0)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) prctl$PR_MCE_KILL(0x21, 0x1, 0x0) tkill(r2, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:29:12 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$inet6(0xa, 0x3, 0x3a) recvmsg$kcm(0xffffffffffffff9c, &(0x7f0000000340)={&(0x7f0000000180)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff}}, 0x80, &(0x7f0000000100)=[{&(0x7f0000000200)=""/233, 0xe9}, {&(0x7f0000000a00)=""/4096, 0x1000}], 0x2, &(0x7f0000000300)=""/63, 0x3f}, 0x40012000) socket$packet(0x11, 0x3, 0x300) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000002a40)='TIPCv2\x00') sendmsg$TIPC_NL_NODE_GET(r2, &(0x7f0000002b40)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x50701080}, 0xc, &(0x7f0000002b00)={&(0x7f0000002a80)={0x24, r3, 0x402, 0x70bd25, 0x25dfdbfc, {}, [@TIPC_NLA_SOCK={0x10, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2ff7}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x40080}, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000007c0)='memory.swap.current\x00', 0x0, 0x0) pipe(&(0x7f0000000800)) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000002ac0)={r1}) accept$packet(r4, 0x0, 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) sendmsg$IPVS_CMD_FLUSH(0xffffffffffffffff, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, 0x0, 0x0) r5 = accept(r0, &(0x7f0000000740)=@tipc=@name, &(0x7f0000002a00)=0xf6) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r5, 0x0, 0xfffffffffffffffd) setsockopt$inet6_int(r1, 0x29, 0x200000000c8, &(0x7f0000000000), 0x23) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd2, &(0x7f0000000040)={{0xa, 0x4e24, 0x6, @mcast2, 0x1}, {0xa, 0x4e20, 0xfffffffffffffffe, @mcast1, 0x2}, 0x0, [0x6, 0xb5, 0x3ff, 0x9, 0x1000, 0x1, 0x9, 0x7fff]}, 0x5c) close(r1) 04:29:12 executing program 5: r0 = socket$kcm(0xa, 0x20000000000003, 0x11) openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x404000, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffc) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r4, &(0x7f0000011fd2), 0xffffffee) read(r3, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(r0, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:29:12 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c12") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185502, &(0x7f0000000000)={0x81}) [ 484.154750] usb usb9: usbfs: process 21041 (syz-executor4) did not claim interface 0 before use 04:29:12 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c12") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185502, &(0x7f0000000000)={0x81}) 04:29:12 executing program 3: clone(0x200, 0x0, 0x0, 0x0, 0x0) mknod(&(0x7f0000f80000)='./file0\x00', 0x1042, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f00000002c0)=""/11, 0xb9) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000200)) syz_execute_func(&(0x7f00000002c0)="3666440f50f564ff0941c3c4e2c9975842c4c27d794e0066420fe2e33e0f1110c442019dccd3196f") clone(0x2000003102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f00000001c0)='./file1\x00', 0x0, 0x0) ioctl$EVIOCSFF(r0, 0x40304580, 0x0) open$dir(&(0x7f0000000300)='./file0\x00', 0x841, 0x0) [ 484.309208] usb usb9: usbfs: process 21049 (syz-executor4) did not claim interface 0 before use 04:29:12 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185502, &(0x7f0000000000)={0x81}) 04:29:12 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185502, &(0x7f0000000000)={0x81}) [ 484.481933] usb usb9: usbfs: process 21061 (syz-executor4) did not claim interface 0 before use [ 484.597729] usb usb9: usbfs: process 21067 (syz-executor4) did not claim interface 0 before use 04:29:12 executing program 0: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000000)={0x3, 0x1, &(0x7f00000001c0)=""/163, &(0x7f0000000280)=""/76, &(0x7f0000000400)=""/245, 0xd000}) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r0, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) gettid() ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:29:14 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) 04:29:14 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185502, &(0x7f0000000000)={0x81}) 04:29:14 executing program 5: openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x404000, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffc) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:29:14 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) accept$inet(r1, 0x0, &(0x7f0000000040)) 04:29:14 executing program 0: r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$VHOST_GET_VRING_BASE(r1, 0xc008af12, &(0x7f0000000000)) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r2, 0x40000000af01, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r2, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r3) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000180)={0x0, r3}) gettid() ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:29:14 executing program 3: socket$inet6_udp(0xa, 0x2, 0x0) r0 = socket$inet6(0xa, 0x6, 0x0) listen(r0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) socket$rxrpc(0x21, 0x2, 0x2) write(r2, &(0x7f0000000340), 0x41395527) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000340)) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 486.528149] usb usb9: usbfs: process 21089 (syz-executor4) did not claim interface 0 before use 04:29:14 executing program 0: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r0, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) ioctl$KVM_SET_DEBUGREGS(r1, 0x4080aea2, &(0x7f00000001c0)={[0x16001, 0x10000, 0x1, 0x100000], 0x400, 0x40, 0x100000001}) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$SNDRV_SEQ_IOCTL_PVERSION(r1, 0x80045300, &(0x7f0000000000)) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) gettid() ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:29:14 