1fe991dafcbeba12f85a11c92506b2248566253905bc68df53c4416040cf3477aa067ea29d851aa9a7574d7d82340459ce900b426f66eb62f0ed590bfc3a45d9025ad6f1168db113e7006bcc51fa9b336434df41109dd73e0e9a098d6f3292136879f1f096f6d92eb5ef16113609cda11d1732990ebc28b483b77e6fd294200570be2430d08f5d9fe467faebda82b8ca1aa9fa7cd95804b2b8480ba803721d0040cb2d2fb5842aec3aaee557c8d686612cb7d406d1eaa89c41ea62f784862205aeedde9614c301e7ebd90ecb38a9a6ce75b66c0bb53bb6e0640bb3ef95acd6e873c3e14c80657d5ad46d91b470014f70880533d16a3658da08af0fd938ba155c7fc7e6828bf54b5dd8957281e7840e0aec10a61389a70bb7ce2ddbb13387de3d3db305f7a1d4eb966093292bc0cc9f4319015e3063c7dde6b84d2aceea8cc3e3aa904c371490a08316ed37f3301ed44b85b82fcb8ed043eeb35a0681b82d3a7c68362994220c00fde518409084f0397e4c397f9e97c753187f1e46943c868135507a47624cc0581eb0c4a7bf1c54413378eee3c1d09f1b2ed0795d56ddc9a2b9eeb826163254fa8a3a9445dfd34ad4164de3fea26032db5e8b2f7b4e3d10d2c6febfc302f1b176dcc482aedef7305119733fe84a98a589f415fb9a3c500f06b7f721601aa46ed6d8a334bd39c33b9e17c8482e3a8e9243ea0aa4ae75a59bae55dd2ebf5cc006efc2e44e6e886a48ac3c79b26c523eab3849ede29b2b86d40fe4e5197dd51213303ac77ccb01def2d3ef9b15fd1e6e978f0808d3507c1e52600aac77f5bc2d9bfb03b8c9f70bc8466b929c3d6ee4130e820513e5438f90db69f43527831c8a48e34c38c5233b987a51cfe28d6f2f408adb64b22678915fc967d374caec1d13b270fa7fcc9bc8d840e04fd55bccb6d93833490c19d0a3f9522d538e4feffa4f81a3023f4c35bf41790d06fece0946a4198309143421a502655e3c903fe485a93951814d9130b1580ab1efee3148d1cf2a65fa9432f271731735d1d7a770b8c9e6457e5c10d764bf08c91151e1ae3962a9219f10aeecc0abe04bdee2f577d3beb97e7e88f00c774c3bfcdb1da1258137789331ad4735e31e8c5e4b2a5848812530832412fcadd3d52d9275ab512", 0x1000}, {&(0x7f0000004340)="903a4468b6c60aea5eb57b38c6", 0xd}, {&(0x7f0000004380)="bf263659a97d08d5dd2f80fd0595fe28665f3a2c8a33fc5dd92db5a72bffae95e6c5a9a86672b139ed64614eb4b1cb38600b17a147656b366a78f72e87", 0x3d}], 0x6, &(0x7f0000004440)=[@txtime={{0x18, 0x1, 0x3d, 0x1}}, @timestamping={{0x14, 0x1, 0x25, 0x4}}, @timestamping={{0x14, 0x1, 0x25, 0x3}}, @mark={{0x14, 0x1, 0x24, 0x55}}, @txtime={{0x18, 0x1, 0x3d, 0x4}}, @timestamping={{0x14, 0x1, 0x25, 0x1ecd}}, @txtime={{0x18, 0x1, 0x3d, 0x7}}, @mark={{0x14, 0x1, 0x24, 0x4}}], 0xc0}, 0x20000092) ioctl$FS_IOC_GETFLAGS(r6, 0x80086601, &(0x7f0000004540)) 20:36:41 executing program 2: r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x102200) ioctl$TIOCLINUX3(r0, 0x541c, &(0x7f0000000040)) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000080)={{{@in, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000180)=0xe8) fstat(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r0, r1, r2) r3 = openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/user\x00', 0x2, 0x0) fsetxattr$trusted_overlay_upper(r3, &(0x7f0000000280)='trusted.overlay.upper\x00', &(0x7f00000002c0)={0x0, 0xfb, 0x8e, 0x7, 0x0, "e7a50f7172375b3a48251c4c1930f7f6", "a486b1598088d77d7cb572c0ed491ed4b9e7884387a8fdd05d62e64a857360176d143d6c91df9f45fb237967d019a65e58c3656b3837af293260077caddd7e49bfac688031495b1fcadd30d5f082c05011b8eed31a7c10226b26788257cfb4770fece53f3fb73f977bca6bd017f0c4577bfa38d5411f570293"}, 0x8e, 0x1) openat$zero(0xffffffffffffff9c, &(0x7f0000000380)='/dev/zero\x00', 0x8080, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) r5 = accept4(r4, &(0x7f00000003c0)=@pppoe={0x18, 0x0, {0x0, @broadcast}}, &(0x7f0000000440)=0x80, 0x80000) fcntl$F_SET_RW_HINT(r4, 0x40c, &(0x7f0000000480)=0x3) setsockopt$inet6_tcp_int(r5, 0x6, 0x11, &(0x7f00000004c0)=0x9, 0x4) r6 = getpgid(0x0) sched_rr_get_interval(r6, &(0x7f0000000500)) write$binfmt_elf64(r5, &(0x7f0000000540)={{0x7f, 0x45, 0x4c, 0x46, 0x32, 0x80, 0x5, 0x5, 0x7fffffff, 0x2, 0x3e, 0x1, 0x46, 0x40, 0xa4, 0x2, 0x4, 0x38, 0x2, 0x8, 0x7fff, 0x1}, [{0x60000007, 0x8, 0x1000, 0x5, 0xd3a9, 0x40, 0x24, 0x9}, {0x70000000, 0x80000000, 0x7, 0x152, 0x93b, 0x1a, 0x8001, 0x2}], "34f75f0dd6973c3251c7a65686a16f41396e68ea8794ef267e269515906a72f2c5ebf7bb00193fd8d16ce26700536d0a3a227d4d26da8fa54741763147b0257a675881269dd34937c0f20facbc29fead018c215979fe9fa2dfea2dd564fa578015bfdc0a261884c61444224f7db3a819f30024e023c0fca332553c2b41789cca49d3ba76cc6158ce897c83991aac5fb9e8a61eab7a0637e0cb8f9328ada0c77eb7dec934cd6b421cff325198f84203a1b10a691c80b9f1b32edf2b8d4af41bc2", [[], [], [], [], [], [], [], []]}, 0x970) r7 = syz_open_dev$evdev(&(0x7f0000000ec0)='/dev/input/event#\x00', 0x3ff, 0x400100) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x110, r7, 0x706de000) r8 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000f00)='/proc/self/net/pfkey\x00', 0x600000, 0x0) ioctl$TIOCLINUX2(r8, 0x541c, &(0x7f0000000f40)={0x2, 0x7, 0xbac, 0x700, 0xfff9, 0x8001}) keyctl$set_reqkey_keyring(0xe, 0xffffffffffffffff) ioctl$EVIOCGSND(r8, 0x8040451a, &(0x7f0000000f80)=""/171) pipe(&(0x7f0000001040)) utime(&(0x7f0000001080)='./file0\x00', &(0x7f00000010c0)={0x5, 0x2}) pipe2(&(0x7f0000001100)={0xffffffffffffffff}, 0x1000) ioctl$IOC_PR_RELEASE(r9, 0x401070ca, &(0x7f0000001140)={0x3, 0x401, 0x1}) memfd_create(&(0x7f0000001180)='!\x00', 0x4) clock_adjtime(0x2, &(0x7f00000011c0)={0x84, 0xffffffff, 0x4, 0x2, 0x8, 0xffffffff, 0xffffffffffffffbc, 0xff, 0x100000000, 0x1f, 0x784, 0x3ff, 0x7ff, 0xdfa2, 0x5, 0x7, 0x7fff, 0xba, 0x6, 0x3, 0x8, 0x200, 0x9, 0x8, 0x3, 0x3}) link(&(0x7f00000012c0)='./file0\x00', &(0x7f0000001300)='./file0\x00') r10 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000001340)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$KDMKTONE(r10, 0x4b30, 0x1) 20:36:41 executing program 1: arch_prctl$ARCH_SET_GS(0x1001, &(0x7f0000000000)) prctl$PR_SET_PDEATHSIG(0x1, 0x9) r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) openat$cgroup(r0, &(0x7f0000000080)='syz1\x00', 0x200002, 0x0) linkat(r0, &(0x7f00000000c0)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1000) r1 = creat(&(0x7f0000000140)='./file1\x00', 0x20) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) write$UHID_INPUT(r2, &(0x7f00000001c0)={0x8, "b1506099d379095df8acfd57102b52a9265d0285ae00aacad61d1b9bff746ec841dd766ed1156cbff2ed5413253e909a892ea50d8fc755271ffde13d3848b8fd55fd24fc92ea572a4f05842fc7dcad1dde88669b53a7ef2ac9a7f568d8fc83f2664e7aa5fdf0501c10ca275b91f8a7a039a1476edcdd71e04bcf0e82c6377ec45b012f0ff4b65cb3325ff1b215f00fd3d44952dd08fe82086ff84efdcec88bc3506ffd25abdf7686af4ad7b727a22d720d90ecc39bfb5f61b0a283f5900ccb55a485e3b02b8a402c67407773c39152cd24e429858e3605cae5ea9b608845e1770ef4d61f6ac0d22038f1925ca103055a6a1f2dde1abd108e44387250023ae158285538382e5faf20c0b59c84b179886b4b0fe886ea2d3524a5166aea84c23f0af050602a94381e2ee5b724c9d0619dc16c8c3b7cb8003f36f5b0dd056769a8491033a83f883f1e0dd19deba80260b343e7e6a24cebfd017102fd77211f96325341bd750601ee9ca05ab84dfe0af1c34552275b97e07c5b438e11c6237d88580330112d6e4b74aa4ada3210a7e013293060997c22ace7611a937b08f7b47ef2ca6b1709de16f5e3779e84c1b04f194cbcc161e7dc5bd565cb6b69a0fafff7a52156789180f69917e47d8ecce5bbde403db03c5484697e4de2679325f10e8f639f4e15d272e1ac5ebc1e5f909016dc1b075be92a4d8370e009fd852770c89bce260c2df467e9b93c3977f461ad715c325c976ea4da7dd143c3c01a63273b372bc61530bb06ceeda1d4dca1f974afc2a0bca9e303afaa807f698d46faabb4392180b33f70475945f762f7106afeb2330b96c9a60b88e60818170b338fdfd75ca26494477f75c5f45afa1d0055874d714059b143422307abb973be75544d7279b90422c8962dac4c3c4e30e324ec620e22e131d51fbc35a19cca48bc6f48f099107f2e85960e0c0311b01f17aad0d4619bd152d1b35d86061fac1e94ed99add30cb30a3c06e5ccabf2759592c431f3a698dec29ee76d5d677a62b48b11931c39a29c3ee04b483ac531804159463ae21d6238e8a0f3da7164b5ceb56d5d5e58a2a06c76580ed52dfaf79054d43c4f12f60edbb6f9f18f62481aeddcfaeaf2ba3cb2d7e27a1ed064befdab03378d26b88e054fab3fb54a3cd4b786be770181ba9039afb180026e6f7da0b75a1fa29cafb9948ba0e11d8a0569d33b9b6a616c38948c33eb01df3ae79629d8cca7b7415860c7ed747dce6aa2fb18001087eada4a8c7b31a9116dd65c26d99e2be23f24ae0f3a25915d454e2eeb8232fe0de88c550a573215da15a8fc54ae6e67336471a8a3ddf865d1d1810c0e7414ae9739c96606b5dc8ec7d8b44c23a679656b92f78a70185edb66d3e76228ef81865bb642b94ba9c8f0ef0c33e207b25594c433f2a6466a0336ba02f72f9be0c5fc4a51fab9d4e8cd50f27f0acf54db5353761ead78a55e62ce5e3569ab92c562f9f5cf3b46b71764544879e729792d977ca9dfa5d0fa79621336fe884eb2a0653f28299bb61c2d53657db297f79b90d5e64f07185ed5989498dbce86de50879d3d818f6b387de0a1b99448074342a34a30fd18d3c86bf123a290dc5d0c2b59e9f330cef2798427dd1d30839c5744cff5a109fc9a9dea482514adc01857db8f66e4268ef45dd090ee6401a59e93254e7a43680c9bc061a120d92163fbb0146bb9a1f7123cce4a08713fe546977566089114041f863ba75f6620d0ebe05f059764efb9b9047143753a27719380339f761f65ab471950dc2ddb9e10ac42d47fd2fa11040c248bb7c59989ccc90efb414c00dda71b255c54a53a9f034f0510ee01fae7400fcb818459699ed54402159e075af4bd26c2e2df96da033bb6d74fa3dce1238d3dfcdf7397b8425f7e394e8033e2bf85630bb9185516f3585823fcac6a454344ad60bbff420feda7b1fb80d5e0db7279d1a2614658979aaa24ab4f5e2f80451aefd20f7b42d39ec160411b09d75d21805787817ed4d21cd37ac0700ecb8d6da38bb62bd699faa5171b3095f793ea8687c33dadf25b30cf828caa086761eae5a4d545304c958c22b85c4b91d9ec376158386a9c95387dee0d4fe9928e671819fedf6913b7d809778ea7480638a3c2472fdd6814ab6907986dbfc26bb6d1742d4d379d24a70f42b6b4b8a99683ee3a2d7576b4c768af2b6a5a4dd51c7055fb971670822c1131340278b79b28b76867667a38993c99e334cf72bca62a041f8eb6abffe00e8ca786ca106e99df01f870a5577fe3424977cd724557aed52e45302d10801ce0a1e6a50872622778d700bdbb61f126061961106d22115d8e4637d9d042b5175979abaddf14924d247cf6ab2925c0c0cd89de56099c49aff3bb6f16864a1c0da4aed13950cf6a715b00e4b2dc74bcea8cc36b32d5739dfa801d95d16b15f2fbbb8e9315c51889d0edabb192e7fd789db0216f371dfe156876ebc3e068304bb2efc37255ad71a9a72e6183092216997c535cdcecb638a7fe24969f88e9d5233b38a49ace083e0b53e7ba3014dd39e9f7ffc5c8e86319af69bd013c8f313fb144ffd0daee11b0f1c23c25016900b69dac298b775205ee5816a1bf1c57201f7ea9ddb2d40ba563f2ef46a1248439fec44fbd3b68469777524318b1fb0975b17b0b9b08e300993c5352ef222f22d74836dc7186dc85a95777731679d1e7feca2d72aa5f82ffe5b22526fb95a12c96f70598f6f054aee896ebe1f1005e193966219f34644121b588d6982f279d2e9ce956d525f9c4c592a8f2661ec64628f68ad577e9cfd258d9876f1ecf60f8084a3cb8544214252dc0eac3d92e1c2bf7add7d08719f2f40df87e3f31724d48e460bfb7cc30c3968f2927311ab5f9eff0adaeccc453ed568103d2683cf6b880250fac13d12d93d5695094e913ba49a415b9b27e19449452eba1c0644143aa389ee86aaa4eda384dc8fc609a8350a43e1b67e01fb0630195efe0ac365f4f45826387fe87935546b96d7865255ea5171651d2719ce8f7cc7d1efa4f20e8c606eb287feb6642744a334d5be61170c2441dc63948ca62eea2bbdefd60f3a02a7fe037613664690c8d945272a2584f2b1b2457d795d813249e761ebe572fcae3ea710370b94a64e9ab31b4660c36abc77457ca3e1c0537770b9fcc37f5d06a3e1e840189e7b0db914adf407bebe4fd650739c94bff5412cdedc105415238e85625c8551c6d989d10f748fdaa422d33ece164ce2e7dcc5c7b01fde65e93998d1b9aabcb6569985888be1f2bf5a1cce8598c89ec3b01a7cf5fc1a99a81da64d6bf6cdb8c1231502e3ab4cc6feab728db2d068aa1ce341c99114c8efa3aa508c8e5d4ad6031015c730c40ee4b2788aa5bf5eecd6b39aa3abf37ef15c2ab84b90d19d62bf38bbb699badc0b5e138aab9dde903961d68313066134e3944fe4ca84d96c4ad1e7dd6f4f3ee66f5c0cd5677946046d70157e0e0411ce1993ab664929ff14f9f5e569be5954e8de50d96119b477bdef4e7b5ebc5e56cccaccaf0ba5e26cdf6972e1275f976bd53914824af68e7e4100682ccb75a5b3b134ac5f2a011df930634cfc150974b02219caa9b2d3429e9b43f02bb3d0ccc025118fd8580da5d5b8a0f00b78553f15540c78f8f51fab75361c2a1563be181285b17f9b364c09c495294d329f356e9e384ee698545b393f3ea638864e2b869212ec2c5ee2ae89a2875eaeb6086014d5ca7dcb7226cc0bdc2d4c55b0ffec6b06063c2f11e90c4a1137614dd174d7c67530d59665794987356bdebe5a609d4ad2fffab57a19cebfc8822a17f88127f0a9e611735a598d0f9f1d4e015fe9c8658f48355d66c04b5c7dae2aa5e00de733588d64e119fdcc337b607a172cff284dd61cbabdf5db6f9614e660773d31b2e3930a01907b1012a216bebbcd077ddd7e71978318fa917509366c54868b8302066e8d066bc684bf03dfab75e0b659963bcea79405a01caf718135ab7b0bc06a2f57834057f0abc2ca1d2b3544e1dbdbccafdf50dfe855fbb39d6d7634c89061672cc089c93e4976125a4821ce0d37e0523d7a48930bcbd2d0ab9bc3f7ff5fc80c9616a2c6c071c5ed57b8d4419682de27d4f598e3a4bbcf9db586ea02ac5a7574e6e808fb793ea791e2d9d634fdebf1cdb29fda8db40bc6b57e0324afe16f6380f61fc6f960eca77180312c370b3a5ab90572d5c51dbad61b6ce9f3511175b109398e2cf7d5e175fabb6a74de3093a9eab259d98fa9559eadc0ee2fa2c2d398d319d17ade3891694e264e5846fa40382428769e518545a4fc0e5190939a66bd0c64d0e39ffe521acb0d93dc69f4899723d47810a1c21faeae18d9a15b4a74b2eb149cf87d66b9d1172f607426c9c81eb0fc125fff63968e3f99769e267c316347a1d8e3d31aeed47a049dc5a2f03e361528616cd8f34f676f42cd852dd306bca0845734f245df0e716bef8befbbd01c9831a7a68b1ede279b95f8b8efc9ebc1e38bd16e91d8b45734d3d1a10f665a6297faa867a421c5387c271c2708d4235a9ff6018662d21f44f5e4244baaee1cf605a3d24c15ec0f764a08eedfd24f6b5f2083833e47ebd9b6b238a93fa4410dd0b71f65ad4ed0d23b97322ca85653185a2f2b87f04ef8f2ecd409af9c7a13602e6bd31496e4f8075131c0406640c81240e21a39e9e8bb124544195c52f07d62dc4c549a3e4a5039be88793839cc77ebbcffb139693aaf9e532a1e82e0ce4a62b28907df5afe48c65fe60d9fe7b1588caba1bafdb2cb0f763894ee4543a59449bfe4df34f1ee749fe80ad6591441360244a4a22ecd336da253471ab8ae4b8779427b48185ce51ef5508fa7176a87a0160f742b720f9726e19844b6db4d9abb95b861c2dcb156e7d477e4925a06799fd7c19f58746195fd97d792c448da2440b485880a4ea4822ea4efe091a81c4afab6198c2c46990c97a1ecce02ed2076651d9324161c66e2f3ab776c3912bbebfec672b7af2851268d88742e610851964244d61cbef605b44abfa85ad72e4f7de976f1148baa1df7d19f88e162ec87618b12db4654efff0793912db22e0cad74662e7c15ca8192043bd62469e2fe067a5011d67f499ab902903e3c14083e35b3a1e345dc6a82bd939fb214763455e6d20190b0d428595f4810a47246f67ee8ee1c515614b5c2c4f0308f6af5aeb2c308cacd36192cc2d09f530c506c10cc13e8c03a5467184085b39ee00c8ff02b3e344fbed6fb967b61632db52131cb54f1b9dc2edd6a4ab6bfdc35cc4e7c82680d06a7d5fcf9f0c55d54d565072a504976bd3afd6509df3f30fa613d264bc01d97d82b174e4b33c2d1b7eacf3d82b6bbccea6227011f0574be3f975ae05b3dea122246615e7d5006cc72ebb6049b3a880125c99cd4dc2e3558e7c38fb59c8f12d93d9aef8c94f6c7bffa0747e981d042cec6ccea335ec98327ead15a53666b6db0ee7236e58b7b77d072e6676d66968b446982ba40f1f749d9b1f57d0245c3a4b84923d04f28f0f167a59af0f3d4c69aa6aef44272cb0e02320a5a55e88b93597f5650e89daabee41d2529ff07d42de87f3ae487bce74285fd702da6266eff019a6e5b82c36c36634ece89fec61a2fe7ec86c0fb6091f9594670e9665a0f870efa86038c03bc9f4c95247c2dc724d596a93318fc7a9f18cdf8bb0728bc11e2fe94fe267d78ad123c144fefc1ccdd533a9537fe2a9b69cd4369f8a98303f45e045678801a98c3fbb6db96141f4f82a54463b1fa07f0a6e1c19cca1ac348c8d414bc51ea4f14ef2ad2c7879", 0x1000}, 0x1006) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001200)={{0x0, 0x7, 0x0, 0x211, 0x2b2, 0x1, 0x2a0, 0x81}, "e68c70ff80d0e1471add7e9641322a1c014f4dac30ef9493523d256c14e0c31b1cf98c7bafd19d5ab8818168840cdd584dcfe583c40f8490b5e58fad23452df5cbb0706720b989dbe59ba3ead34c53c41a15f2deef3f6de809e650a7006c9ee2771cf88eb489157255bb", [[], [], [], [], []]}, 0x58a) r3 = creat(&(0x7f00000017c0)='./file1\x00', 0x20) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r3, 0x29, 0xd2, &(0x7f0000001800)={{0xa, 0x4e24, 0x3, @remote, 0x50}, {0xa, 0x4e20, 0x4, @rand_addr="631e53eb697adcac4cf594fce22a76d8", 0x3ff}, 0x401, [0x1ff, 0x3, 0x7, 0x2, 0x20, 0x7, 0x1, 0x10000]}, 0x5c) r4 = accept4$inet6(r0, &(0x7f0000001880)={0xa, 0x0, 0x0, @initdev}, &(0x7f00000018c0)=0x1c, 0x80000) ioctl$FS_IOC_GETVERSION(r4, 0x80087601, &(0x7f0000001900)) r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000001940)='/dev/vga_arbiter\x00', 0x200, 0x0) getsockopt$inet6_tcp_buf(r5, 0x6, 0x1a, &(0x7f0000001980)=""/15, &(0x7f00000019c0)=0xf) r6 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_QUERY_BPF(r6, 0xc008240a, &(0x7f0000001a00)={0x1, 0x0, [0x0]}) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000001a80)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_PORTS(r6, &(0x7f0000001b40)={&(0x7f0000001a40)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000001b00)={&(0x7f0000001ac0)={0x1c, r7, 0x2, 0x70bd27, 0x25dfdbfb, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x80) prctl$PR_GET_NAME(0x10, &(0x7f0000001b80)=""/4096) r8 = socket$inet6_udp(0xa, 0x2, 0x0) lseek(r8, 0x2, 0x1) ustat(0x5, &(0x7f0000002b80)) openat$cgroup_procs(r1, &(0x7f0000002bc0)='tasks\x00', 0x2, 0x0) r9 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000002c00)='/dev/vga_arbiter\x00', 0x10000, 0x0) write$FUSE_DIRENT(r9, &(0x7f0000002c40)={0x88, 0x0, 0x4, [{0x0, 0x1ff, 0x4, 0x3f, 'bdev'}, {0x5, 0x3, 0x5, 0xffffff7f, 'TIPC\x00'}, {0x5, 0x9, 0x0, 0x3}, {0x4, 0x7, 0x8, 0x7, 'eth0self'}]}, 0x88) ioctl$EVIOCGBITSND(r1, 0x80404532, &(0x7f0000002d00)=""/142) r10 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000002dc0)='/selinux/status\x00', 0x0, 0x0) r11 = syz_genetlink_get_family_id$tipc2(&(0x7f0000002e40)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r10, &(0x7f0000002f40)={&(0x7f0000002e00)={0x10, 0x0, 0x0, 0x4000080}, 0xc, &(0x7f0000002f00)={&(0x7f0000002e80)={0x80, r11, 0x10, 0x70bd29, 0x25dfdbfc, {}, [@TIPC_NLA_SOCK={0x30, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x15141911}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x149a0000}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x3}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x81}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_NET={0x28, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x4}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x4}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7188}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x3}]}, @TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xfffffffd}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x40000}, 0x80004) 20:36:41 executing program 3: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$TIOCSBRK(r0, 0x5427) r1 = accept$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f0000000080)=0x14) r3 = eventfd2(0x81, 0x1000) sendfile(r1, r3, &(0x7f00000000c0)=0xfffffffe00000000, 0xbbb7) ioctl$EXT4_IOC_PRECACHE_EXTENTS(0xffffffffffffffff, 0x6612) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x7893fc089defb10b, 0x2) ioctl$NS_GET_OWNER_UID(r0, 0xb704, &(0x7f0000000180)=0x0) accept$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000480)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000440)={&(0x7f0000000300)=@ipv4_delroute={0x124, 0x19, 0x1ad, 0x70bd2a, 0x25dfdbff, {0x2, 0x80, 0x90, 0x5, 0xfe, 0x3, 0xff, 0x2}, [@RTA_METRICS={0xa4, 0x8, "81c21f4ca3f0b95122433e6803d2eb570e93846e5b87bb5df62be8f160fe0ae4db3c971c509218c27ce22e9c7da3360a1ff94aa524206789d79798396a439c3084206deaad5ff622c1fc69cf59b3fd55b849ce475bbeb9350e7c17a990f6a831d6117d5754fa857f727f8af45b8c1dccf6831f63f9019ad94513378716016dac9a530d5178ebf1567196ce797ee212c0a5b87bbb1db4a5c3a1e9dbefd3f01f"}, @RTA_METRICS={0x44, 0x8, "eb7e2550a181e2f748a77e4a2baac451577ed7b2e3c7f5fb263e1f52c0d8435ff4f0c07f0d5f4ecc48767eb51772eade4734ea99747abd606a97b3ac2f"}, @RTA_UID={0x8, 0x19, r5}, @RTA_MARK={0x8, 0x10, 0x8}, @RTA_IIF={0x8, 0x1, r6}, @RTA_OIF={0x8, 0x4, r2}]}, 0x124}, 0x1, 0x0, 0x0, 0x24009100}, 0x4002) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000004c0)={{{@in=@remote, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@multicast2}}, &(0x7f00000005c0)=0xe8) setreuid(r7, r5) r8 = accept4(0xffffffffffffffff, &(0x7f0000000600)=@x25={0x9, @remote}, &(0x7f0000000680)=0x80, 0x40800) getsockopt$inet_IP_XFRM_POLICY(r8, 0x0, 0x11, &(0x7f00000006c0)={{{@in=@local, @in6=@local}}, {{@in6=@empty}}}, &(0x7f00000007c0)=0xe8) r9 = dup(0xffffffffffffffff) ioctl$sock_SIOCSIFVLAN_GET_VLAN_VID_CMD(r9, 0x8983, &(0x7f0000000800)) execveat(r9, &(0x7f0000000880)='./file0\x00', &(0x7f0000000980)=[&(0x7f00000008c0)='\x00', &(0x7f0000000900)='userem0\x00', &(0x7f0000000940)='\x00'], &(0x7f0000000ac0)=[&(0x7f00000009c0)='))\x00', &(0x7f0000000a00)='%em1)vmnet1\x00', &(0x7f0000000a40)='/selinux/avc/cache_threshold\x00', &(0x7f0000000a80)='/selinux/avc/cache_threshold\x00'], 0x1800) r10 = accept$unix(0xffffffffffffffff, &(0x7f0000000b00)=@abs, &(0x7f0000000b80)=0x6e) fdatasync(r10) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000bc0)=@ccm_128={{}, "9e11a153db849cae", "f19737e9f5a80e91dd62886cab3ce031", "c1d0e75e", "d87e7ce71ac9d364"}, 0x28) r11 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000c00)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setsockopt$inet6_mtu(r11, 0x29, 0x17, &(0x7f0000000c40)=0x4, 0x4) r12 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r12, 0x660c) r13 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000c80)='/dev/vga_arbiter\x00', 0x40, 0x0) accept$packet(r13, &(0x7f0000000cc0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000d00)=0x14) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000d80)={0x1, 0x28, &(0x7f0000000d40)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000dc0)={r14, 0x87}, 0xc) r15 = openat(0xffffffffffffffff, &(0x7f0000000e00)='./file0\x00', 0x42, 0x2) ioctl$LOOP_SET_STATUS64(r15, 0x4c04, &(0x7f0000000e40)={0x0, 0x0, 0x0, 0x8, 0x6, 0x0, 0x0, 0xb, 0x1, "9c3281722d49bb06f534ffdd8cea0759eaa0e58b8d46214f8838afc100bffd73a22ba11a892d42c263eb8efd37915a90ce6d6dfb638d97a48af46301fc74828e", "ef0b6b9fa9ae92891062eabf202cdf3e59a9ed50e3ce90393fb6332053d2e235e1601f8e04d52d56e4721390c0a221d68b99fd894669951bdadef160006191c4", "5739c6aeedf49645d8fc284cf05efa7ac0b3b0abfab3ccbbdd99b63cb81b41d9", [0x101, 0x7fffffff]}) 20:36:41 executing program 4: r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x200, 0x4) getsockopt$EBT_SO_GET_INIT_ENTRIES(r0, 0x0, 0x83, &(0x7f0000001080)={'nat\x00', 0x0, 0x3, 0x1000, [], 0x1, &(0x7f0000000040)=[{}], &(0x7f0000000080)=""/4096}, &(0x7f0000001100)=0x78) r1 = open(&(0x7f0000001140)='./file0\x00', 0x80800, 0xd1fc2120dddc5bc9) getsockopt$IP6T_SO_GET_ENTRIES(r1, 0x29, 0x41, &(0x7f0000001180)={'security\x00', 0xc7, "a0e7714f20993a3843128942a6069cd929ac6100d50522f45ad1d2aa5c9c0a56bc49567d1cb44d55a65e94909627723c7db8067964f2ee965355dce1eb8c3cf5c3a7c6f8dba1c5dc988a5a722c35e754ad2eb964a9e615d64deb1fde2e04b454edafda7e4987c47f13392d4eeb080447912d3ba2efef226c4efc6834f32ced045bf1b772e0088e1d6de8713d1e0a8c7276ffcc9230500d35173008fa35906a5a8b9f66d60f85e894cebc00f4a8b206ded1ef6f61d9baa98e5195cf4cf1a53f6995a72d267fd52c"}, &(0x7f0000001280)=0xeb) lgetxattr(&(0x7f00000012c0)='./file0\x00', &(0x7f0000001300)=@known='system.sockprotoname\x00', &(0x7f0000001340)=""/215, 0xd7) r2 = getuid() getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000001480)={0x0, 0x0, 0x0}, &(0x7f00000014c0)=0xc) chown(&(0x7f0000001440)='./file0/file0\x00', r2, r3) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000001500)={{{@in6=@loopback, @in=@initdev}}, {{@in6=@mcast1}, 0x0, @in6=@loopback}}, &(0x7f0000001600)=0xe8) setsockopt$IP_VS_SO_SET_TIMEOUT(r1, 0x0, 0x48a, &(0x7f0000001640)={0x9, 0x8e35, 0x7fff}, 0xc) getrlimit(0xd, &(0x7f0000001680)) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000016c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$TCSETXF(r5, 0x5434, &(0x7f0000001700)={0x768, 0x1, [0x3f, 0x5, 0x6, 0x1ff, 0x5], 0x90c1}) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000001740)='net/packet\x00') ioctl$RNDADDTOENTCNT(r6, 0x40045201, &(0x7f0000001780)=0x7fff) ioctl$VT_ACTIVATE(0xffffffffffffffff, 0x5606, 0x800) r7 = socket$inet6(0xa, 0x5, 0x7) ioctl$void(r7, 0x5450) lsetxattr$smack_xattr_label(&(0x7f00000017c0)='./file0\x00', &(0x7f0000001800)='security.SMACK64IPOUT\x00', &(0x7f0000001840)={'-,-!-'}, 0x6, 0x2) pipe2(&(0x7f0000001880)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4800) setsockopt$inet_mreqsrc(r8, 0x0, 0x26, &(0x7f00000018c0)={@dev={0xac, 0x14, 0x14, 0x29}, @local, @remote}, 0xc) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000001900)=0x0) ptrace$peeksig(0x4209, r9, &(0x7f0000001940)={0xfffffffffffffff9, 0x0, 0x2}, &(0x7f0000001980)=[{}, {}]) r10 = accept$unix(0xffffffffffffffff, &(0x7f0000001a80), &(0x7f0000001b00)=0x6e) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r10, &(0x7f0000001b40)={0xf3a8b4f26550baf}) r11 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000001b80)='/selinux/status\x00', 0x0, 0x0) r12 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000001bc0)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) r13 = accept4$inet6(0xffffffffffffffff, &(0x7f0000001c00)={0xa, 0x0, 0x0, @dev}, &(0x7f0000001c40)=0x1c, 0x80000) r14 = dup3(0xffffffffffffffff, r10, 0x80000) r15 = socket$nl_netfilter(0x10, 0x3, 0xc) r16 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000001c80)='/selinux/load\x00', 0x2, 0x0) ppoll(&(0x7f0000001cc0)=[{r11, 0x1}, {0xffffffffffffffff, 0x104}, {r12, 0x10}, {r1}, {0xffffffffffffffff, 0x200}, {r10, 0x23e7}, {r13, 0x2000}, {r14, 0x1}, {r15, 0xd400}, {r16, 0x400}], 0xa, &(0x7f0000001d40), &(0x7f0000001d80), 0x8) [ 85.820534] audit: type=1400 audit(1575059804.928:5): avc: denied { associate } for pid=2101 comm="syz-executor.5" name="syz5" scontext=unconfined_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1 20:36:45 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4000000010003b0e00"/20, @ANYRES32=0x0, @ANYBLOB="0004f6ffffff00000800010000001f000008000100736974000c000200080055a4", @ANYRES32=r4], 0x40}}, 0x0) prctl$PR_MCE_KILL(0x21, 0x1, 0x740cc5e6d7d98013) 20:36:45 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x8}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000480)="b0a3cdef47f59ec515de0fcb5dfc761cf7120c4312b2054efdc0cf574f65329a05d03a24674b1d94d072b4bd702c576dc1d6e4fef97bdd899d359dadcfe32ba24fb1e152533e4df2c20324dda85d95c102000000d81d2b9bea7f9e468b3da19d62e9913b2f7cd488de25886811470818af91afd3bce1422670d6f2d054d8b16374e3617a22b1c70e7e3104b814e24e6e7b62256ae8faaae5f59f840c029418a34c", 0xffffff47) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3, 0x0, 0x0, 0xdf}, 0x0) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000540)=ANY=[@ANYBLOB="38000000100005070000000000ee000000000000ffc62aaf1408679d596738929d85e98d8c6f1e4616132c5c0a89291188c7f9fc29bc9e93e8aa872d66f45af721278f2ea1d06b2d8794d0969234127b0b34ea2b48e06e495c18be56c55803b04a9b2d44f61f4bd5fe1f24c5bd3e720e99fd11ff4899126c11b0d769c73b40f4f265754bbe53696828041641dad47729da3abbd4719510db9b5105c720699579a3af60c209594d45b601ea5decd9781bf61e53edccfa21fc", @ANYRES32=r6, @ANYBLOB="00000000000000001800120008000100767469000c00020008000400ac1e0001"], 0x38}}, 0x0) getpeername$netlink(r4, &(0x7f0000000140), &(0x7f0000000180)=0xc) symlink(&(0x7f00000001c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0/file0\x00', &(0x7f0000000340)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00') open(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) truncate(&(0x7f0000000100)='./file0\x00', 0x0) unlink(&(0x7f0000000040)='./file0\x00') open(&(0x7f00000000c0)='./file0\x00', 0x3fd, 0x0) 20:36:45 executing program 2: syz_mount_image$ext4(&(0x7f0000000000)='ext2\x00', &(0x7f0000000140)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f00000000c0)="25bca274769e620aa734fa0095e0d0a18db43915e3a702a9d8aea872943afd874e2f98b579a7186270146d0e02c06cffa8c67cd7dcc6760253ef0b2a20a602210318f8104a27ea57b012d31c34951dc119dac04eab9c68842086234a45fbe202000000000029", 0x66, 0x400}], 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup3(r4, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) execveat(r5, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000740)=[&(0x7f00000002c0)='GPL@!#md5sum+\x00', &(0x7f0000000300)='keyring\x00', &(0x7f0000000340)='/dev/ashmem\x00', &(0x7f0000000380)='/dev/ashmem\x00', &(0x7f0000000440)='\x00', &(0x7f0000000540)='selinuxwlan0eth1//][vboxnet1#\x00', &(0x7f0000000580)='/user@md5sumsystemsecuritylowlan0&{wlan1vboxnet0em1keyringsecurityvboxnet0+systemppp0security\x00', &(0x7f0000000700)='/&$wlan0\x00'], &(0x7f0000000800)=[&(0x7f00000007c0)='\x00'], 0x100) fallocate(r5, 0x10, 0xd4, 0x3) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = dup3(r7, r6, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) execveat(r8, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000740), &(0x7f0000000800)=[&(0x7f00000007c0)='\x00'], 0x100) fallocate(r8, 0x10, 0xd4, 0x3) write$P9_RVERSION(r8, &(0x7f0000000200)={0x15, 0x65, 0xffff, 0x20, 0x8, '9P2000.L'}, 0x15) accept$packet(r5, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000180)=0x14) [ 86.012163] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'. [ 86.032959] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'. [ 86.102705] EXT4-fs (loop2): couldn't mount as ext2 due to feature incompatibilities 20:36:45 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000020000000001, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e23, @dev}, 0x10) socketpair(0xa, 0x80800, 0x6, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setflags(r1, 0x2, 0x1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r3, r2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) execveat(r4, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000740)=[&(0x7f00000002c0)='GPL@!#md5sum+\x00', &(0x7f0000000300)='keyring\x00', &(0x7f0000000340)='/dev/ashmem\x00', &(0x7f0000000380)='/dev/ashmem\x00', &(0x7f0000000440)='\x00', &(0x7f0000000540)='selinuxwlan0eth1//][vboxnet1#\x00', &(0x7f0000000580)='/user@md5sumsystemsecuritylowlan0&{wlan1vboxnet0em1keyringsecurityvboxnet0+systemppp0security\x00', &(0x7f0000000700)='/&$wlan0\x00'], &(0x7f0000000800)=[&(0x7f00000007c0)='\x00'], 0x100) r5 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r5, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000500)=ANY=[@ANYBLOB="7c000000547429340c523f8b34b05315e89a5cf12930daf42a8f39b5652666dc378703023115e5a499e5e023c5428696852e048e5ecba292e11d0d7f33ac8f631784a4824ec147fc5b72121945c36e69f90b47d2c2cfd0b830d784905e0086026c681fdbeffa4c4e86d11c148bff9df2d9c497456f36dfbef3ab8ec8f205131ea85c726d52c03afd63380f3c2a98cbb6e3948b249234ee551192a033908fbe32bc92736f9a7e0d3c8b9e3979296c8ca57cbbf76aa4f539a44986c2ab133a40b1159ec9f0573e068c3f511c8986b9af8fd931411b88374bfd562ba1272a25179307bf745b697625bc5b2c57345c24ffcf34a3550338defb5edaff4706f10a4f", @ANYRES16=r6, @ANYBLOB="000026bd7000fcdbdf251000000008000400050000000800060001000080440001000c0007000400000020000000140003000000000000000000000000000000000108000b007369700008"], 0x3}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000600)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000400)={&(0x7f0000000480)={0x9c, r6, 0x400, 0x70bd2d, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DEST={0x4c, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x5}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x3fc}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x3}, @IPVS_DEST_ATTR_TUN_PORT={0x8, 0xe, 0x4e20}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e21}, @IPVS_DEST_ATTR_U_THRESH={0x8}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xb2e575c5d505e83a}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e24}]}, @IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x3c}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x75}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xff}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth0\x00'}]}]}, 0x9c}, 0x1, 0x0, 0x0, 0xa080}, 0x0) fallocate(r4, 0x10, 0xd4, 0x3) ioctl$SIOCGSTAMPNS(r4, 0x8907, &(0x7f0000000180)) r7 = accept4(r0, &(0x7f00000000c0)=@in6={0xa, 0x0, 0x0, @dev}, &(0x7f0000000000)=0x80, 0x0) connect$inet(r7, &(0x7f0000000140)={0x2, 0x4e23, @empty}, 0x10) sendto$inet(r0, 0x0, 0xfffffffffffffea4, 0x20000800, &(0x7f0000000280)={0x2, 0x4e22, @local}, 0x10) setsockopt$inet_msfilter(r7, 0x0, 0x29, &(0x7f0000000680)={@loopback, @multicast2, 0x0, 0x8, [@dev={0xac, 0x14, 0x14, 0x2a}, @dev={0xac, 0x14, 0x14, 0x12}, @local, @local, @empty, @multicast1, @dev={0xac, 0x14, 0x14, 0x1c}, @remote]}, 0x30) sendto$inet(r0, &(0x7f0000000000), 0xfffffffffffffccf, 0x240, 0x0, 0xffffffffffffff37) keyctl$setperm(0x5, 0x0, 0x0) [ 86.191375] EXT4-fs (loop2): couldn't mount as ext2 due to feature incompatibilities [ 86.225405] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'. 20:36:45 executing program 2: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f00000009c0)='./bus\x00', 0x141042, 0x0) io_setup(0x8, &(0x7f0000000040)) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) fallocate(r1, 0x8, 0xb2a, 0x3) fcntl$setstatus(r1, 0x4, 0x6100) ftruncate(r1, 0x8200) recvmmsg(0xffffffffffffffff, &(0x7f00000052c0)=[{{0x0, 0x0, &(0x7f00000035c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) open(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000580)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x509, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r3, r2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) execveat(r4, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000740)=[&(0x7f00000002c0)='GPL@!#md5sum+\x00', &(0x7f0000000300)='keyring\x00', &(0x7f0000000340)='/dev/ashmem\x00', &(0x7f0000000380)='/dev/ashmem\x00', &(0x7f0000000440)='\x00', &(0x7f0000000540)='selinuxwlan0eth1//][vboxnet1#\x00', &(0x7f0000000580)='/user@md5sumsystemsecuritylowlan0&{wlan1vboxnet0em1keyringsecurityvboxnet0+systemppp0security\x00', &(0x7f0000000700)='/&$wlan0\x00'], &(0x7f0000000800), 0x100) fallocate(r4, 0x10, 0xd4, 0x3) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, 0xffffffffffffffff) write$cgroup_type(r1, &(0x7f0000000200)='threaded\x00', 0x175d900f) getresuid(&(0x7f0000004180), 0x0, 0x0) close(0xffffffffffffffff) [ 86.291319] audit: type=1400 audit(1575059805.398:6): avc: denied { create } for pid=3522 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 20:36:45 executing program 4: socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000240)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup3(r5, r4, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) execveat(r6, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000740)=[&(0x7f00000002c0)='GPL@!