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a0") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185502, &(0x7f0000000000)={0x81}) [ 486.693115] usb usb9: usbfs: process 21112 (syz-executor4) did not claim interface 0 before use 04:29:14 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a0") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185502, &(0x7f0000000000)={0x81}) 04:29:15 executing program 0: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000000)=0x200000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r0, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) gettid() ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 486.968447] usb usb9: usbfs: process 21124 (syz-executor4) did not claim interface 0 before use 04:29:15 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a0") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185502, &(0x7f0000000000)={0x81}) [ 487.173242] usb usb9: usbfs: process 21137 (syz-executor4) did not claim interface 0 before use 04:29:15 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(0x0, 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185502, &(0x7f0000000000)={0x81}) [ 489.462135] net_ratelimit: 25 callbacks suppressed [ 489.462153] protocol 88fb is buggy, dev hsr_slave_0 [ 489.462165] protocol 88fb is buggy, dev hsr_slave_0 [ 489.462591] protocol 88fb is buggy, dev hsr_slave_1 [ 489.467723] protocol 88fb is buggy, dev hsr_slave_1 [ 489.487913] protocol 88fb is buggy, dev hsr_slave_0 [ 489.493713] protocol 88fb is buggy, dev hsr_slave_1 04:29:17 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) 04:29:17 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(0x0, 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185502, &(0x7f0000000000)={0x81}) 04:29:17 executing program 5: openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x404000, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffc) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:29:17 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r2 = gettid() ioctl$FIBMAP(r0, 0x1, &(0x7f0000000040)=0x800) timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:29:17 executing program 0: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_ima(&(0x7f00000000c0)='./file0\x00', &(0x7f00000001c0)='security.ima\x00', &(0x7f0000000200)=@md5={0x1, "b321a03313e0f8c046271690335abef7"}, 0x11, 0x2) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000000)=0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000140)=0x5) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r1, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r1, 0x40000000af01, 0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r1, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r2) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, &(0x7f0000000180)={0x0, r2}) gettid() ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000002c0)={r2, &(0x7f0000000240)="4e415385657266909276b5717ba49119052fb90426c3b7bf401d37d211fead4a5afb3963bcd2bf85b9a36bb1df5b23c7a1d99c3893c08207c007752f81d9892ab51779c4b0133364fe98bf05e70eb2e366dee22cd4cda7ed92a3832ccf59a60011cd17950a2eb85f4ffa77de589d61d4775e0f9512efe12c23756b"}, 0x10) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:29:17 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x131f64) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f00000003c0), 0x4) setsockopt$IP_VS_SO_SET_ZERO(r1, 0x0, 0x48f, 0x0, 0x0) 04:29:17 executing program 0: r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$sock_inet_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000500)={'vxcan1\x00', {0x2, 0x4e20, @empty}}) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x802800, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000580)='NET_DM\x00') sendmsg$NET_DM_CMD_START(r1, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x14, r2, 0x4, 0x70bd29, 0x25dfdbff, {}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x20000800) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) r4 = syz_open_dev$audion(&(0x7f00000001c0)='/dev/audio#\x00', 0x6, 0x200) setsockopt$bt_BT_RCVMTU(r4, 0x112, 0xd, &(0x7f0000000200)=0xb34, 0x2) ioctl$int_in(r0, 0x1, 0x0) r5 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) readlinkat(r4, &(0x7f0000000280)='./file0/file0\x00', &(0x7f00000002c0)=""/245, 0xf5) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) fsetxattr$trusted_overlay_redirect(r0, &(0x7f0000000000)='trusted.overlay.redirect\x00', &(0x7f00000000c0)='./file0\x00', 0x8, 0x1) close(r3) setsockopt$inet_dccp_buf(r1, 0x21, 0xcf, &(0x7f00000016c0)="b6ba5a9efc0fac39e7db6b73aa522130cc7e4f371e679c0dc25f0705f04f1c358743d83ea6ea659aa6cd5bc8f4255c730446d4f0d1dfdf1ceeb9cffc89cc524c4a9137eb1364594cd3e3ce4d66095adb5c0f172a3dc3e4bcb60fb23f177e28eb7498fe262a21af5c05e3c0", 0x6b) r6 = socket$packet(0x11, 0x100000003, 0x300) setsockopt$inet_sctp_SCTP_AUTOCLOSE(r4, 0x84, 0x4, &(0x7f0000000240), 0x4) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) r7 = syz_open_dev$video(&(0x7f0000000140)='/dev/video#\x00', 0x6287, 0x0) r8 = dup2(r7, r7) ioctl$VIDIOC_S_PARM(r8, 0xc0cc5616, &(0x7f0000000280)={0x2, @output}) ioctl$TIOCGPGRP(r6, 0x540f, &(0x7f0000001740)=0x0) ptrace$getregset(0x4204, r9, 0x203, &(0x7f0000000400)={&(0x7f0000001780)=""/103, 0x67}) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r5}) ioctl$TUNGETVNETHDRSZ(r0, 0x800454d7, &(0x7f0000000680)) 04:29:17 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(0x0, 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185502, &(0x7f0000000000)={0x81}) [ 489.702308] protocol 88fb is buggy, dev hsr_slave_0 [ 489.707920] protocol 88fb is buggy, dev hsr_slave_1 04:29:17 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x0, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185502, &(0x7f0000000000)={0x81}) [ 489.942141] protocol 88fb is buggy, dev hsr_slave_0 [ 