#md5sum+\x00', &(0x7f0000000300)='keyring\x00', &(0x7f0000000340)='/dev/ashmem\x00', &(0x7f0000000380)='/dev/ashmem\x00', &(0x7f0000000440)='\x00', &(0x7f0000000540)='selinuxwlan0eth1//][vboxnet1#\x00', &(0x7f0000000580)='/user@md5sumsystemsecuritylowlan0&{wlan1vboxnet0em1keyringsecurityvboxnet0+systemppp0security\x00', &(0x7f0000000700)='/&$wlan0\x00'], &(0x7f0000000800)=[&(0x7f00000007c0)='\x00'], 0x100) fallocate(r6, 0x10, 0xd4, 0x3) r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000000140)='/dev/zero\x00', 0x10000, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000100)={'eql\x00\x00\x04\x00\x00\x00\x03\x00\x00\x00\xf2\a\x00'}) io_setup(0x0, &(0x7f0000000240)=0x0) io_submit(r8, 0x0, 0x0) io_submit(r8, 0x1, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, 0xffffffffffffffff, 0x0}]) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) write$P9_RREADLINK(0xffffffffffffffff, 0x0, 0x0) r9 = creat(&(0x7f0000000040)='./bus\x00', 0x0) lseek(r9, 0x800002, 0x0) ioctl$EXT4_IOC_SETFLAGS(r9, 0x40086602, &(0x7f00000001c0)) write$binfmt_elf64(r9, &(0x7f00000005c0)=ANY=[@ANYBLOB="000eedc95336ccdc4041aafbb509"], 0x2) fallocate(r9, 0x3, 0x0, 0x8020003) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) pipe(&(0x7f0000000280)={0xffffffffffffffff}) r12 = socket$inet_udp(0x2, 0x2, 0x0) splice(r11, 0x0, r12, 0x0, 0x4ffe0, 0x0) ioctl$ION_IOC_ALLOC(r10, 0xc0184900, &(0x7f0000000600)={0x9, 0x34, 0x1, r11}) lseek(r13, 0x952, 0x1) ioctl$EVIOCGABS3F(r9, 0x8018457f, &(0x7f0000000340)=""/94) syz_open_procfs(0x0, &(0x7f00000001c0)='net/arp\x00') [ 86.392496] audit: type=1400 audit(1575059805.498:7): avc: denied { create } for pid=3541 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 86.414020] hrtimer: interrupt took 47006 ns [ 86.471740] audit: type=1400 audit(1575059805.578:8): avc: denied { write } for pid=3541 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 20:36:45 executing program 3: r0 = socket$inet(0x10, 0x80003, 0x0) memfd_create(0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/mls\x00', 0x0, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000009c0)='/dev/loop-control\x00', 0x0, 0x0) ioctl$PIO_UNIMAP(r1, 0x4b67, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x1f, 0x80}]}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000340)='./cgroup.cpu/syz1\x00', 0x1ff) socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) r4 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000100)='cgroup.subtree_control\x00', 0x2, 0x0) pread64(r4, 0x0, 0x0, 0x6) r5 = dup(r4) setsockopt$packet_tx_ring(r5, 0x107, 0xd, &(0x7f0000000580)=@req={0x6, 0x4, 0x4, 0x4291}, 0x10) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r7 = openat$cgroup_subtree(r6, &(0x7f0000000100)='cgroup.subtree_control\x00', 0x2, 0x0) pread64(r7, 0x0, 0x0, 0x6) write$binfmt_misc(r7, &(0x7f0000000540)=ANY=[@ANYBLOB="73797a31614acb856f266b5c37f691ee42ec6b681aa733140e347381f5b6ebf4b4fab50f5ad5e407779e42f5240852f6adbfaaee4d3d90ba"], 0x38) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) r8 = openat(r1, &(0x7f0000000440)='./file0\x00', 0x0, 0x0) setsockopt$packet_drop_memb(r8, 0x107, 0x2, &(0x7f0000000480)={0x0, 0x1, 0x6, @broadcast}, 0x10) r9 = openat$zero(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/zero\x00', 0x8000, 0x0) ioctl$int_in(r9, 0x5421, &(0x7f0000000600)=0xff) creat(0x0, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000700)=ANY=[@ANYRESDEC=0x0, @ANYRESOCT=r0, @ANYPTR64=&(0x7f0000000740)=ANY=[@ANYRES64, @ANYRESDEC=r3], @ANYRES16=0x0], 0x35) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, 0x0, 0x0) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000000)={0x0, 0x7b, 0xf6}, 0x0, &(0x7f0000000140)="05dba0e3e1f617052ea1377827b8669973ff7d5543cb37cdfc7e2a6e1c6431b1b893245531a10fc9116abc2c53efb97f1996a9fb0201ac41f788f62fc26ee83a9936ebb26634e9859210d9cef5045c5545f90739d0ade3711fbc041444001ccb617a9571839469fdc5d611c3c6fb636443c8321dc20691827d2180", &(0x7f0000000200)=""/246) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000001c0)="24000000200007041dfffd946f6105000200000a1f0000400028080008000c00e9110300", 0x24}], 0x1}, 0x0) [ 86.538869] audit: type=1400 audit(1575059805.648:9): avc: denied { read } for pid=3541 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 20:36:45 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x8}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000000840)=[{{&(0x7f0000000b00)=@sco, 0x80, &(0x7f0000000340)=[{&(0x7f0000000180)=""/24, 0x18}], 0x1, &(0x7f0000000380)=""/30, 0x1e}}, {{&(0x7f00000003c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f0000000ac0)=[{&(0x7f0000000980)=""/201}, {&(0x7f0000000a80)=""/13, 0x116}], 0x4, &(0x7f0000000780)=""/180, 0xb4}, 0x1}], 0x2, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r4, &(0x7f0000000080), 0x1c) r5 = dup2(0xffffffffffffffff, 0xffffffffffffffff) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, 0x0, 0x0) ioctl$EVIOCGUNIQ(r5, 0x80404508, &(0x7f00000000c0)=""/128) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) socket$unix(0x1, 0x0, 0x0) socket$inet(0x2, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba001000030000000000000000", @ANYRES32=0x0, @ANYBLOB="030000000000000008001b0000000000f89093ea170b197374b5912ed55f28cb8f9407147b62ec7359abe47b79c70adca3a3479ed87f51e2ea1fabb0b1b13f95fbc4abdbf343a39ae8aff21f9f0ca800f4da99358c5bbee8f61a8d83fce719c0b83e"], 0x28}}, 0x0) close(r6) sched_setattr(0x0, &(0x7f00000002c0)={0x30, 0x0, 0x1, 0x8, 0x401, 0x81, 0x800, 0x6}, 0x0) 20:36:46 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x8}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000480)="b0a3cdef47f59ec515de0fcb5dfc761cf7120c4312b2054efdc0cf574f65329a05d03a24674b1d94d072b4bd702c576dc1d6e4fef97bdd899d359dadcfe32ba24fb1e152533e4df2c20324dda85d95c102000000d81d2b9bea7f9e468b3da19d62e9913b2f7cd488de25886811470818af91afd3bce1422670d6f2d054d8b16374e3617a22b1c70e7e3104b814e24e6e7b62256ae8faaae5f59f840c029418a34c", 0xffffff47) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000180)={0x30, 0x2, 0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0) r4 = socket$inet6(0xa, 0x400000000001, 0x0) bind$inet6(r4, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0xfffffffffffffffd) ftruncate(r5, 0x80003) sendfile(r4, r5, &(0x7f00000000c0), 0x8000fffffffe) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_GET_LINKS(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x220000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r6, 0x300, 0x70bd2a, 0x25dfdbfc, {{}, 0x0, 0x4, 0x0, {0x8, 0x11, 0x4}}, ["", "", "", "", "", "", ""]}, 0xfffffffffffffe90}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000) sendmsg$TIPC_CMD_SHOW_PORTS(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000140)={0x1c, r6, 0x304, 0x70bd28, 0x25dfdbfe, {}, ["", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x80) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) symlink(&(0x7f00000001c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0/file0\x00', &(0x7f0000000340)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00') connect$inet6(0xffffffffffffffff, 0x0, 0x0) r7 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000440)='TIPCv2\x00') sendmsg$TIPC_NL_NODE_GET(r7, &(0x7f00000006c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000680)={&(0x7f0000000540)={0x114, r8, 0x100, 0x70bd2a, 0x25dfdbfe, {}, [@TIPC_NLA_BEARER={0x100, 0x1, [@TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffff13d0}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'rose0\x00'}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x2a}}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0xffffffff, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xffffffff}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfbf}]}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf5d}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3d2e}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x3}]}]}, 0x114}, 0x1, 0x0, 0x0, 0x3000}, 0x4000) [ 86.932826] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'. 20:36:46 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key$keyring(&(0x7f00000003c0)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffb) keyctl$instantiate(0xc, 0x0, 0x0, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r1 = dup(0xffffffffffffffff) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x351, 0x0) r3 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/ptmx\x00', 0x0, 0x0) dup2(r3, r4) writev(r4, &(0x7f00000023c0), 0x1000000000000252) r5 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/ptmx\x00', 0x0, 0x0) dup2(r5, 0xffffffffffffffff) writev(r6, &(0x7f00000023c0), 0x1000000000000252) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/ptmx\x00', 0x0, 0x0) r8 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x4182) io_setup(0x1, &(0x7f00000003c0)=0x0) io_submit(r9, 0x2, &(0x7f00000005c0)=[&(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x70, r8, &(0x7f0000000400)="e7acb3f84a906021407dd8f5b129d36a33c3bf2c2477201406867f17d6ae4dc1a2c241787d750226d4a3ef2486589bb95f451dc9056d8298af40fe7ea0a2e7555117a113beb670c86f501be9bcadac4af60d7bf02ec9afc759038a4a1a29cb63f0e813eacee470d0332d95307cfe04764879cd0eac4b9c26470d552f3c23442cb555c81490f227bacf27e58a34880f8276784ec245d36616a877d8ad538f371e40ef97eaa33e13d4e9b30b15820efbfb6152756a92ac1f57fc131ea9c36d134ee71ee374c7a5ac0886acc5a82eb65e516a20dcd26bd77a89c896728bc6b2c619885525a632a09263dbe1ab51b9bb8daa37e398982ef3cde0f861faad3c328a", 0xff, 0x2, 0x0, 0x2}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x3, 0x3, 0xffffffffffffffff, &(0x7f0000000540)="34f682da24135d8ec6626f9d0b833f95cad17d28ff2361a86cfffe5183fac4aaeaa41c97ad3e49b80285fe681d23665b8d7d97dd02d04d", 0x46, 0x7, 0x0, 0x1}]) dup2(r8, r7) r10 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x4182) io_setup(0x1, &(0x7f00000003c0)=0x0) io_submit(r11, 0x2, &(0x7f00000005c0)=[&(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x70, r10, &(0x7f0000000400)="e7acb3f84a906021407dd8f5b129d36a33c3bf2c2477201406867f17d6ae4dc1a2c241787d750226d4a3ef2486589bb95f451dc9056d8298af40fe7ea0a2e7555117a113beb670c86f501be9bcadac4af60d7bf02ec9afc759038a4a1a29cb63f0e813eacee470d0332d95307cfe04764879cd0eac4b9c26470d552f3c23442cb555c81490f227bacf27e58a34880f8276784ec245d36616a877d8ad538f371e40ef97eaa33e13d4e9b30b15820efbfb6152756a92ac1f57fc131ea9c36d134ee71ee374c7a5ac0886acc5a82eb65e516a20dcd26bd77a89c896728bc6b2c619885525a632a09263dbe1ab51b9bb8daa37e398982ef3cde0f861faad3c328a", 0xff, 0x2, 0x0, 0x2}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x3, 0x3, 0xffffffffffffffff, &(0x7f0000000540)="34f682da24135d8ec6626f9d0b833f95cad17d28ff2361a86cfffe5183fac4aaeaa41c97ad3e49b80285fe681d23665b8d7d97dd02d04d", 0x37, 0x7, 0x0, 0x1}]) ftruncate(0xffffffffffffffff, 0xcc) keyctl$assume_authority(0x10, 0x0) sendfile(r1, r2, 0x0, 0x8000fffffffe) bind$packet(r1, &(0x7f0000000300)={0x11, 0x1c}, 0x14) write$UHID_CREATE(r1, &(0x7f0000000480)={0x0, 'syz0\x00', 'syz0\x00', 'syz1\x00', &(0x7f0000000180)=""/69, 0x45, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x120) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000040)=ANY=[]}}, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_genetlink_get_family_id$net_dm(&(0x7f0000000400)='NET_DM\x00') 20:36:46 executing program 3: r0 = socket$inet(0x10, 0x80003, 0x0) memfd_create(0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/mls\x00', 0x0, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000009c0)='/dev/loop-control\x00', 0x0, 0x0) ioctl$PIO_UNIMAP(r1, 0x4b67, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x1f, 0x80}]}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000340)='./cgroup.cpu/syz1\x00', 0x1ff) socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) r4 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000100)='cgroup.subtree_control\x00', 0x2, 0x0) pread64(r4, 0x0, 0x0, 0x6) r5 = dup(r4) setsockopt$packet_tx_ring(r5, 0x107, 0xd, &(0x7f0000000580)=@req={0x6, 0x4, 0x4, 0x4291}, 0x10) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r7 = openat$cgroup_subtree(r6, &(0x7f0000000100)='cgroup.subtree_control\x00', 0x2, 0x0) pread64(r7, 0x0, 0x0, 0x6) write$binfmt_misc(r7, &(0x7f0000000540)=ANY=[@ANYBLOB="73797a31614acb856f266b5c37f691ee42ec6b681aa733140e347381f5b6ebf4b4fab50f5ad5e407779e42f5240852f6adbfaaee4d3d90ba"], 0x38) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) r8 = openat(r1, &(0x7f0000000440)='./file0\x00', 0x0, 0x0) setsockopt$packet_drop_memb(r8, 0x107, 0x2, &(0x7f0000000480)={0x0, 0x1, 0x6, @broadcast}, 0x10) r9 = openat$zero(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/zero\x00', 0x8000, 0x0) ioctl$int_in(r9, 0x5421, &(0x7f0000000600)=0xff) creat(0x0, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000700)=ANY=[@ANYRESDEC=0x0, @ANYRESOCT=r0, @ANYPTR64=&(0x7f0000000740)=ANY=[@ANYRES64, @ANYRESDEC=r3], @ANYRES16=0x0], 0x35) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, 0x0, 0x0) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000000)={0x0, 0x7b, 0xf6}, 0x0, &(0x7f0000000140)="05dba0e3e1f617052ea1377827b8669973ff7d5543cb37cdfc7e2a6e1c6431b1b893245531a10fc9116abc2c53efb97f1996a9fb0201ac41f788f62fc26ee83a9936ebb26634e9859210d9cef5045c5545f90739d0ade3711fbc041444001ccb617a9571839469fdc5d611c3c6fb636443c8321dc20691827d2180", &(0x7f0000000200)=""/246) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000001c0)="24000000200007041dfffd946f6105000200000a1f0000400028080008000c00e9110300", 0x24}], 0x1}, 0x0) [ 87.081836] syz-executor.2 (3551) used greatest stack depth: 22832 bytes left 20:36:46 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x60, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="086310400000000000000000000000000000000012634840000000000000000000000000000000000000000000000000000000000000000000000000000000e8ffffffffffffff00000000000000000000000000000000000000000000000000b582ec3d4e9ad2e6aba63cdc431a846aad1c6e8032a8f29b4337826f1407820b7eb85196e55d6c9ed534c5051ca40fb9c3bc7fc3cb2e830000"], 0x0, 0x0, 0x0}) r2 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x4182) io_setup(0x1, &(0x7f00000003c0)=0x0) io_submit(r3, 0x2, &(0x7f00000005c0)=[&(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x70, r2, &(0x7f0000000400)="e7acb3f84a906021407dd8f5b129d36a33c3bf2c2477201406867f17d6ae4dc1a2c241787d750226d4a3ef2486589bb95f451dc9056d8298af40fe7ea0a2e7555117a113beb670c86f501be9bcadac4af60d7bf02ec9afc759038a4a1a29cb63f0e813eacee470d0332d95307cfe04764879cd0eac4b9c26470d552f3c23442cb555c81490f227bacf27e58a34880f8276784ec245d36616a877d8ad538f371e40ef97eaa33e13d4e9b30b15820efbfb6152756a92ac1f57fc131ea9c36d134ee71ee374c7a5ac0886acc5a82eb65e516a20dcd26bd77a89c896728bc6b2c619885525a632a09263dbe1ab51b9bb8daa37e398982ef3cde0f861faad3c328a", 0xff, 0x2, 0x0, 0x2}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x3, 0x3, 0xffffffffffffffff, &(0x7f0000000540)="34f682da24135d8ec6626f9d0b833f95cad17d28ff2361a86cfffe5183fac4aaeaa41c97ad3e49b80285fe681d23665b8d7d97dd02d04d", 0x37, 0x7, 0x0, 0x1}]) preadv(r2, &(0x7f0000001640)=[{&(0x7f0000000000)=""/57, 0x39}, {&(0x7f0000000300)=""/4096, 0x1000}, {&(0x7f0000000040)}, {&(0x7f0000000180)=""/148, 0x94}, {&(0x7f0000000240)=""/106, 0x6a}, {&(0x7f0000001300)=""/54, 0x36}, {&(0x7f0000001340)=""/255, 0xff}, {&(0x7f0000001440)=""/219, 0xdb}, {&(0x7f0000001540)=""/211, 0xd3}], 0x9, 0x6) 20:36:46 executing program 2: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f00000009c0)='./bus\x00', 0x141042, 0x0) io_setup(0x8, &(0x7f0000000040)) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) fallocate(r1, 0x8, 0xb2a, 0x3) fcntl$setstatus(r1, 0x4, 0x6100) ftruncate(r1, 0x8200) recvmmsg(0xffffffffffffffff, &(0x7f00000052c0)=[{{0x0, 0x0, &(0x7f00000035c0)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) open(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000580)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x509, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r3, r2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) execveat(r4, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000740)=[&(0x7f00000002c0)='GPL@!#md5sum+\x00', &(0x7f0000000300)='keyring\x00', &(0x7f0000000340)='/dev/ashmem\x00', &(0x7f0000000380)='/dev/ashmem\x00', &(0x7f0000000440)='\x00', &(0x7f0000000540)='selinuxwlan0eth1//][vboxnet1#\x00', &(0x7f0000000580)='/user@md5sumsystemsecuritylowlan0&{wlan1vboxnet0em1keyringsecurityvboxnet0+systemppp0security\x00', &(0x7f0000000700)='/&$wlan0\x00'], &(0x7f0000000800), 0x100) fallocate(r4, 0x10, 0xd4, 0x3) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, 0xffffffffffffffff) write$cgroup_type(r1, &(0x7f0000000200)='threaded\x00', 0x175d900f) getresuid(&(0x7f0000004180), 0x0, 0x0) close(0xffffffffffffffff) 20:36:46 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/t/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'vat\x00\x00\x00\x00\x00\x00\x00\xa8\x03\x00', 0x43732e5398416f1a}) close(r1) socket$nl_route(0x10, 0x3, 0x0) r2 = dup3(r0, 0xffffffffffffffff, 0x140000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup3(r4, r3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = dup3(r7, r6, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) execveat(r8, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000740)=[&(0x7f00000002c0)='GPL@!#md5sum+\x00', &(0x7f0000000300)='keyring\x00', &(0x7f0000000340)='/dev/ashmem\x00', &(0x7f0000000380)='/dev/ashmem\x00', &(0x7f0000000440)='\x00', &(0x7f0000000540)='selinuxwlan0eth1//][vboxnet1#\x00', &(0x7f0000000580)='/user@md5sumsystemsecuritylowlan0&{wlan1vboxnet0em1keyringsecurityvboxnet0+systemppp0security\x00', &(0x7f0000000700)='/&$wlan0\x00'], &(0x7f0000000800)=[&(0x7f00000007c0)='\x00'], 0x100) fallocate(r8, 0x10, 0xd4, 0x3) r9 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x4182) io_setup(0x1, &(0x7f00000003c0)=0x0) io_submit(r10, 0x2, &(0x7f00000005c0)=[&(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x70, r9, &(0x7f0000000400)="e7acb3f84a906021407dd8f5b129d36a33c3bf2c2477201406867f17d6ae4dc1a2c241787d750226d4a3ef2486589bb95f451dc9056d8298af40fe7ea0a2e7555117a113beb670c86f501be9bcadac4af60d7bf02ec9afc759038a4a1a29cb63f0e813eacee470d0332d95307cfe04764879cd0eac4b9c26470d552f3c23442cb555c81490f227bacf27e58a34880f8276784ec245d36616a877d8ad538f371e40ef97eaa33e13d4e9b30b15820efbfb6152756a92ac1f57fc131ea9c36d134ee71ee374c7a5ac0886acc5a82eb65e516a20dcd26bd77a89c896728bc6b2c619885525a632a09263dbe1ab51b9bb8daa37e398982ef3cde0f861faad3c328a", 0xff, 0x2, 0x0, 0x2}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x3, 0x3, 0xffffffffffffffff, &(0x7f0000000540)="34f682da24135d8ec6626f9d0b833f95cad17d28ff2361a86cfffe5183fac4aaeaa41c97ad3e49b80285fe681d23665b8d7d97dd02d04d", 0x37, 0x7, 0x0, 0x1}]) write$binfmt_misc(r9, &(0x7f0000000100)={'syz0', "d0e724280c4fe32a9319bfdd8156a27f9cd08e2e436d7cff46323a743d11d537347e89c970ce9570486c5c5d27eaec2da5383f1025831888588fd5bce687ce9d36b59e51b5016f989a031c4b4d632f16b0c494916349c15c7eb4ffeb3f74711b87d466974a4cb371f24513554c12e7ffb03e65b93ccf3df8c98b41c88b4c83e4f20da17b5eb2314f0c50dc52faf901edaba45eea5c32d1e61ae97518568c5b628a11ab9525fa5133cc62"}, 0xae) r11 = gettid() ptrace$setopts(0x4206, r11, 0x0, 0x0) tkill(r11, 0x3b) ptrace$setregs(0xd, r11, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r11, 0x0, 0x0) sched_getattr(r11, &(0x7f00000000c0)={0x30}, 0x30, 0x0) faccessat(r8, &(0x7f0000000080)='./file0\x00', 0x2, 0x200) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r14 = dup3(r13, r12, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r14, 0x8912, 0x400200) fallocate(r14, 0x10, 0xd4, 0x3) setsockopt$EBT_SO_SET_ENTRIES(r14, 0x0, 0x80, &(0x7f0000000600)=@filter={'filter\x00', 0xe, 0x3, 0x5a2, [0x0, 0x20000840, 0x2000096e, 0x2000099e], 0x0, &(0x7f0000000240), &(0x7f0000000840)=[{0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{0x5, 0x8, 0x1, 'bridge0\x00', 'veth0_to_team\x00', 'hsr0\x00', 'rose0\x00', @random="d1add1f0150e", [0x7f, 0xff, 0x7f, 0x0, 0x1fe, 0xff], @local, [0x0, 0x0, 0x4877c3e65e6de58e, 0x0, 0xff, 0xff], 0x6e, 0xce, 0xfe, [], [@common=@NFQUEUE0={'NFQUEUE\x00', 0x8, {{0x2}}}, @common=@CLASSIFY={'CLASSIFY\x00', 0x8, {{0xca}}}], @common=@CONNSECMARK={'CONNSECMARK\x00', 0x8, {{0x2}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1, 0x9938740d88309583}, {0x0, '\x00', 0x1, 0x1, 0x2, [{0x11, 0x12, 0x806, 'erspan0\x00', 'nr0\x00', 'batadv0\x00', 'veth1_to_bond\x00', @broadcast, [0xff, 0x0, 0x83389b5b5f9bf321, 0xff, 0x0, 0x7f], @local, [0xff, 0x17e, 0x7f, 0xff, 0x0, 0x101], 0x9e, 0x1fe, 0x32e, [@m802_3={'802_3\x00', 0x8, {{0xe, 0x1, 0x4, 0xb5114ed6c538c2a6}}}], [@common=@SECMARK={'SECMARK\x00', 0x108, {{0x1, 0x6, 'system_u:object_r:semanage_read_lock_t:s0\x00'}}}, @common=@STANDARD={'\x00', 0x8, {0xffffffffffffffff}}], @common=@SECMARK={'SECMARK\x00', 0x108, {{0x1, 0x401, 'system_u:object_r:sudo_exec_t:s0\x00'}}}}, {0x5, 0x8, 0x0, 'erspan0\x00', 'team_slave_1\x00', 'vxcan1\x00', 'ip6gretap0\x00', @local, [0x69e4e43ca13a68a4, 0x0, 0x0, 0xff], @remote, [0xff, 0x0, 0xff, 0xff, 0xff, 0xff], 0x6e, 0x6e, 0xb6, [], [], @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00', 0x2, 0x81, 0x100}}}}]}]}, 0x61a) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) execveat(r5, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000740)=[&(0x7f00000002c0)='GPL@!#md5sum+\x00', &(0x7f0000000300)='keyring\x00', &(0x7f0000000340)='/dev/ashmem\x00', &(0x7f0000000380)='/dev/ashmem\x00', &(0x7f0000000440)='\x00', &(0x7f0000000540)='selinuxwlan0eth1//][vboxnet1#\x00', &(0x7f0000000580)='/user@md5sumsystemsecuritylowlan0&{wlan1vboxnet0em1keyringsecurityvboxnet0+systemppp0security\x00', &(0x7f0000000700)='/&$wlan0\x00'], &(0x7f0000000800)=[&(0x7f00000007c0)='\x00'], 0x100) fallocate(r5, 0x10, 0xd4, 0x3) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000040)={0x5, 0x0, 0x1, r5}) 20:36:46 executing program 3: r0 = socket$inet(0x10, 0x80003, 0x0) memfd_create(0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/mls\x00', 0x0, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000009c0)='/dev/loop-control\x00', 0x0, 0x0) ioctl$PIO_UNIMAP(r1, 0x4b67, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x1f, 0x80}]}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000340)='./cgroup.cpu/syz1\x00', 0x1ff) socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) r4 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000100)='cgroup.subtree_control\x00', 0x2, 0x0) pread64(r4, 0x0, 0x0, 0x6) r5 = dup(r4) setsockopt$packet_tx_ring(r5, 0x107, 0xd, &(0x7f0000000580)=@req={0x6, 0x4, 0x4, 0x4291}, 0x10) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r7 = openat$cgroup_subtree(r6, &(0x7f0000000100)='cgroup.subtree_control\x00', 0x2, 0x0) pread64(r7, 0x0, 0x0, 0x6) write$binfmt_misc(r7, &(0x7f0000000540)=ANY=[@ANYBLOB="73797a31614acb856f266b5c37f691ee42ec6b681aa733140e347381f5b6ebf4b4fab50f5ad5e407779e42f5240852f6adbfaaee4d3d90ba"], 0x38) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) r8 = openat(r1, &(0x7f0000000440)='./file0\x00', 0x0, 0x0) setsockopt$packet_drop_memb(r8, 0x107, 0x2, &(0x7f0000000480)={0x0, 0x1, 0x6, @broadcast}, 0x10) r9 = openat$zero(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/zero\x00', 0x8000, 0x0) ioctl$int_in(r9, 0x5421, &(0x7f0000000600)=0xff) creat(0x0, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000700)=ANY=[@ANYRESDEC=0x0, @ANYRESOCT=r0, @ANYPTR64=&(0x7f0000000740)=ANY=[@ANYRES64, @ANYRESDEC=r3], @ANYRES16=0x0], 0x35) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, 0x0, 0x0) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000000)={0x0, 0x7b, 0xf6}, 0x0, &(0x7f0000000140)="05dba0e3e1f617052ea1377827b8669973ff7d5543cb37cdfc7e2a6e1c6431b1b893245531a10fc9116abc2c53efb97f1996a9fb0201ac41f788f62fc26ee83a9936ebb26634e9859210d9cef5045c5545f90739d0ade3711fbc041444001ccb617a9571839469fdc5d611c3c6fb636443c8321dc20691827d2180", &(0x7f0000000200)=""/246) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000001c0)="24000000200007041dfffd946f6105000200000a1f0000400028080008000c00e9110300", 0x24}], 0x1}, 0x0) [ 87.375298] audit: type=1400 audit(1575059806.488:10): avc: denied { set_context_mgr } for pid=3617 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 87.403864] binder: 3617:3620 BC_INCREFS_DONE node 1 has no pending increfs request [ 87.412224] binder: 3617:3620 got reply transaction with no transaction stack 20:36:46 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x60, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="086310400000000000000000000000000000000012634840000000000000000000000000000000000000000000000000000000000000000000000000000000e8ffffffffffffff00000000000000000000000000000000000000000000000000b582ec3d4e9ad2e6aba63cdc431a846aad1c6e8032a8f29b4337826f1407820b7eb85196e55d6c9ed534c5051ca40fb9c3bc7fc3cb2e830000"], 0x0, 0x0, 0x0}) r2 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x4182) io_setup(0x1, &(0x7f00000003c0)=0x0) io_submit(r3, 0x2, &(0x7f00000005c0)=[&(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x70, r2, &(0x7f0000000400)="e7acb3f84a906021407dd8f5b129d36a33c3bf2c2477201406867f17d6ae4dc1a2c241787d750226d4a3ef2486589bb95f451dc9056d8298af40fe7ea0a2e7555117a113beb670c86f501be9bcadac4af60d7bf02ec9afc759038a4a1a29cb63f0e813eacee470d0332d95307cfe04764879cd0eac4b9c26470d552f3c23442cb555c81490f227bacf27e58a34880f8276784ec245d36616a877d8ad538f371e40ef97eaa33e13d4e9b30b15820efbfb6152756a92ac1f57fc131ea9c36d134ee71ee374c7a5ac0886acc5a82eb65e516a20dcd26bd77a89c896728bc6b2c619885525a632a09263dbe1ab51b9bb8daa37e398982ef3cde0f861faad3c328a", 0xff, 0x2, 0x0, 0x2}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x3, 0x3, 0xffffffffffffffff, &(0x7f0000000540)="34f682da24135d8ec6626f9d0b833f95cad17d28ff2361a86cfffe5183fac4aaeaa41c97ad3e49b80285fe681d23665b8d7d97dd02d04d", 0x37, 0x7, 0x0, 0x1}]) preadv(r2, &(0x7f0000001640)=[{&(0x7f0000000000)=""/57, 0x39}, {&(0x7f0000000300)=""/4096, 0x1000}, {&(0x7f0000000040)}, {&(0x7f0000000180)=""/148, 0x94}, {&(0x7f0000000240)=""/106, 0x6a}, {&(0x7f0000001300)=""/54, 0x36}, {&(0x7f0000001340)=""/255, 0xff}, {&(0x7f0000001440)=""/219, 0xdb}, {&(0x7f0000001540)=""/211, 0xd3}], 0x9, 0x6) 20:36:46 executing program 0: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) memfd_create(0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000040), 0x0) r0 = creat(&(0x7f0000002440)='./file0\x00', 0x0) r1 = creat(&(0x7f0000002440)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f0000000240)='threaded\x00', 0xfb3f) openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/create\x00', 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x0, 0xb, 0xffffffffffffffff, 0x0) fallocate(r0, 0x8, 0x0, 0x8000) openat$fuse(0xffffffffffffff9c, &(0x7f0000000d40)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='f', @ANYBLOB, @ANYRESDEC=0x0]) pipe(0x0) [ 87.430653] binder: 3617:3620 transaction failed 29201/-71, size -1729382256910270464-72057594037927935 line 3046 [ 87.451980] binder: undelivered TRANSACTION_ERROR: 29201 20:36:46 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x60, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="086310400000000000000000000000000000000012634840000000000000000000000000000000000000000000000000000000000000000000000000000000e8ffffffffffffff00000000000000000000000000000000000000000000000000b582ec3d4e9ad2e6aba63cdc431a846aad1c6e8032a8f29b4337826f1407820b7eb85196e55d6c9ed534c5051ca40fb9c3bc7fc3cb2e830000"], 0x0, 0x0, 0x0}) r2 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x4182) io_setup(0x1, &(0x7f00000003c0)=0x0) io_submit(r3, 0x2, &(0x7f00000005c0)=[&(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x70, r2, &(0x7f0000000400)="e7acb3f84a906021407dd8f5b129d36a33c3bf2c2477201406867f17d6ae4dc1a2c241787d750226d4a3ef2486589bb95f451dc9056d8298af40fe7ea0a2e7555117a113beb670c86f501be9bcadac4af60d7bf02ec9afc759038a4a1a29cb63f0e813eacee470d0332d95307cfe04764879cd0eac4b9c26470d552f3c23442cb555c81490f227bacf27e58a34880f8276784ec245d36616a877d8ad538f371e40ef97eaa33e13d4e9b30b15820efbfb6152756a92ac1f57fc131ea9c36d134ee71ee374c7a5ac0886acc5a82eb65e516a20dcd26bd77a89c896728bc6b2c619885525a632a09263dbe1ab51b9bb8daa37e398982ef3cde0f861faad3c328a", 0xff, 0x2, 0x0, 0x2}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x3, 0x3, 0xffffffffffffffff, &(0x7f0000000540)="34f682da24135d8ec6626f9d0b833f95cad17d28ff2361a86cfffe5183fac4aaeaa41c97ad3e49b80285fe681d23665b8d7d97dd02d04d", 0x37, 0x7, 0x0, 0x1}]) preadv(r2, &(0x7f0000001640)=[{&(0x7f0000000000)=""/57, 0x39}, {&(0x7f0000000300)=""/4096, 0x1000}, {&(0x7f0000000040)}, {&(0x7f0000000180)=""/148, 0x94}, {&(0x7f0000000240)=""/106, 0x6a}, {&(0x7f0000001300)=""/54, 0x36}, {&(0x7f0000001340)=""/255, 0xff}, {&(0x7f0000001440)=""/219, 0xdb}, {&(0x7f0000001540)=""/211, 0xd3}], 0x9, 0x6) 20:36:46 executing program 3: r0 = socket$inet(0x10, 0x80003, 0x0) memfd_create(0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/mls\x00', 0x0, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000009c0)='/dev/loop-control\x00', 0x0, 0x0) ioctl$PIO_UNIMAP(r1, 0x4b67, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x1f, 0x80}]}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000340)='./cgroup.cpu/syz1\x00', 0x1ff) socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) r4 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000100)='cgroup.subtree_control\x00', 0x2, 0x0) pread64(r4, 0x0, 0x0, 0x6) r5 = dup(r4) setsockopt$packet_tx_ring(r5, 0x107, 0xd, &(0x7f0000000580)=@req={0x6, 0x4, 0x4, 0x4291}, 0x10) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r7 = openat$cgroup_subtree(r6, &(0x7f0000000100)='cgroup.subtree_control\x00', 0x2, 0x0) pread64(r7, 0x0, 0x0, 0x6) write$binfmt_misc(r7, &(0x7f0000000540)=ANY=[@ANYBLOB="73797a31614acb856f266b5c37f691ee42ec6b681aa733140e347381f5b6ebf4b4fab50f5ad5e407779e42f5240852f6adbfaaee4d3d90ba"], 0x38) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) r8 = openat(r1, &(0x7f0000000440)='./file0\x00', 0x0, 0x0) setsockopt$packet_drop_memb(r8, 0x107, 0x2, &(0x7f0000000480)={0x0, 0x1, 0x6, @broadcast}, 0x10) r9 = openat$zero(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/zero\x00', 0x8000, 0x0) ioctl$int_in(r9, 0x5421, &(0x7f0000000600)=0xff) creat(0x0, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000700)=ANY=[@ANYRESDEC=0x0, @ANYRESOCT=r0, @ANYPTR64=&(0x7f0000000740)=ANY=[@ANYRES64, @ANYRESDEC=r3], @ANYRES16=0x0], 0x35) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, 0x0, 0x0) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000000)={0x0, 0x7b, 0xf6}, 0x0, &(0x7f0000000140)="05dba0e3e1f617052ea1377827b8669973ff7d5543cb37cdfc7e2a6e1c6431b1b893245531a10fc9116abc2c53efb97f1996a9fb0201ac41f788f62fc26ee83a9936ebb26634e9859210d9cef5045c5545f90739d0ade3711fbc041444001ccb617a9571839469fdc5d611c3c6fb636443c8321dc20691827d2180", &(0x7f0000000200)=""/246) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000001c0)="24000000200007041dfffd946f6105000200000a1f0000400028080008000c00e9110300", 0x24}], 0x1}, 0x0) [ 87.481450] binder: 3626:3627 BC_INCREFS_DONE node 3 has no pending increfs request [ 87.489541] binder: 3626:3627 got reply transaction with no transaction stack [ 87.497362] binder: 3626:3627 transaction failed 29201/-71, size -1729382256910270464-72057594037927935 line 3046 [ 87.520009] binder: undelivered TRANSACTION_ERROR: 29201 [ 87.569172] binder: 3630:3633 BC_INCREFS_DONE node 5 has no pending increfs request [ 87.577553] binder: 3630:3633 got reply transaction with no transaction stack [ 87.585730] binder: 3630:3633 transaction failed 29201/-71, size -1729382256910270464-72057594037927935 line 3046 [ 87.607229] binder: undelivered TRANSACTION_ERROR: 29201 20:36:46 executing program 1: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'ip_vti0\x00', 0x0}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r2, 0x0, r2) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f0000000240)={@mcast2, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @loopback, 0x1, 0xfffc, 0x0, 0x0, 0x0, 0x21c00082, r1}) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr="93993974d566da0e3578d082d7ae73b9"}, 0x1c) 20:36:46 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x10800, 0x0) utime(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x8, 0x6}) close(r1) 20:36:47 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x60, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="086310400000000000000000000000000000000012634840000000000000000000000000000000000000000000000000000000000000000000000000000000e8ffffffffffffff00000000000000000000000000000000000000000000000000b582ec3d4e9ad2e6aba63cdc431a846aad1c6e8032a8f29b4337826f1407820b7eb85196e55d6c9ed534c5051ca40fb9c3bc7fc3cb2e830000"], 0x0, 0x0, 0x0}) r2 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x4182) io_setup(0x1, &(0x7f00000003c0)=0x0) io_submit(r3, 0x2, &(0x7f00000005c0)=[&(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x70, r2, &(0x7f0000000400)="e7acb3f84a906021407dd8f5b129d36a33c3bf2c2477201406867f17d6ae4dc1a2c241787d750226d4a3ef2486589bb95f451dc9056d8298af40fe7ea0a2e7555117a113beb670c86f501be9bcadac4af60d7bf02ec9afc759038a4a1a29cb63f0e813eacee470d0332d95307cfe04764879cd0eac4b9c26470d552f3c23442cb555c81490f227bacf27e58a34880f8276784ec245d36616a877d8ad538f371e40ef97eaa33e13d4e9b30b15820efbfb6152756a92ac1f57fc131ea9c36d134ee71ee374c7a5ac0886acc5a82eb65e516a20dcd26bd77a89c896728bc6b2c619885525a632a09263dbe1ab51b9bb8daa37e398982ef3cde0f861faad3c328a", 0xff, 0x2, 0x0, 0x2}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x3, 0x3, 0xffffffffffffffff, &(0x7f0000000540)="34f682da24135d8ec6626f9d0b833f95cad17d28ff2361a86cfffe5183fac4aaeaa41c97ad3e49b80285fe681d23665b8d7d97dd02d04d", 0x37, 0x7, 0x0, 0x1}]) preadv(r2, &(0x7f0000001640)=[{&(0x7f0000000000)=""/57, 0x39}, {&(0x7f0000000300)=""/4096, 0x1000}, {&(0x7f0000000040)}, {&(0x7f0000000180)=""/148, 0x94}, {&(0x7f0000000240)=""/106, 0x6a}, {&(0x7f0000001300)=""/54, 0x36}, {&(0x7f0000001340)=""/255, 0xff}, {&(0x7f0000001440)=""/219, 0xdb}, {&(0x7f0000001540)=""/211, 0xd3}], 0x9, 0x6) 20:36:47 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7277}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, 0x0) socket$inet(0x2, 0xa, 0x0) timer_create(0x0, &(0x7f0000000480)={0x0, 0x32, 0x1, @tid=0xffffffffffffffff}, &(0x7f00000007c0)=0x0) timer_settime(r0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}}, 0x0) ftruncate(0xffffffffffffffff, 0x0) lstat(0x0, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0}) prctl$PR_SET_UNALIGN(0x6, 0x0) getresgid(&(0x7f0000000040), &(0x7f00000002c0), &(0x7f0000000500)=0x0) setgid(r2) perf_event_open(&(0x7f0000000580)={0x0, 0x70, 0x0, 0x0, 0x6, 0x9, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x3, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000540), 0xf2d8b275e8d6173b}, 0x0, 0x0, 0x9, 0x7, 0x0, 0x0, 0x62}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x2) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) bind$unix(r4, &(0x7f0000000680)=@file={0x0, './file0\x00'}, 0x6e) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0xc) mount$bpf(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x80808, &(0x7f00000003c0)={[{@mode={'\x00\x02\x00', 0x3d, 0x8000}}], [{@euid_lt={'euid<'}}, {@permit_directio='permit_directio'}, {@smackfsdef={'smackfsdef', 0x3d, 'group_id'}}, {@fowner_gt={'fowner>', r1}}, {@uid_lt={'uid<', r5}}, {@smackfstransmute={'smackfstransmute'}}]}) openat$fuse(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fuse\x00', 0x2, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)=@getaddr={0x14, 0x16, 0x2, 0x70bd29, 0x25dfdbfd, {}, ["", "", "", "", ""]}, 0x14}}, 0x8084) 20:36:47 executing program 3: getpgrp(0x0) ioctl$int_in(0xffffffffffffffff, 0x0, &(0x7f0000000040)=0xfffffffffffffffe) r0 = getpgrp(0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/hash_stats\x00', 0x0, 0x0) fgetxattr(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="747275737465642e747a75ffffff7f08"], &(0x7f0000000880)=""/4096, 0x1000) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000000040)=0xfffffffffffffffe) r2 = syz_open_procfs(r0, &(0x7f0000000080)='net/dev_snmp6\x00') openat$ptmx(0xffffffffffffff9c, 0x0, 0xf292970b90c98047, 0x0) dup3(0xffffffffffffffff, r2, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r4, 0x40045431, &(0x7f0000000280)) write$binfmt_aout(r4, &(0x7f0000000240)=ANY=[], 0x35b) ioctl$TCSETA(r4, 0x5406, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x100000009b4b62b}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r4) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x37, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0x3ff}, 0x4000, 0x0, 0x0, 0x5, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x8000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7, 0x7ff}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz1\x00', 0x1ff) r5 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) keyctl$reject(0x13, r5, 0x0, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) mmap$binder(&(0x7f0000ff2000/0x2000)=nil, 0x2000, 0x1, 0x11, r7, 0x9) add_key$keyring(0x0, &(0x7f0000000840)={'syz', 0x3}, 0x0, 0x0, r5) request_key(&(0x7f00000001c0)='trusted\x00', &(0x7f0000000200)={'syz', 0x1}, &(0x7f0000000300)='net/dev_snmp6\x00', 0xffffffffffffffff) keyctl$reject(0x13, 0x0, 0x0, 0x3, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r8, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) getsockopt$IP_VS_SO_GET_INFO(r3, 0x0, 0x481, &(0x7f0000000000), &(0x7f0000000140)=0xc) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0x2, 0x13012, r8, 0x0) 20:36:47 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xff) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0800b5055e0bcfe87b2071") r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = socket(0x840000000002, 0x3, 0xff) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000080)='ip6_vti0\x00 \x00', 0x10) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e21, 0x760, @empty, 0x8}, 0x1c) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @initdev}, 0x10) write$binfmt_elf32(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="4ef2faff32460000002f006ce00a00117fffffff830923000000000000440b9c3b170b360700e00000000009000b00108d994fd1826b0018"], 0x38) [ 87.895516] binder: 3642:3647 BC_INCREFS_DONE node 7 has no pending increfs request [ 87.914670] binder: 3642:3647 got reply transaction with no transaction stack [ 87.920819] syz-executor.2 uses obsolete (PF_INET,SOCK_PACKET) 20:36:47 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xff) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0800b5055e0bcfe87b2071") r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = socket(0x840000000002, 0x3, 0xff) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000080)='ip6_vti0\x00 \x00', 0x10) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e21, 0x760, @empty, 0x8}, 0x1c) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @initdev}, 0x10) write$binfmt_elf32(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="4ef2faff32460000002f006ce00a00117fffffff830923000000000000440b9c3b170b360700e00000000009000b00108d994fd1826b0018"], 0x38) 20:36:47 executing program 1: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'ip_vti0\x00', 0x0}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r2, 0x0, r2) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f0000000240)={@mcast2, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @loopback, 0x1, 0xfffc, 0x0, 0x0, 0x0, 0x21c00082, r1}) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr="93993974d566da0e3578d082d7ae73b9"}, 0x1c) 20:36:47 executing program 5: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'ip_vti0\x00', 0x0}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r2, 0x0, r2) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f0000000240)={@mcast2, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @loopback, 0x1, 0xfffc, 0x0, 0x0, 0x0, 0x21c00082, r1}) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr="93993974d566da0e3578d082d7ae73b9"}, 0x1c) 20:36:47 executing program 1: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'ip_vti0\x00', 0x0}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r2, 0x0, r2) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f0000000240)={@mcast2, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @loopback, 0x1, 0xfffc, 0x0, 0x0, 0x0, 0x21c00082, r1}) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr="93993974d566da0e3578d082d7ae73b9"}, 0x1c) [ 87.922354] [ 87.922357] =============================== [ 87.922358] [ INFO: suspicious RCU usage. ] [ 87.922365] 4.9.205-syzkaller #0 Not tainted 20:36:47 executing program 5: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'ip_vti0\x00', 0x0}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r2, 0x0, r2) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f0000000240)={@mcast2, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @loopback, 0x1, 0xfffc, 0x0, 0x0, 0x0, 0x21c00082, r1}) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr="93993974d566da0e3578d082d7ae73b9"}, 0x1c) 20:36:47 executing program 1: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'ip_vti0\x00', 0x0}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r2, 0x0, r2) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f0000000240)={@mcast2, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @loopback, 0x1, 0xfffc, 0x0, 0x0, 0x0, 0x21c00082, r1}) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr="93993974d566da0e3578d082d7ae73b9"}, 0x1c) [ 87.922367] ------------------------------- [ 87.922374] include/linux/inetdevice.h:205 suspicious rcu_dereference_check() usage! 20:36:47 executing program 1: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'ip_vti0\x00'}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r1, 0x0, r1) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr="93993974d566da0e3578d082d7ae73b9"}, 0x1c) [ 87.922376] [ 87.922376] other info that might help us debug this: [ 87.922376] [ 87.922381] [ 87.922381] rcu_scheduler_active = 2, debug_locks = 0 [ 87.922388] 4 locks held by syz-executor.5/3652: [ 87.922419] #0: (rcu_read_lock_bh){......}, at: [<0000000061dcdef9>] ip_finish_output2+0x20b/0x1280 [ 87.922441] #1: (rcu_read_lock_bh){......}, at: [<00000000208790fc>] __dev_queue_xmit+0x1d4/0x1bd0 [ 87.922460] #2: (_xmit_TUNNEL6#2){+.-...}, at: [<000000002aa74d34>] __dev_queue_xmit+0x1116/0x1bd0 [ 87.922473] #3: (slock-AF_INET){+.-...}, at: [<000000002f65d4b7>] __icmp_send+0x48b/0x1420 [ 87.922474] [ 87.922474] stack backtrace: [ 87.922482] CPU: 0 PID: 3652 Comm: syz-executor.5 Not tainted 4.9.205-syzkaller #0 [ 87.922499] ffff8801d2fc6dd8 ffffffff81b55e6b ffff8801d1d4d3c0 0000000000000000 [ 87.922513] 0000000000000002 00000000000000cd ffff8801d30897c0 ffff8801d2fc6e08 [ 87.922523] ffffffff81406997 ffff8801d1d4d418 ffff8801d2fc6f28 ffff8801d5268000 [ 87.922525] Call Trace: [ 87.922536] [<000000005129a9e8>] dump_stack+0xcb/0x130 [ 87.922547] [<00000000951d0f1a>] lockdep_rcu_suspicious.cold+0x10a/0x149 [ 87.922556] [<000000001250b8b2>] fib_compute_spec_dst+0x6c4/0xcc0 [ 87.922565] [<00000000970a7525>] ? fib_unmerge+0x4c0/0x4c0 [ 87.922574] [<0000000009077edd>] ? perf_trace_lock_acquire+0x530/0x530 [ 87.922582] [<00000000cc829c67>] ? __lock_acquire+0x5e0/0x4390 [ 87.922592] [<00000000bd38cce4>] ? debug_smp_processor_id+0x1c/0x20 [ 87.922599] [<0000000048f63706>] ? perf_trace_lock+0x11e/0x540 [ 87.922609] [<00000000b4fdbb7c>] __ip_options_echo+0x4be/0x13e0 [ 87.922616] [<000000009c2331fe>] __icmp_send+0x648/0x1420 [ 87.922622] [<000000006880676e>] ? __icmp_send+0xc07/0x1420 [ 87.922631] [<00000000bd38cce4>] ? debug_smp_processor_id+0x1c/0x20 [ 87.922638] [<0000000048f63706>] ? perf_trace_lock+0x11e/0x540 [ 87.922645] [<000000007be93075>] ? icmpv4_xrlim_allow.isra.0+0x2d0/0x2d0 [ 87.922653] [<0000000048f63706>] ? perf_trace_lock+0x11e/0x540 [ 87.922662] [<000000009b5df33a>] ? ipv4_link_failure+0x410/0x850 [ 87.922670] [<000000000c3c8dbd>] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 87.922678] [<0000000065035f53>] ? __ip_options_compile+0x668/0x13c0 [ 87.922687] [<00000000109cff91>] ? check_preemption_disabled+0x3c/0x200 [ 87.922695] [<000000009b5df33a>] ? ipv4_link_failure+0x410/0x850 [ 87.922703] [<00000000f412095e>] ipv4_link_failure+0x460/0x850 [ 87.922710] [<000000006e43e4b9>] ? ipv4_link_failure+0x32b/0x850 [ 87.922719] [<0000000085faad2f>] ? rt_dst_alloc+0x450/0x450 [ 87.922726] [<0000000085faad2f>] ? rt_dst_alloc+0x450/0x450 [ 87.922735] [<00000000afae8172>] vti6_tnl_xmit+0xb08/0x17f0 [ 87.922743] [<00000000f3924801>] ? vti6_dellink+0x270/0x270 [ 87.922753] [<00000000ed5cd717>] dev_hard_start_xmit+0x195/0x8b0 [ 87.922761] [<00000000ac676a4f>] __dev_queue_xmit+0x11a3/0x1bd0 [ 87.922770] [<00000000208790fc>] ? __dev_queue_xmit+0x1d4/0x1bd0 [ 87.922779] [<000000000c551ba2>] ? __local_bh_enable_ip+0x6a/0xe0 [ 87.922786] [<00000000451d67f8>] ? netdev_pick_tx+0x300/0x300 [ 87.922794] [<0000000093f59efa>] ? __neigh_create+0x96e/0x1b30 [ 87.922803] [<0000000096901f49>] dev_queue_xmit+0x18/0x20 [ 87.922811] [<000000008ed681bf>] neigh_direct_output+0x16/0x20 [ 87.922817] [<00000000190ea3f3>] ip_finish_output2+0x6a2/0x1280 [ 87.922824] [<0000000061dcdef9>] ? ip_finish_output2+0x20b/0x1280 [ 87.922831] [<0000000038f07bcc>] ? rcu_read_lock_held+0x9e/0xc0 [ 87.922840] [<000000001093ae52>] ? nf_iterate+0x19e/0x310 [ 87.922846] [<0000000069dc6dab>] ? ip_send_check+0xb0/0xb0 [ 87.922854] [<000000000c3c8dbd>] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 87.922861] [<00000000eb578c49>] ? nf_hook_slow+0x12f/0x1f0 [ 87.922869] [<00000000ad8e474d>] ip_finish_output+0x3c4/0xce0 [ 87.922875] [<000000008b75145d>] ip_output+0x1ec/0x5b0 [ 87.922882] [<00000000652769c9>] ? ip_output+0x287/0x5b0 [ 87.922889] [<00000000625bb705>] ? ip_mc_output+0xcb0/0xcb0 [ 87.922897] [<0000000026e4e9f6>] ? nf_hook_slow+0x112/0x1f0 [ 87.922905] [<00000000b4483624>] ? ip_fragment.constprop.0+0x210/0x210 [ 87.922913] [<00000000109cff91>] ? check_preemption_disabled+0x3c/0x200 [ 87.922921] [<000000002b1ec13f>] ? raw_sendmsg+0x1929/0x23e0 [ 87.922928] [<000000007c977197>] raw_sendmsg+0x1c5c/0x23e0 [ 87.922936] [<0000000082d441fd>] ? raw_sendmsg+0x1851/0x23e0 [ 87.922946] [<0000000016e9092c>] ? avc_has_perm+0x164/0x3a0 [ 87.922955] [<000000000b8127ac>] ? compat_raw_setsockopt+0xd0/0xd0 [ 87.922962] [<00000000cc829c67>] ? __lock_acquire+0x5e0/0x4390 [ 87.922971] [<00000000293067e8>] ? perf_trace_lock_acquire+0x4e2/0x530 [ 87.922980] [<0000000047c75eb0>] ? ip4_datagram_release_cb+0x970/0x970 [ 87.922987] [<0000000027a19ada>] ? selinux_msg_queue_alloc_security+0x2e0/0x2e0 [ 87.922995] [<00000000535bb794>] ? migrate_swap_stop+0x7d2/0x810 [ 87.923003] [<0000000031481e0f>] ? inet_sendmsg+0x143/0x4d0 [ 87.923010] [<000000000c3c8dbd>] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 87.923018] [<00000000109cff91>] ? check_preemption_disabled+0x3c/0x200 [ 87.923027] [<00000000109cff91>] ? check_preemption_disabled+0x3c/0x200 [ 87.923037] [<00000000109cff91>] ? check_preemption_disabled+0x3c/0x200 [ 87.923043] [<0000000031481e0f>] ? inet_sendmsg+0x143/0x4d0 [ 87.923050] [<00000000d4b7f9a7>] inet_sendmsg+0x202/0x4d0 [ 87.923058] [<00000000fbe2cc5f>] ? inet_sendmsg+0x76/0x4d0 [ 87.923065] [<000000006dc7beae>] ? inet_recvmsg+0x4d0/0x4d0 [ 87.923074] [<0000000094e2fb00>] sock_sendmsg+0xbe/0x110 [ 87.923081] [<000000007f6530f9>] sock_write_iter+0x235/0x3d0 [ 87.923090] [<00000000109cff91>] ? check_preemption_disabled+0x3c/0x200 [ 87.923097] [<000000006bdfc62a>] ? sock_sendmsg+0x110/0x110 [ 87.923110] [<0000000011f13583>] ? iov_iter_init+0xaf/0x1d0 [ 87.923120] [<00000000a6662821>] __vfs_write+0x3c1/0x560 [ 87.923131] [<00000000bc6429f9>] ? bpf_fd_pass+0x270/0x270 [ 87.923140] [<00000000a83c8f0a>] ? __vfs_read+0x550/0x550 [ 87.923153] [<00000000d10c9ecd>] ? selinux_file_permission+0x85/0x470 [ 87.923163] [<00000000aef3537d>] ? security_file_permission+0x8f/0x1f0 [ 87.923170] [<000000002098a29a>] ? rw_verify_area+0xea/0x2b0 [ 87.923178] [<0000000049e19732>] vfs_write+0x185/0x520 [ 87.923185] [<00000000bf0a546d>] SyS_write+0x121/0x270 [ 87.923193] [<000000003ce39699>] ? SyS_read+0x270/0x270 [ 87.923201] [<00000000a2868d4b>] ? do_syscall_64+0x4a/0x5c0 [ 87.923208] [<000000003ce39699>] ? SyS_read+0x270/0x270 [ 87.923215] [<00000000805d4cb0>] do_syscall_64+0x1ad/0x5c0 [ 87.923225] [<0000000058dd1a22>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 88.836421] binder: 3642:3647 transaction failed 29201/-71, size -1729382256910270464-72057594037927935 line 3046 [ 88.849870] binder: undelivered TRANSACTION_ERROR: 29201 20:36:49 executing program 0: getpgrp(0x0) ioctl$int_in(0xffffffffffffffff, 0x0, &(0x7f0000000040)=0xfffffffffffffffe) r0 = getpgrp(0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/hash_stats\x00', 0x0, 0x0) fgetxattr(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="747275737465642e747a75ffffff7f08"], &(0x7f0000000880)=""/4096, 0x1000) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000000040)=0xfffffffffffffffe) r2 = syz_open_procfs(r0, &(0x7f0000000080)='net/dev_snmp6\x00') openat$ptmx(0xffffffffffffff9c, 0x0, 0xf292970b90c98047, 0x0) dup3(0xffffffffffffffff, r2, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r4, 0x40045431, &(0x7f0000000280)) write$binfmt_aout(r4, &(0x7f0000000240)=ANY=[], 0x35b) ioctl$TCSETA(r4, 0x5406, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x100000009b4b62b}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r4) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x37, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0x3ff}, 0x4000, 0x0, 0x0, 0x5, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x8000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7, 0x7ff}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz1\x00', 0x1ff) r5 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) keyctl$reject(0x13, r5, 0x0, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) mmap$binder(&(0x7f0000ff2000/0x2000)=nil, 0x2000, 0x1, 0x11, r7, 0x9) add_key$keyring(0x0, &(0x7f0000000840)={'syz', 0x3}, 0x0, 0x0, r5) request_key(&(0x7f00000001c0)='trusted\x00', &(0x7f0000000200)={'syz', 0x1}, &(0x7f0000000300)='net/dev_snmp6\x00', 0xffffffffffffffff) keyctl$reject(0x13, 0x0, 0x0, 0x3, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r8, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) getsockopt$IP_VS_SO_GET_INFO(r3, 0x0, 0x481, &(0x7f0000000000), &(0x7f0000000140)=0xc) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0x2, 0x13012, r8, 0x0) 20:36:49 executing program 5: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'ip_vti0\x00', 0x0}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r2, 0x0, r2) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f0000000240)={@mcast2, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @loopback, 0x1, 0xfffc, 0x0, 0x0, 0x0, 0x21c00082, r1}) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr="93993974d566da0e3578d082d7ae73b9"}, 0x1c) 20:36:49 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7277}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000000300)='fuse\x00', 0x0, 0x0) socket$inet(0x2, 0xa, 0x0) timer_create(0x0, &(0x7f0000000480)={0x0, 0x32, 0x1, @tid=0xffffffffffffffff}, &(0x7f00000007c0)=0x0) timer_settime(r0, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}}, 0x0) ftruncate(0xffffffffffffffff, 0x0) lstat(0x0, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0}) prctl$PR_SET_UNALIGN(0x6, 0x0) getresgid(&(0x7f0000000040), &(0x7f00000002c0), &(0x7f0000000500)=0x0) setgid(r2) perf_event_open(&(0x7f0000000580)={0x0, 0x70, 0x0, 0x0, 0x6, 0x9, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x3, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000540), 0xf2d8b275e8d6173b}, 0x0, 0x0, 0x9, 0x7, 0x0, 0x0, 0x62}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x2) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001500)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) bind$unix(r4, &(0x7f0000000680)=@file={0x0, './file0\x00'}, 0x6e) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0xc) mount$bpf(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x80808, &(0x7f00000003c0)={[{@mode={'\x00\x02\x00', 0x3d, 0x8000}}], [{@euid_lt={'euid<'}}, {@permit_directio='permit_directio'}, {@smackfsdef={'smackfsdef', 0x3d, 'group_id'}}, {@fowner_gt={'fowner>', r1}}, {@uid_lt={'uid<', r5}}, {@smackfstransmute={'smackfstransmute'}}]}) openat$fuse(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fuse\x00', 0x2, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)=@getaddr={0x14, 0x16, 0x2, 0x70bd29, 0x25dfdbfd, {}, ["", "", "", "", ""]}, 0x14}}, 0x8084) 20:36:49 executing program 3: getpgrp(0x0) ioctl$int_in(0xffffffffffffffff, 0x0, &(0x7f0000000040)=0xfffffffffffffffe) r0 = getpgrp(0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/hash_stats\x00', 0x0, 0x0) fgetxattr(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="747275737465642e747a75ffffff7f08"], &(0x7f0000000880)=""/4096, 0x1000) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000000040)=0xfffffffffffffffe) r2 = syz_open_procfs(r0, &(0x7f0000000080)='net/dev_snmp6\x00') openat$ptmx(0xffffffffffffff9c, 0x0, 0xf292970b90c98047, 0x0) dup3(0xffffffffffffffff, r2, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r4, 0x40045431, &(0x7f0000000280)) write$binfmt_aout(r4, &(0x7f0000000240)=ANY=[], 0x35b) ioctl$TCSETA(r4, 0x5406, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x100000009b4b62b}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r4) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x37, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0x3ff}, 0x4000, 0x0, 0x0, 0x5, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x8000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7, 0x7ff}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz1\x00', 0x1ff) r5 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) keyctl$reject(0x13, r5, 0x0, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) mmap$binder(&(0x7f0000ff2000/0x2000)=nil, 0x2000, 0x1, 0x11, r7, 0x9) add_key$keyring(0x0, &(0x7f0000000840)={'syz', 0x3}, 0x0, 0x0, r5) request_key(&(0x7f00000001c0)='trusted\x00', &(0x7f0000000200)={'syz', 0x1}, &(0x7f0000000300)='net/dev_snmp6\x00', 0xffffffffffffffff) keyctl$reject(0x13, 0x0, 0x0, 0x3, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r8, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) getsockopt$IP_VS_SO_GET_INFO(r3, 0x0, 0x481, &(0x7f0000000000), &(0x7f0000000140)=0xc) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0x2, 0x13012, r8, 0x0) 20:36:49 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x60, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="086310400000000000000000000000000000000012634840000000000000000000000000000000000000000000000000000000000000000000000000000000e8ffffffffffffff00000000000000000000000000000000000000000000000000b582ec3d4e9ad2e6aba63cdc431a846aad1c6e8032a8f29b4337826f1407820b7eb85196e55d6c9ed534c5051ca40fb9c3bc7fc3cb2e830000"], 0x0, 0x0, 0x0}) r2 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x4182) io_setup(0x1, &(0x7f00000003c0)=0x0) io_submit(r3, 0x2, &(0x7f00000005c0)=[&(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x70, r2, &(0x7f0000000400)="e7acb3f84a906021407dd8f5b129d36a33c3bf2c2477201406867f17d6ae4dc1a2c241787d750226d4a3ef2486589bb95f451dc9056d8298af40fe7ea0a2e7555117a113beb670c86f501be9bcadac4af60d7bf02ec9afc759038a4a1a29cb63f0e813eacee470d0332d95307cfe04764879cd0eac4b9c26470d552f3c23442cb555c81490f227bacf27e58a34880f8276784ec245d36616a877d8ad538f371e40ef97eaa33e13d4e9b30b15820efbfb6152756a92ac1f57fc131ea9c36d134ee71ee374c7a5ac0886acc5a82eb65e516a20dcd26bd77a89c896728bc6b2c619885525a632a09263dbe1ab51b9bb8daa37e398982ef3cde0f861faad3c328a", 0xff, 0x2, 0x0, 0x2}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x3, 0x3, 0xffffffffffffffff, &(0x7f0000000540)="34f682da24135d8ec6626f9d0b833f95cad17d28ff2361a86cfffe5183fac4aaeaa41c97ad3e49b80285fe681d23665b8d7d97dd02d04d", 0x37, 0x7, 0x0, 0x1}]) 20:36:49 executing program 5: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'ip_vti0\x00', 0x0}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r2, 0x0, r2) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f0000000240)={@mcast2, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @loopback, 0x1, 0xfffc, 0x0, 0x0, 0x0, 0x21c00082, r1}) 20:36:49 executing program 1: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'ip_vti0\x00'}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r1, 0x0, r1) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr="93993974d566da0e3578d082d7ae73b9"}, 0x1c) 20:36:50 executing program 5: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'ip_vti0\x00'}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r1, 0x0, r1) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) 20:36:50 executing program 1: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'ip_vti0\x00'}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r1, 0x0, r1) socket(0x10, 0x803, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr="93993974d566da0e3578d082d7ae73b9"}, 0x1c) [ 90.903986] binder: 3931:3935 BC_INCREFS_DONE node 9 has no pending increfs request [ 90.940299] binder: 3931:3935 got reply transaction with no transaction stack 20:36:50 executing program 1: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'ip_vti0\x00'}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r1, 0x0, r1) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr="93993974d566da0e3578d082d7ae73b9"}, 0x1c) 20:36:50 executing program 5: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'ip_vti0\x00'}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r1, 0x0, r1) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) 20:36:50 executing program 5: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'ip_vti0\x00'}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r1, 0x0, r1) socket(0x10, 0x803, 0x0) 20:36:50 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x60, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="086310400000000000000000000000000000000012634840000000000000000000000000000000000000000000000000000000000000000000000000000000e8ffffffffffffff00000000000000000000000000000000000000000000000000b582ec3d4e9ad2e6aba63cdc431a846aad1c6e8032a8f29b4337826f1407820b7eb85196e55d6c9ed534c5051ca40fb9c3bc7fc3cb2e830000"], 0x0, 0x0, 0x0}) r2 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x4182) io_setup(0x1, &(0x7f00000003c0)=0x0) io_submit(r3, 0x2, &(0x7f00000005c0)=[&(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x70, r2, &(0x7f0000000400)="e7acb3f84a906021407dd8f5b129d36a33c3bf2c2477201406867f17d6ae4dc1a2c241787d750226d4a3ef2486589bb95f451dc9056d8298af40fe7ea0a2e7555117a113beb670c86f501be9bcadac4af60d7bf02ec9afc759038a4a1a29cb63f0e813eacee470d0332d95307cfe04764879cd0eac4b9c26470d552f3c23442cb555c81490f227bacf27e58a34880f8276784ec245d36616a877d8ad538f371e40ef97eaa33e13d4e9b30b15820efbfb6152756a92ac1f57fc131ea9c36d134ee71ee374c7a5ac0886acc5a82eb65e516a20dcd26bd77a89c896728bc6b2c619885525a632a09263dbe1ab51b9bb8daa37e398982ef3cde0f861faad3c328a", 0xff, 0x2, 0x0, 0x2}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x3, 0x3, 0xffffffffffffffff, &(0x7f0000000540)="34f682da24135d8ec6626f9d0b833f95cad17d28ff2361a86cfffe5183fac4aaeaa41c97ad3e49b80285fe681d23665b8d7d97dd02d04d", 0x37, 0x7, 0x0, 0x1}]) 20:36:50 executing program 0: getpgrp(0x0) ioctl$int_in(0xffffffffffffffff, 0x0, &(0x7f0000000040)=0xfffffffffffffffe) r0 = getpgrp(0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/hash_stats\x00', 0x0, 0x0) fgetxattr(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="747275737465642e747a75ffffff7f08"], &(0x7f0000000880)=""/4096, 0x1000) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000000040)=0xfffffffffffffffe) r2 = syz_open_procfs(r0, &(0x7f0000000080)='net/dev_snmp6\x00') openat$ptmx(0xffffffffffffff9c, 0x0, 0xf292970b90c98047, 0x0) dup3(0xffffffffffffffff, r2, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r4, 0x40045431, &(0x7f0000000280)) write$binfmt_aout(r4, &(0x7f0000000240)=ANY=[], 0x35b) ioctl$TCSETA(r4, 0x5406, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x100000009b4b62b}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r4) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x37, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0x3ff}, 0x4000, 0x0, 0x0, 0x5, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x8000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7, 0x7ff}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz1\x00', 0x1ff) r5 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) keyctl$reject(0x13, r5, 0x0, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) mmap$binder(&(0x7f0000ff2000/0x2000)=nil, 0x2000, 0x1, 0x11, r7, 0x9) add_key$keyring(0x0, &(0x7f0000000840)={'syz', 0x3}, 0x0, 0x0, r5) request_key(&(0x7f00000001c0)='trusted\x00', &(0x7f0000000200)={'syz', 0x1}, &(0x7f0000000300)='net/dev_snmp6\x00', 0xffffffffffffffff) keyctl$reject(0x13, 0x0, 0x0, 0x3, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r8, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) getsockopt$IP_VS_SO_GET_INFO(r3, 0x0, 0x481, &(0x7f0000000000), &(0x7f0000000140)=0xc) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0x2, 0x13012, r8, 0x0) [ 90.955752] binder: 3931:3935 transaction failed 29201/-71, size -1729382256910270464-72057594037927935 line 3046 [ 90.990153] binder: undelivered TRANSACTION_ERROR: 29201 [ 91.029617] binder: 3963:3964 BC_INCREFS_DONE node 11 has no pending increfs request [ 91.038037] binder: 3963:3964 got reply transaction with no transaction stack [ 91.045660] binder: 3963:3964 transaction failed 29201/-71, size -1729382256910270464-72057594037927935 line 3046 [ 91.065971] binder: undelivered TRANSACTION_ERROR: 29201 20:36:52 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x60, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="086310400000000000000000000000000000000012634840000000000000000000000000000000000000000000000000000000000000000000000000000000e8ffffffffffffff00000000000000000000000000000000000000000000000000b582ec3d4e9ad2e6aba63cdc431a846aad1c6e8032a8f29b4337826f1407820b7eb85196e55d6c9ed534c5051ca40fb9c3bc7fc3cb2e830000"], 0x0, 0x0, 0x0}) r2 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x4182) io_setup(0x1, &(0x7f00000003c0)=0x0) io_submit(r3, 0x2, &(0x7f00000005c0)=[&(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x70, r2, &(0x7f0000000400)="e7acb3f84a906021407dd8f5b129d36a33c3bf2c2477201406867f17d6ae4dc1a2c241787d750226d4a3ef2486589bb95f451dc9056d8298af40fe7ea0a2e7555117a113beb670c86f501be9bcadac4af60d7bf02ec9afc759038a4a1a29cb63f0e813eacee470d0332d95307cfe04764879cd0eac4b9c26470d552f3c23442cb555c81490f227bacf27e58a34880f8276784ec245d36616a877d8ad538f371e40ef97eaa33e13d4e9b30b15820efbfb6152756a92ac1f57fc131ea9c36d134ee71ee374c7a5ac0886acc5a82eb65e516a20dcd26bd77a89c896728bc6b2c619885525a632a09263dbe1ab51b9bb8daa37e398982ef3cde0f861faad3c328a", 0xff, 0x2, 0x0, 0x2}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x3, 0x3, 0xffffffffffffffff, &(0x7f0000000540)="34f682da24135d8ec6626f9d0b833f95cad17d28ff2361a86cfffe5183fac4aaeaa41c97ad3e49b80285fe681d23665b8d7d97dd02d04d", 0x37, 0x7, 0x0, 0x1}]) 20:36:52 executing program 5: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'ip_vti0\x00'}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r1, 0x0, r1) 20:36:52 executing program 1: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'ip_vti0\x00'}) socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr="93993974d566da0e3578d082d7ae73b9"}, 0x1c) 20:36:52 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x60, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="086310400000000000000000000000000000000012634840000000000000000000000000000000000000000000000000000000000000000000000000000000e8ffffffffffffff00000000000000000000000000000000000000000000000000b582ec3d4e9ad2e6aba63cdc431a846aad1c6e8032a8f29b4337826f1407820b7eb85196e55d6c9ed534c5051ca40fb9c3bc7fc3cb2e830000"], 0x0, 0x0, 0x0}) r2 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x4182) io_setup(0x1, &(0x7f00000003c0)=0x0) io_submit(r3, 0x2, &(0x7f00000005c0)=[&(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x70, r2, &(0x7f0000000400)="e7acb3f84a906021407dd8f5b129d36a33c3bf2c2477201406867f17d6ae4dc1a2c241787d750226d4a3ef2486589bb95f451dc9056d8298af40fe7ea0a2e7555117a113beb670c86f501be9bcadac4af60d7bf02ec9afc759038a4a1a29cb63f0e813eacee470d0332d95307cfe04764879cd0eac4b9c26470d552f3c23442cb555c81490f227bacf27e58a34880f8276784ec245d36616a877d8ad538f371e40ef97eaa33e13d4e9b30b15820efbfb6152756a92ac1f57fc131ea9c36d134ee71ee374c7a5ac0886acc5a82eb65e516a20dcd26bd77a89c896728bc6b2c619885525a632a09263dbe1ab51b9bb8daa37e398982ef3cde0f861faad3c328a", 0xff, 0x2, 0x0, 0x2}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x3, 0x3, 0xffffffffffffffff, &(0x7f0000000540)="34f682da24135d8ec6626f9d0b833f95cad17d28ff2361a86cfffe5183fac4aaeaa41c97ad3e49b80285fe681d23665b8d7d97dd02d04d", 0x37, 0x7, 0x0, 0x1}]) 20:36:52 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x60, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="086310400000000000000000000000000000000012634840000000000000000000000000000000000000000000000000000000000000000000000000000000e8ffffffffffffff00000000000000000000000000000000000000000000000000b582ec3d4e9ad2e6aba63cdc431a846aad1c6e8032a8f29b4337826f1407820b7eb85196e55d6c9ed534c5051ca40fb9c3bc7fc3cb2e830000"], 0x0, 0x0, 0x0}) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x4182) io_setup(0x1, &(0x7f00000003c0)) 20:36:52 executing program 0: getpgrp(0x0) ioctl$int_in(0xffffffffffffffff, 0x0, &(0x7f0000000040)=0xfffffffffffffffe) r0 = getpgrp(0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/hash_stats\x00', 0x0, 0x0) fgetxattr(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="747275737465642e747a75ffffff7f08"], &(0x7f0000000880)=""/4096, 0x1000) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000000040)=0xfffffffffffffffe) r2 = syz_open_procfs(r0, &(0x7f0000000080)='net/dev_snmp6\x00') openat$ptmx(0xffffffffffffff9c, 0x0, 0xf292970b90c98047, 0x0) dup3(0xffffffffffffffff, r2, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r4, 0x40045431, &(0x7f0000000280)) write$binfmt_aout(r4, &(0x7f0000000240)=ANY=[], 0x35b) ioctl$TCSETA(r4, 0x5406, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x100000009b4b62b}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r4) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x37, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0x3ff}, 0x4000, 0x0, 0x0, 0x5, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x8000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7, 0x7ff}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz1\x00', 0x1ff) r5 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) keyctl$reject(0x13, r5, 0x0, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) mmap$binder(&(0x7f0000ff2000/0x2000)=nil, 0x2000, 0x1, 0x11, r7, 0x9) add_key$keyring(0x0, &(0x7f0000000840)={'syz', 0x3}, 0x0, 0x0, r5) request_key(&(0x7f00000001c0)='trusted\x00', &(0x7f0000000200)={'syz', 0x1}, &(0x7f0000000300)='net/dev_snmp6\x00', 0xffffffffffffffff) keyctl$reject(0x13, 0x0, 0x0, 0x3, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r8, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) getsockopt$IP_VS_SO_GET_INFO(r3, 0x0, 0x481, &(0x7f0000000000), &(0x7f0000000140)=0xc) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0x2, 0x13012, r8, 0x0) 20:36:52 executing program 5: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'ip_vti0\x00'}) socket$inet6_tcp(0xa, 0x1, 0x0) 20:36:52 executing program 1: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'ip_vti0\x00'}) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr="93993974d566da0e3578d082d7ae73b9"}, 0x1c) 20:36:52 executing program 5: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'ip_vti0\x00'}) 20:36:52 executing program 5: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'ip_vti0\x00'}) 20:36:52 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x60, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="086310400000000000000000000000000000000012634840000000000000000000000000000000000000000000000000000000000000000000000000000000e8ffffffffffffff00000000000000000000000000000000000000000000000000b582ec3d4e9ad2e6aba63cdc431a846aad1c6e8032a8f29b4337826f1407820b7eb85196e55d6c9ed534c5051ca40fb9c3bc7fc3cb2e830000"], 0x0, 0x0, 0x0}) r2 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x4182) io_setup(0x1, &(0x7f00000003c0)=0x0) io_submit(r3, 0x2, &(0x7f00000005c0)=[&(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x70, r2, &(0x7f0000000400)="e7acb3f84a906021407dd8f5b129d36a33c3bf2c2477201406867f17d6ae4dc1a2c241787d750226d4a3ef2486589bb95f451dc9056d8298af40fe7ea0a2e7555117a113beb670c86f501be9bcadac4af60d7bf02ec9afc759038a4a1a29cb63f0e813eacee470d0332d95307cfe04764879cd0eac4b9c26470d552f3c23442cb555c81490f227bacf27e58a34880f8276784ec245d36616a877d8ad538f371e40ef97eaa33e13d4e9b30b15820efbfb6152756a92ac1f57fc131ea9c36d134ee71ee374c7a5ac0886acc5a82eb65e516a20dcd26bd77a89c896728bc6b2c619885525a632a09263dbe1ab51b9bb8daa37e398982ef3cde0f861faad3c328a", 0xff, 0x2, 0x0, 0x2}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x3, 0x3, 0xffffffffffffffff, &(0x7f0000000540)="34f682da24135d8ec6626f9d0b833f95cad17d28ff2361a86cfffe5183fac4aaeaa41c97ad3e49b80285fe681d23665b8d7d97dd02d04d", 0x37, 0x7, 0x0, 0x1}]) 20:36:53 executing program 1: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr="93993974d566da0e3578d082d7ae73b9"}, 0x1c) [ 93.816374] binder: 4214:4216 BC_INCREFS_DONE node 13 has no pending increfs request [ 93.831688] binder: 4217:4221 BC_INCREFS_DONE node 14 has no pending increfs request [ 93.839277] binder: 4214:4216 got reply transaction with no transaction stack [ 93.839289] binder: 4214:4216 transaction failed 29201/-71, size -1729382256910270464-72057594037927935 line 3046 [ 93.848945] binder: undelivered TRANSACTION_ERROR: 29201 20:36:53 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x60, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="086310400000000000000000000000000000000012634840000000000000000000000000000000000000000000000000000000000000000000000000000000e8ffffffffffffff00000000000000000000000000000000000000000000000000b582ec3d4e9ad2e6aba63cdc431a846aad1c6e8032a8f29b4337826f1407820b7eb85196e55d6c9ed534c5051ca40fb9c3bc7fc3cb2e830000"], 0x0, 0x0, 0x0}) r2 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x4182) io_setup(0x1, &(0x7f00000003c0)=0x0) io_submit(r3, 0x2, &(0x7f00000005c0)=[&(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x70, r2, &(0x7f0000000400)="e7acb3f84a906021407dd8f5b129d36a33c3bf2c2477201406867f17d6ae4dc1a2c241787d750226d4a3ef2486589bb95f451dc9056d8298af40fe7ea0a2e7555117a113beb670c86f501be9bcadac4af60d7bf02ec9afc759038a4a1a29cb63f0e813eacee470d0332d95307cfe04764879cd0eac4b9c26470d552f3c23442cb555c81490f227bacf27e58a34880f8276784ec245d36616a877d8ad538f371e40ef97eaa33e13d4e9b30b15820efbfb6152756a92ac1f57fc131ea9c36d134ee71ee374c7a5ac0886acc5a82eb65e516a20dcd26bd77a89c896728bc6b2c619885525a632a09263dbe1ab51b9bb8daa37e398982ef3cde0f861faad3c328a", 0xff, 0x2, 0x0, 0x2}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x3, 0x3, 0xffffffffffffffff, &(0x7f0000000540)="34f682da24135d8ec6626f9d0b833f95cad17d28ff2361a86cfffe5183fac4aaeaa41c97ad3e49b80285fe681d23665b8d7d97dd02d04d", 0x37, 0x7, 0x0, 0x1}]) 20:36:53 executing program 5: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'ip_vti0\x00'}) 20:36:53 executing program 1: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr="93993974d566da0e3578d082d7ae73b9"}, 0x1c) 20:36:53 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x60, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="086310400000000000000000000000000000000012634840000000000000000000000000000000000000000000000000000000000000000000000000000000e8ffffffffffffff00000000000000000000000000000000000000000000000000b582ec3d4e9ad2e6aba63cdc431a846aad1c6e8032a8f29b4337826f1407820b7eb85196e55d6c9ed534c5051ca40fb9c3bc7fc3cb2e830000"], 0x0, 0x0, 0x0}) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x4182) io_setup(0x1, &(0x7f00000003c0)) [ 93.888107] binder: 4233:4235 BC_INCREFS_DONE node 16 has no pending increfs request [ 93.888729] binder: 4217:4221 got reply transaction with no transaction stack [ 93.888739] binder: 4217:4221 transaction failed 29201/-71, size -1729382256910270464-72057594037927935 line 3046 [ 93.891939] binder: undelivered TRANSACTION_ERROR: 29201 20:36:53 executing program 5: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'ip_vti0\x00'}) 20:36:53 executing program 0: getpgrp(0x0) ioctl$int_in(0xffffffffffffffff, 0x0, &(0x7f0000000040)=0xfffffffffffffffe) r0 = getpgrp(0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/hash_stats\x00', 0x0, 0x0) fgetxattr(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="747275737465642e747a75ffffff7f08"], &(0x7f0000000880)=""/4096, 0x1000) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000000040)=0xfffffffffffffffe) r2 = syz_open_procfs(r0, &(0x7f0000000080)='net/dev_snmp6\x00') openat$ptmx(0xffffffffffffff9c, 0x0, 0xf292970b90c98047, 0x0) dup3(0xffffffffffffffff, r2, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r4, 0x40045431, &(0x7f0000000280)) write$binfmt_aout(r4, &(0x7f0000000240)=ANY=[], 0x35b) ioctl$TCSETA(r4, 0x5406, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x100000009b4b62b}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r4) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x37, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0x3ff}, 0x4000, 0x0, 0x0, 0x5, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x8000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7, 0x7ff}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz1\x00', 0x1ff) r5 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) keyctl$reject(0x13, r5, 0x0, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) mmap$binder(&(0x7f0000ff2000/0x2000)=nil, 0x2000, 0x1, 0x11, r7, 0x9) add_key$keyring(0x0, &(0x7f0000000840)={'syz', 0x3}, 0x0, 0x0, r5) request_key(&(0x7f00000001c0)='trusted\x00', &(0x7f0000000200)={'syz', 0x1}, &(0x7f0000000300)='net/dev_snmp6\x00', 0xffffffffffffffff) keyctl$reject(0x13, 0x0, 0x0, 0x3, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r8, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) getsockopt$IP_VS_SO_GET_INFO(r3, 0x0, 0x481, &(0x7f0000000000), &(0x7f0000000140)=0xc) 20:36:53 executing program 1: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr="93993974d566da0e3578d082d7ae73b9"}, 0x1c) 20:36:53 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'ip_vti0\x00'}) 20:36:53 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x60, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="086310400000000000000000000000000000000012634840000000000000000000000000000000000000000000000000000000000000000000000000000000e8ffffffffffffff00000000000000000000000000000000000000000000000000b582ec3d4e9ad2e6aba63cdc431a846aad1c6e8032a8f29b4337826f1407820b7eb85196e55d6c9ed534c5051ca40fb9c3bc7fc3cb2e830000"], 0x0, 0x0, 0x0}) r2 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x4182) io_setup(0x1, &(0x7f00000003c0)=0x0) io_submit(r3, 0x2, &(0x7f00000005c0)=[&(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x70, r2, &(0x7f0000000400)="e7acb3f84a906021407dd8f5b129d36a33c3bf2c2477201406867f17d6ae4dc1a2c241787d750226d4a3ef2486589bb95f451dc9056d8298af40fe7ea0a2e7555117a113beb670c86f501be9bcadac4af60d7bf02ec9afc759038a4a1a29cb63f0e813eacee470d0332d95307cfe04764879cd0eac4b9c26470d552f3c23442cb555c81490f227bacf27e58a34880f8276784ec245d36616a877d8ad538f371e40ef97eaa33e13d4e9b30b15820efbfb6152756a92ac1f57fc131ea9c36d134ee71ee374c7a5ac0886acc5a82eb65e516a20dcd26bd77a89c896728bc6b2c619885525a632a09263dbe1ab51b9bb8daa37e398982ef3cde0f861faad3c328a", 0xff, 0x2, 0x0, 0x2}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x3, 0x3, 0xffffffffffffffff, &(0x7f0000000540)="34f682da24135d8ec6626f9d0b833f95cad17d28ff2361a86cfffe5183fac4aaeaa41c97ad3e49b80285fe681d23665b8d7d97dd02d04d", 0x37, 0x7, 0x0, 0x1}]) 20:36:53 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x60, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="086310400000000000000000000000000000000012634840000000000000000000000000000000000000000000000000000000000000000000000000000000e8ffffffffffffff00000000000000000000000000000000000000000000000000b582ec3d4e9ad2e6aba63cdc431a846aad1c6e8032a8f29b4337826f1407820b7eb85196e55d6c9ed534c5051ca40fb9c3bc7fc3cb2e830000"], 0x0, 0x0, 0x0}) r2 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x4182) io_setup(0x1, &(0x7f00000003c0)=0x0) io_submit(r3, 0x2, &(0x7f00000005c0)=[&(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x70, r2, &(0x7f0000000400)="e7acb3f84a906021407dd8f5b129d36a33c3bf2c2477201406867f17d6ae4dc1a2c241787d750226d4a3ef2486589bb95f451dc9056d8298af40fe7ea0a2e7555117a113beb670c86f501be9bcadac4af60d7bf02ec9afc759038a4a1a29cb63f0e813eacee470d0332d95307cfe04764879cd0eac4b9c26470d552f3c23442cb555c81490f227bacf27e58a34880f8276784ec245d36616a877d8ad538f371e40ef97eaa33e13d4e9b30b15820efbfb6152756a92ac1f57fc131ea9c36d134ee71ee374c7a5ac0886acc5a82eb65e516a20dcd26bd77a89c896728bc6b2c619885525a632a09263dbe1ab51b9bb8daa37e398982ef3cde0f861faad3c328a", 0xff, 0x2, 0x0, 0x2}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x3, 0x3, 0xffffffffffffffff, &(0x7f0000000540)="34f682da24135d8ec6626f9d0b833f95cad17d28ff2361a86cfffe5183fac4aaeaa41c97ad3e49b80285fe681d23665b8d7d97dd02d04d", 0x37, 0x7, 0x0, 0x1}]) [ 93.935863] binder: 4249:4250 BC_INCREFS_DONE node 18 has no pending increfs request [ 93.964912] binder: 4249:4250 got reply transaction with no transaction stack [ 93.967400] binder: 4233:4235 got reply transaction with no transaction stack 20:36:53 executing program 1: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr="93993974d566da0e3578d082d7ae73b9"}, 0x1c) 20:36:53 executing program 5: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'ip_vti0\x00'}) 20:36:53 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x60, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="086310400000000000000000000000000000000012634840000000000000000000000000000000000000000000000000000000000000000000000000000000e8ffffffffffffff00000000000000000000000000000000000000000000000000b582ec3d4e9ad2e6aba63cdc431a846aad1c6e8032a8f29b4337826f1407820b7eb85196e55d6c9ed534c5051ca40fb9c3bc7fc3cb2e830000"], 0x0, 0x0, 0x0}) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x4182) io_setup(0x1, &(0x7f00000003c0)) [ 93.967411] binder: 4233:4235 transaction failed 29201/-71, size -1729382256910270464-72057594037927935 line 3046 [ 93.970199] binder: undelivered TRANSACTION_ERROR: 29201 [ 94.021730] binder: 4249:4250 transaction failed 29201/-71, size -1729382256910270464-72057594037927935 line 3046 20:36:53 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr="93993974d566da0e3578d082d7ae73b9"}, 0x1c) 20:36:53 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x60, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="086310400000000000000000000000000000000012634840000000000000000000000000000000000000000000000000000000000000000000000000000000e8ffffffffffffff00000000000000000000000000000000000000000000000000b582ec3d4e9ad2e6aba63cdc431a846aad1c6e8032a8f29b4337826f1407820b7eb85196e55d6c9ed534c5051ca40fb9c3bc7fc3cb2e830000"], 0x0, 0x0, 0x0}) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x4182) io_setup(0x1, &(0x7f00000003c0)) [ 94.036749] binder: 4268:4272 BC_INCREFS_DONE node 21 has no pending increfs request [ 94.036760] binder: 4268:4272 got reply transaction with no transaction stack [ 94.036768] binder: 4268:4272 transaction failed 29201/-71, size -1729382256910270464-72057594037927935 line 3046 [ 94.046587] binder: undelivered TRANSACTION_ERROR: 29201 [ 94.093361] binder: 4278:4284 BC_INCREFS_DONE node 23 has no pending increfs request [ 94.093370] binder: 4278:4284 got reply transaction with no transaction stack [ 94.093379] binder: 4278:4284 transaction failed 29201/-71, size -1729382256910270464-72057594037927935 line 3046 [ 94.098226] binder: undelivered TRANSACTION_ERROR: 29201 [ 94.128551] binder: 4288:4290 BC_INCREFS_DONE node 25 has no pending increfs request [ 94.128560] binder: 4288:4290 got reply transaction with no transaction stack 20:36:53 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x60, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="086310400000000000000000000000000000000012634840000000000000000000000000000000000000000000000000000000000000000000000000000000e8ffffffffffffff00000000000000000000000000000000000000000000000000b582ec3d4e9ad2e6aba63cdc431a846aad1c6e8032a8f29b4337826f1407820b7eb85196e55d6c9ed534c5051ca40fb9c3bc7fc3cb2e830000"], 0x0, 0x0, 0x0}) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x4182) io_setup(0x1, &(0x7f00000003c0)) 20:36:53 executing program 1: r0 = socket$inet6(0xa, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr="93993974d566da0e3578d082d7ae73b9"}, 0x1c) 20:36:53 executing program 5: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'ip_vti0\x00'}) 20:36:53 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x60, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="086310400000000000000000000000000000000012634840000000000000000000000000000000000000000000000000000000000000000000000000000000e8ffffffffffffff00000000000000000000000000000000000000000000000000b582ec3d4e9ad2e6aba63cdc431a846aad1c6e8032a8f29b4337826f1407820b7eb85196e55d6c9ed534c5051ca40fb9c3bc7fc3cb2e830000"], 0x0, 0x0, 0x0}) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x4182) 20:36:53 executing program 0: getpgrp(0x0) ioctl$int_in(0xffffffffffffffff, 0x0, &(0x7f0000000040)=0xfffffffffffffffe) r0 = getpgrp(0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/hash_stats\x00', 0x0, 0x0) fgetxattr(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="747275737465642e747a75ffffff7f08"], &(0x7f0000000880)=""/4096, 0x1000) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000000040)=0xfffffffffffffffe) r2 = syz_open_procfs(r0, &(0x7f0000000080)='net/dev_snmp6\x00') openat$ptmx(0xffffffffffffff9c, 0x0, 0xf292970b90c98047, 0x0) dup3(0xffffffffffffffff, r2, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r4, 0x40045431, &(0x7f0000000280)) write$binfmt_aout(r4, &(0x7f0000000240)=ANY=[], 0x35b) ioctl$TCSETA(r4, 0x5406, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x100000009b4b62b}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r4) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x37, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0x3ff}, 0x4000, 0x0, 0x0, 0x5, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x8000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7, 0x7ff}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz1\x00', 0x1ff) r5 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) keyctl$reject(0x13, r5, 0x0, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) mmap$binder(&(0x7f0000ff2000/0x2000)=nil, 0x2000, 0x1, 0x11, r7, 0x9) add_key$keyring(0x0, &(0x7f0000000840)={'syz', 0x3}, 0x0, 0x0, r5) request_key(&(0x7f00000001c0)='trusted\x00', &(0x7f0000000200)={'syz', 0x1}, &(0x7f0000000300)='net/dev_snmp6\x00', 0xffffffffffffffff) keyctl$reject(0x13, 0x0, 0x0, 0x3, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r8, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) getsockopt$IP_VS_SO_GET_INFO(r3, 0x0, 0x481, &(0x7f0000000000), &(0x7f0000000140)=0xc) [ 94.128569] binder: 4288:4290 transaction failed 29201/-71, size -1729382256910270464-72057594037927935 line 3046 [ 94.140474] binder: undelivered TRANSACTION_ERROR: 29201 [ 94.241470] binder: undelivered TRANSACTION_ERROR: 29201 [ 94.266687] binder: 4295:4300 BC_INCREFS_DONE node 27 has no pending increfs request [ 94.273584] binder: 4298:4302 BC_INCREFS_DONE node 28 has no pending increfs request [ 94.273593] binder: 4298:4302 got reply transaction with no transaction stack [ 94.273601] binder: 4298:4302 transaction failed 29201/-71, size -1729382256910270464-72057594037927935 line 3046 [ 94.279883] binder: undelivered TRANSACTION_ERROR: 29201 [ 94.353522] binder: 4295:4300 got reply transaction with no transaction stack [ 94.360858] binder: 4295:4300 transaction failed 29201/-71, size -1729382256910270464-72057594037927935 line 3046 [ 94.400327] binder: undelivered TRANSACTION_ERROR: 29201 20:36:56 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x60, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="086310400000000000000000000000000000000012634840000000000000000000000000000000000000000000000000000000000000000000000000000000e8ffffffffffffff00000000000000000000000000000000000000000000000000b582ec3d4e9ad2e6aba63cdc431a846aad1c6e8032a8f29b4337826f1407820b7eb85196e55d6c9ed534c5051ca40fb9c3bc7fc3cb2e830000"], 0x0, 0x0, 0x0}) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x4182) io_setup(0x1, &(0x7f00000003c0)) 20:36:56 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x60, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="086310400000000000000000000000000000000012634840000000000000000000000000000000000000000000000000000000000000000000000000000000e8ffffffffffffff00000000000000000000000000000000000000000000000000b582ec3d4e9ad2e6aba63cdc431a846aad1c6e8032a8f29b4337826f1407820b7eb85196e55d6c9ed534c5051ca40fb9c3bc7fc3cb2e830000"], 0x0, 0x0, 0x0}) 20:36:56 executing program 1: r0 = socket$inet6(0xa, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr="93993974d566da0e3578d082d7ae73b9"}, 0x1c) 20:36:56 executing program 5: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'ip_vti0\x00'}) 20:36:56 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x60, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="086310400000000000000000000000000000000012634840000000000000000000000000000000000000000000000000000000000000000000000000000000e8ffffffffffffff00000000000000000000000000000000000000000000000000b582ec3d4e9ad2e6aba63cdc431a846aad1c6e8032a8f29b4337826f1407820b7eb85196e55d6c9ed534c5051ca40fb9c3bc7fc3cb2e830000"], 0x0, 0x0, 0x0}) r2 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x4182) io_submit(0x0, 0x2, &(0x7f00000005c0)=[&(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x70, r2, &(0x7f0000000400)="e7acb3f84a906021407dd8f5b129d36a33c3bf2c2477201406867f17d6ae4dc1a2c241787d750226d4a3ef2486589bb95f451dc9056d8298af40fe7ea0a2e7555117a113beb670c86f501be9bcadac4af60d7bf02ec9afc759038a4a1a29cb63f0e813eacee470d0332d95307cfe04764879cd0eac4b9c26470d552f3c23442cb555c81490f227bacf27e58a34880f8276784ec245d36616a877d8ad538f371e40ef97eaa33e13d4e9b30b15820efbfb6152756a92ac1f57fc131ea9c36d134ee71ee374c7a5ac0886acc5a82eb65e516a20dcd26bd77a89c896728bc6b2c619885525a632a09263dbe1ab51b9bb8daa37e398982ef3cde0f861faad3c328a", 0xff, 0x2, 0x0, 0x2}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x3, 0x3, 0xffffffffffffffff, &(0x7f0000000540)="34f682da24135d8ec6626f9d0b833f95cad17d28ff2361a86cfffe5183fac4aaeaa41c97ad3e49b80285fe681d23665b8d7d97dd02d04d", 0x37, 0x7, 0x0, 0x1}]) 20:36:56 executing program 0: getpgrp(0x0) ioctl$int_in(0xffffffffffffffff, 0x0, &(0x7f0000000040)=0xfffffffffffffffe) r0 = getpgrp(0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/hash_stats\x00', 0x0, 0x0) fgetxattr(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="747275737465642e747a75ffffff7f08"], &(0x7f0000000880)=""/4096, 0x1000) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000000040)=0xfffffffffffffffe) r2 = syz_open_procfs(r0, &(0x7f0000000080)='net/dev_snmp6\x00') openat$ptmx(0xffffffffffffff9c, 0x0, 0xf292970b90c98047, 0x0) dup3(0xffffffffffffffff, r2, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r4, 0x40045431, &(0x7f0000000280)) write$binfmt_aout(r4, &(0x7f0000000240)=ANY=[], 0x35b) ioctl$TCSETA(r4, 0x5406, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x100000009b4b62b}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r4) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x37, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0x3ff}, 0x4000, 0x0, 0x0, 0x5, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x8000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7, 0x7ff}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz1\x00', 0x1ff) r5 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) keyctl$reject(0x13, r5, 0x0, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) mmap$binder(&(0x7f0000ff2000/0x2000)=nil, 0x2000, 0x1, 0x11, r7, 0x9) add_key$keyring(0x0, &(0x7f0000000840)={'syz', 0x3}, 0x0, 0x0, r5) request_key(&(0x7f00000001c0)='trusted\x00', &(0x7f0000000200)={'syz', 0x1}, &(0x7f0000000300)='net/dev_snmp6\x00', 0xffffffffffffffff) keyctl$reject(0x13, 0x0, 0x0, 0x3, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r8, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) getsockopt$IP_VS_SO_GET_INFO(r3, 0x0, 0x481, &(0x7f0000000000), &(0x7f0000000140)=0xc) [ 97.289625] binder: 4547:4548 BC_INCREFS_DONE node 31 has no pending increfs request [ 97.298120] binder: 4547:4548 got reply transaction with no transaction stack [ 97.305463] binder: 4547:4548 transaction failed 29201/-71, size -1729382256910270464-72057594037927935 line 3046 [ 97.323013] binder: undelivered TRANSACTION_ERROR: 29201 20:36:56 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x60, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="086310400000000000000000000000000000000012634840000000000000000000000000000000000000000000000000000000000000000000000000000000e8ffffffffffffff00000000000000000000000000000000000000000000000000b582ec3d4e9ad2e6aba63cdc431a846aad1c6e8032a8f29b4337826f1407820b7eb85196e55d6c9ed534c5051ca40fb9c3bc7fc3cb2e830000"], 0x0, 0x0, 0x0}) r2 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x4182) io_submit(0x0, 0x2, &(0x7f00000005c0)=[&(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x70, r2, &(0x7f0000000400)="e7acb3f84a906021407dd8f5b129d36a33c3bf2c2477201406867f17d6ae4dc1a2c241787d750226d4a3ef2486589bb95f451dc9056d8298af40fe7ea0a2e7555117a113beb670c86f501be9bcadac4af60d7bf02ec9afc759038a4a1a29cb63f0e813eacee470d0332d95307cfe04764879cd0eac4b9c26470d552f3c23442cb555c81490f227bacf27e58a34880f8276784ec245d36616a877d8ad538f371e40ef97eaa33e13d4e9b30b15820efbfb6152756a92ac1f57fc131ea9c36d134ee71ee374c7a5ac0886acc5a82eb65e516a20dcd26bd77a89c896728bc6b2c619885525a632a09263dbe1ab51b9bb8daa37e398982ef3cde0f861faad3c328a", 0xff, 0x2, 0x0, 0x2}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x3, 0x3, 0xffffffffffffffff, &(0x7f0000000540)="34f682da24135d8ec6626f9d0b833f95cad17d28ff2361a86cfffe5183fac4aaeaa41c97ad3e49b80285fe681d23665b8d7d97dd02d04d", 0x37, 0x7, 0x0, 0x1}]) 20:36:56 executing program 5: socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'ip_vti0\x00'}) 20:36:56 executing program 1: r0 = socket$inet6(0xa, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr="93993974d566da0e3578d082d7ae73b9"}, 0x1c) [ 97.338117] binder: 4555:4556 BC_INCREFS_DONE node 33 has no pending increfs request [ 97.346076] binder: 4551:4561 BC_INCREFS_DONE node 34 has no pending increfs request [ 97.355377] binder: 4559:4562 BC_INCREFS_DONE node 35 has no pending increfs request [ 97.356253] binder: 4555:4556 got reply transaction with no transaction stack [ 97.356263] binder: 4555:4556 transaction failed 29201/-71, size -1729382256910270464-72057594037927935 line 3046 [ 97.359395] binder: undelivered TRANSACTION_ERROR: 29201 20:36:56 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 20:36:56 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x60, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="086310400000000000000000000000000000000012634840000000000000000000000000000000000000000000000000000000000000000000000000000000e8ffffffffffffff00000000000000000000000000000000000000000000000000b582ec3d4e9ad2e6aba63cdc431a846aad1c6e8032a8f29b4337826f1407820b7eb85196e55d6c9ed534c5051ca40fb9c3bc7fc3cb2e830000"], 0x0, 0x0, 0x0}) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x4182) 20:36:56 executing program 5: socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'ip_vti0\x00'}) [ 97.388491] binder: 4568:4569 BC_INCREFS_DONE node 37 has no pending increfs request [ 97.397282] binder: 4568:4569 got reply transaction with no transaction stack [ 97.406630] binder: 4551:4561 got reply transaction with no transaction stack 20:36:56 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)) 20:36:56 executing program 1: socket$inet6(0xa, 0x1, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr="93993974d566da0e3578d082d7ae73b9"}, 0x1c) [ 97.406642] binder: 4551:4561 transaction failed 29201/-71, size -1729382256910270464-72057594037927935 line 3046 20:36:56 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x60, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="086310400000000000000000000000000000000012634840000000000000000000000000000000000000000000000000000000000000000000000000000000e8ffffffffffffff00000000000000000000000000000000000000000000000000b582ec3d4e9ad2e6aba63cdc431a846aad1c6e8032a8f29b4337826f1407820b7eb85196e55d6c9ed534c5051ca40fb9c3bc7fc3cb2e830000"], 0x0, 0x0, 0x0}) 20:36:56 executing program 5: socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'ip_vti0\x00'}) 20:36:56 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) [ 97.407386] binder: undelivered TRANSACTION_ERROR: 29201 [ 97.422471] binder: 4559:4562 got reply transaction with no transaction stack [ 97.422482] binder: 4559:4562 transaction failed 29201/-71, size -1729382256910270464-72057594037927935 line 3046 20:36:56 executing program 0: getpgrp(0x0) ioctl$int_in(0xffffffffffffffff, 0x0, &(0x7f0000000040)=0xfffffffffffffffe) r0 = getpgrp(0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/hash_stats\x00', 0x0, 0x0) fgetxattr(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="747275737465642e747a75ffffff7f08"], &(0x7f0000000880)=""/4096, 0x1000) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000000040)=0xfffffffffffffffe) r2 = syz_open_procfs(r0, &(0x7f0000000080)='net/dev_snmp6\x00') openat$ptmx(0xffffffffffffff9c, 0x0, 0xf292970b90c98047, 0x0) dup3(0xffffffffffffffff, r2, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000280)) write$binfmt_aout(r3, &(0x7f0000000240)=ANY=[], 0x35b) ioctl$TCSETA(r3, 0x5406, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x100000009b4b62b}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x37, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0x3ff}, 0x4000, 0x0, 0x0, 0x5, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x8000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7, 0x7ff}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz1\x00', 0x1ff) r4 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) keyctl$reject(0x13, r4, 0x0, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) mmap$binder(&(0x7f0000ff2000/0x2000)=nil, 0x2000, 0x1, 0x11, r6, 0x9) add_key$keyring(0x0, &(0x7f0000000840)={'syz', 0x3}, 0x0, 0x0, r4) request_key(&(0x7f00000001c0)='trusted\x00', &(0x7f0000000200)={'syz', 0x1}, &(0x7f0000000300)='net/dev_snmp6\x00', 0xffffffffffffffff) keyctl$reject(0x13, 0x0, 0x0, 0x3, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) r7 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r7, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0x2, 0x13012, r7, 0x0) [ 97.430220] binder: undelivered TRANSACTION_ERROR: 29201 [ 97.467462] binder: 4584:4587 BC_INCREFS_DONE node 42 has no pending increfs request [ 97.467471] binder: 4584:4587 got reply transaction with no transaction stack [ 97.467480] binder: 4584:4587 transaction failed 29201/-71, size -1729382256910270464-72057594037927935 line 3046 [ 97.472909] binder: undelivered TRANSACTION_ERROR: 29201 [ 97.495212] binder: 4596:4597 BC_INCREFS_DONE node 45 has no pending increfs request 20:36:56 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x60, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="086310400000000000000000000000000000000012634840000000000000000000000000000000000000000000000000000000000000000000000000000000e8ffffffffffffff00000000000000000000000000000000000000000000000000b582ec3d4e9ad2e6aba63cdc431a846aad1c6e8032a8f29b4337826f1407820b7eb85196e55d6c9ed534c5051ca40fb9c3bc7fc3cb2e830000"], 0x0, 0x0, 0x0}) r2 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x4182) io_submit(0x0, 0x2, &(0x7f00000005c0)=[&(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x70, r2, &(0x7f0000000400)="e7acb3f84a906021407dd8f5b129d36a33c3bf2c2477201406867f17d6ae4dc1a2c241787d750226d4a3ef2486589bb95f451dc9056d8298af40fe7ea0a2e7555117a113beb670c86f501be9bcadac4af60d7bf02ec9afc759038a4a1a29cb63f0e813eacee470d0332d95307cfe04764879cd0eac4b9c26470d552f3c23442cb555c81490f227bacf27e58a34880f8276784ec245d36616a877d8ad538f371e40ef97eaa33e13d4e9b30b15820efbfb6152756a92ac1f57fc131ea9c36d134ee71ee374c7a5ac0886acc5a82eb65e516a20dcd26bd77a89c896728bc6b2c619885525a632a09263dbe1ab51b9bb8daa37e398982ef3cde0f861faad3c328a", 0xff, 0x2, 0x0, 0x2}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x3, 0x3, 0xffffffffffffffff, &(0x7f0000000540)="34f682da24135d8ec6626f9d0b833f95cad17d28ff2361a86cfffe5183fac4aaeaa41c97ad3e49b80285fe681d23665b8d7d97dd02d04d", 0x37, 0x7, 0x0, 0x1}]) 20:36:56 executing program 1: socket$inet6(0xa, 0x1, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr="93993974d566da0e3578d082d7ae73b9"}, 0x1c) 20:36:56 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 20:36:56 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) 20:36:56 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) [ 97.495221] binder: 4596:4597 got reply transaction with no transaction stack [ 97.495230] binder: 4596:4597 transaction failed 29201/-71, size -1729382256910270464-72057594037927935 line 3046 [ 97.495466] binder: undelivered TRANSACTION_ERROR: 29201 [ 97.595543] binder: 4568:4569 transaction failed 29201/-71, size -1729382256910270464-72057594037927935 line 3046 [ 97.609180] binder: undelivered TRANSACTION_ERROR: 29201 20:36:56 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)) 20:36:56 executing program 3: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 20:36:56 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) 20:36:56 executing program 1: socket$inet6(0xa, 0x1, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr="93993974d566da0e3578d082d7ae73b9"}, 0x1c) 20:36:56 executing program 3: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 20:36:56 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) [ 97.630170] binder: 4616:4619 BC_INCREFS_DONE node 49 has no pending increfs request [ 97.656632] binder: 4616:4619 got reply transaction with no transaction stack 20:36:56 executing program 0: getpgrp(0x0) ioctl$int_in(0xffffffffffffffff, 0x0, &(0x7f0000000040)=0xfffffffffffffffe) r0 = getpgrp(0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/hash_stats\x00', 0x0, 0x0) fgetxattr(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="747275737465642e747a75ffffff7f08"], &(0x7f0000000880)=""/4096, 0x1000) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000000040)=0xfffffffffffffffe) r2 = syz_open_procfs(r0, &(0x7f0000000080)='net/dev_snmp6\x00') openat$ptmx(0xffffffffffffff9c, 0x0, 0xf292970b90c98047, 0x0) dup3(0xffffffffffffffff, r2, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000280)) write$binfmt_aout(r3, &(0x7f0000000240)=ANY=[], 0x35b) ioctl$TCSETA(r3, 0x5406, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x100000009b4b62b}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x37, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0x3ff}, 0x4000, 0x0, 0x0, 0x5, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x8000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7, 0x7ff}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz1\x00', 0x1ff) r4 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) keyctl$reject(0x13, r4, 0x0, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) mmap$binder(&(0x7f0000ff2000/0x2000)=nil, 0x2000, 0x1, 0x11, r6, 0x9) add_key$keyring(0x0, &(0x7f0000000840)={'syz', 0x3}, 0x0, 0x0, r4) request_key(&(0x7f00000001c0)='trusted\x00', &(0x7f0000000200)={'syz', 0x1}, &(0x7f0000000300)='net/dev_snmp6\x00', 0xffffffffffffffff) keyctl$reject(0x13, 0x0, 0x0, 0x3, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) r7 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r7, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0x2, 0x13012, r7, 0x0) 20:36:56 executing program 5: 20:36:56 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x60, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="086310400000000000000000000000000000000012634840000000000000000000000000000000000000000000000000000000000000000000000000000000e8ffffffffffffff00000000000000000000000000000000000000000000000000b582ec3d4e9ad2e6aba63cdc431a846aad1c6e8032a8f29b4337826f1407820b7eb85196e55d6c9ed534c5051ca40fb9c3bc7fc3cb2e830000"], 0x0, 0x0, 0x0}) io_setup(0x1, &(0x7f00000003c0)=0x0) io_submit(r2, 0x2, &(0x7f00000005c0)=[&(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x70, 0xffffffffffffffff, &(0x7f0000000400)="e7acb3f84a906021407dd8f5b129d36a33c3bf2c2477201406867f17d6ae4dc1a2c241787d750226d4a3ef2486589bb95f451dc9056d8298af40fe7ea0a2e7555117a113beb670c86f501be9bcadac4af60d7bf02ec9afc759038a4a1a29cb63f0e813eacee470d0332d95307cfe04764879cd0eac4b9c26470d552f3c23442cb555c81490f227bacf27e58a34880f8276784ec245d36616a877d8ad538f371e40ef97eaa33e13d4e9b30b15820efbfb6152756a92ac1f57fc131ea9c36d134ee71ee374c7a5ac0886acc5a82eb65e516a20dcd26bd77a89c896728bc6b2c619885525a632a09263dbe1ab51b9bb8daa37e398982ef3cde0f861faad3c328a", 0xff, 0x2, 0x0, 0x2}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x3, 0x3, 0xffffffffffffffff, &(0x7f0000000540)="34f682da24135d8ec6626f9d0b833f95cad17d28ff2361a86cfffe5183fac4aaeaa41c97ad3e49b80285fe681d23665b8d7d97dd02d04d", 0x37, 0x7, 0x0, 0x1}]) 20:36:56 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) connect$inet6(r0, 0x0, 0x0) 20:36:56 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) 20:36:56 executing program 3: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 20:36:56 executing program 3: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) 20:36:56 executing program 5: 20:36:56 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) connect$inet6(r0, 0x0, 0x0) [ 97.685151] binder: 4616:4619 transaction failed 29201/-71, size -1729382256910270464-72057594037927935 line 3046 [ 97.712064] binder: undelivered TRANSACTION_ERROR: 29201 20:36:56 executing program 2: syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) 20:36:56 executing program 3: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) 20:36:56 executing program 5: [ 97.763491] binder: 4650:4656 BC_INCREFS_DONE node 54 has no pending increfs request [ 97.806899] binder: 4650:4656 got reply transaction with no transaction stack [ 97.827362] binder: 4650:4656 transaction failed 29201/-71, size -1729382256910270464-72057594037927935 line 3046 [ 97.840514] binder: undelivered TRANSACTION_ERROR: 29201 20:36:57 executing program 0: getpgrp(0x0) ioctl$int_in(0xffffffffffffffff, 0x0, &(0x7f0000000040)=0xfffffffffffffffe) r0 = getpgrp(0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/hash_stats\x00', 0x0, 0x0) fgetxattr(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="747275737465642e747a75ffffff7f08"], &(0x7f0000000880)=""/4096, 0x1000) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000000040)=0xfffffffffffffffe) r2 = syz_open_procfs(r0, &(0x7f0000000080)='net/dev_snmp6\x00') openat$ptmx(0xffffffffffffff9c, 0x0, 0xf292970b90c98047, 0x0) dup3(0xffffffffffffffff, r2, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000280)) write$binfmt_aout(r3, &(0x7f0000000240)=ANY=[], 0x35b) ioctl$TCSETA(r3, 0x5406, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x100000009b4b62b}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x37, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0x3ff}, 0x4000, 0x0, 0x0, 0x5, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x8000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7, 0x7ff}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz1\x00', 0x1ff) r4 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) keyctl$reject(0x13, r4, 0x0, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) mmap$binder(&(0x7f0000ff2000/0x2000)=nil, 0x2000, 0x1, 0x11, r6, 0x9) add_key$keyring(0x0, &(0x7f0000000840)={'syz', 0x3}, 0x0, 0x0, r4) request_key(&(0x7f00000001c0)='trusted\x00', &(0x7f0000000200)={'syz', 0x1}, &(0x7f0000000300)='net/dev_snmp6\x00', 0xffffffffffffffff) keyctl$reject(0x13, 0x0, 0x0, 0x3, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) r7 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r7, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0x2, 0x13012, r7, 0x0) 20:36:57 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) connect$inet6(r0, 0x0, 0x0) 20:36:57 executing program 2: syz_open_dev$binderN(0x0, 0x0, 0x0) 20:36:57 executing program 5: 20:36:57 executing program 3: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) 20:36:57 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x60, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="086310400000000000000000000000000000000012634840000000000000000000000000000000000000000000000000000000000000000000000000000000e8ffffffffffffff00000000000000000000000000000000000000000000000000b582ec3d4e9ad2e6aba63cdc431a846aad1c6e8032a8f29b4337826f1407820b7eb85196e55d6c9ed534c5051ca40fb9c3bc7fc3cb2e830000"], 0x0, 0x0, 0x0}) io_setup(0x1, &(0x7f00000003c0)=0x0) io_submit(r1, 0x2, &(0x7f00000005c0)=[&(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x70, 0xffffffffffffffff, &(0x7f0000000400)="e7acb3f84a906021407dd8f5b129d36a33c3bf2c2477201406867f17d6ae4dc1a2c241787d750226d4a3ef2486589bb95f451dc9056d8298af40fe7ea0a2e7555117a113beb670c86f501be9bcadac4af60d7bf02ec9afc759038a4a1a29cb63f0e813eacee470d0332d95307cfe04764879cd0eac4b9c26470d552f3c23442cb555c81490f227bacf27e58a34880f8276784ec245d36616a877d8ad538f371e40ef97eaa33e13d4e9b30b15820efbfb6152756a92ac1f57fc131ea9c36d134ee71ee374c7a5ac0886acc5a82eb65e516a20dcd26bd77a89c896728bc6b2c619885525a632a09263dbe1ab51b9bb8daa37e398982ef3cde0f861faad3c328a", 0xff, 0x2, 0x0, 0x2}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x3, 0x3, 0xffffffffffffffff, &(0x7f0000000540)="34f682da24135d8ec6626f9d0b833f95cad17d28ff2361a86cfffe5183fac4aaeaa41c97ad3e49b80285fe681d23665b8d7d97dd02d04d", 0x37, 0x7, 0x0, 0x1}]) 20:36:57 executing program 3: syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 20:36:57 executing program 1: 20:36:57 executing program 2: syz_open_dev$binderN(0x0, 0x0, 0x0) 20:36:57 executing program 5: 20:36:57 executing program 3: syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 20:36:57 executing program 1: getpgrp(0x0) ioctl$int_in(0xffffffffffffffff, 0x0, &(0x7f0000000040)=0xfffffffffffffffe) r0 = getpgrp(0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/hash_stats\x00', 0x0, 0x0) fgetxattr(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="747275737465642e747a75ffffff7f08"], &(0x7f0000000880)=""/4096, 0x1000) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000000040)=0xfffffffffffffffe) r2 = syz_open_procfs(r0, &(0x7f0000000080)='net/dev_snmp6\x00') openat$ptmx(0xffffffffffffff9c, 0x0, 0xf292970b90c98047, 0x0) dup3(0xffffffffffffffff, r2, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000280)) write$binfmt_aout(r3, &(0x7f0000000240)=ANY=[], 0x35b) ioctl$TCSETA(r3, 0x5406, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x100000009b4b62b}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x37, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0x3ff}, 0x4000, 0x0, 0x0, 0x5, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x8000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7, 0x7ff}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz1\x00', 0x1ff) r4 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) keyctl$reject(0x13, r4, 0x0, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) mmap$binder(&(0x7f0000ff2000/0x2000)=nil, 0x2000, 0x1, 0x11, r6, 0x9) add_key$keyring(0x0, &(0x7f0000000840)={'syz', 0x3}, 0x0, 0x0, r4) request_key(&(0x7f00000001c0)='trusted\x00', &(0x7f0000000200)={'syz', 0x1}, &(0x7f0000000300)='net/dev_snmp6\x00', 0xffffffffffffffff) keyctl$reject(0x13, 0x0, 0x0, 0x3, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) r7 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r7, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0x2, 0x13012, r7, 0x0)