489.947698] protocol 88fb is buggy, dev hsr_slave_1 04:29:18 executing program 3: syz_open_dev$sg(0x0, 0x0, 0x5) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = openat(0xffffffffffffffff, 0x0, 0x4000, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu\x00', 0x200002, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r0, 0x8250aea6, &(0x7f0000000540)=""/225) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000200)=0x42, 0x12) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000200)=ANY=[], 0x0) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) keyctl$join(0x1, &(0x7f0000000440)) r2 = syz_open_dev$audion(0x0, 0x20, 0x880) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000340)='./cgroup.cpu/syz1\x00', 0x1ff) r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) r4 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, r4) ioctl$DRM_IOCTL_GET_CAP(r2, 0xc010640c, &(0x7f0000000040)={0x0, 0x5}) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timerfd_settime(r1, 0x8, 0x0, &(0x7f0000000100)) ioctl$LOOP_CTL_ADD(r3, 0x4c80, r4) 04:29:18 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x0, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185502, &(0x7f0000000000)={0x81}) 04:29:18 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x0, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185502, &(0x7f0000000000)={0x81}) 04:29:20 executing program 3: 04:29:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x0) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185502, &(0x7f0000000000)={0x81}) 04:29:20 executing program 1: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r1, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(0xffffffffffffffff, r0) 04:29:20 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) writev(r0, &(0x7f0000000240)=[{&(0x7f0000000040)="f12d61197ffbdd82b9799fae3eea04badbf8b9fef39fe91291a99a8573172623e0e08fbcef692ac6731a493e1623e4cc8197a929c4d99d5617131db7bf30fcc43462b1527f25cdfb8abc13081a3e404267b3e1ad9cd8d81880692e01aa5358", 0x5f}, {&(0x7f0000000140)="e352bedfdbb5224d6445051157ba1aed7c0846e92fee6d3f82b6bb079dd91dc15c5dda46e6845e37435f7e183780b8462d39d552eb78ff1def673c27fb98cca4668c5ae66e6c9974fa26beda11cb8c0bcff759fc024444df4a0dcf4189047d812d630524023efbfb9534e2e1ea91f3f5d3d1ec5706bc7683af0581548d33f4b6a14d9b150d", 0x85}, {&(0x7f0000000200)}], 0x3) r2 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r2, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) fstatfs(r1, &(0x7f0000000280)=""/89) r3 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) socket$unix(0x1, 0x5, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r3, 0x15) syz_open_procfs(r3, &(0x7f0000000200)='sessionid\x00') ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:29:20 executing program 0: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r0, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r1) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) r3 = shmget(0x2, 0x3000, 0x10, &(0x7f0000ffa000/0x3000)=nil) lstat(&(0x7f0000000000)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@local, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@initdev}}, &(0x7f0000000400)=0xe8) fstat(r2, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = fcntl$getown(r1, 0x9) fcntl$getownex(r0, 0x10, &(0x7f00000004c0)={0x0, 0x0}) shmctl$IPC_SET(r3, 0x1, &(0x7f0000000500)={{0x7, r4, r5, r6, r7, 0x100, 0x6}, 0x0, 0x7, 0x8, 0x5, r8, r9, 0x400}) gettid() ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:29:20 executing program 5: openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x404000, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffc) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:29:20 executing program 3: 04:29:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x0) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185502, &(0x7f0000000000)={0x81}) 04:29:20 executing program 0: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r0, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r1) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000240)=ANY=[@ANYRES32=r0, @ANYRES16=r1, @ANYRES16=r2, @ANYRESOCT=r2, @ANYRES32=r2, @ANYPTR64, @ANYRESDEC=r1, @ANYRESOCT=r2]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) gettid() ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:29:20 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-aes-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) recvmmsg(r2, &(0x7f00000063c0)=[{{0x0, 0x0, &(0x7f0000000c40)=[{&(0x7f0000000980)=""/155, 0x9b}], 0x1}}], 0x162, 0x0, 0x0) 04:29:21 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x0) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185502, &(0x7f0000000000)={0x81}) 04:29:21 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0xc0185502, &(0x7f0000000000)={0x81}) 04:29:21 executing program 3: perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x859, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='status\x00') bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-512\x00'}, 0x58) r2 = accept4$alg(r0, 0x0, 0x0, 0x0) sendfile(r2, r1, 0x0, 0x78b5d00b) 04:29:21 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0xc0185502, &(0x7f0000000000)={0x81}) 04:29:21 executing program 1: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r1, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(0xffffffffffffffff, r0) 04:29:21 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0xc0185502, &(0x7f0000000000)={0x81}) 04:29:21 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x404000, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffc) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:29:21 executing program 3: perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x859, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='status\x00') bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-512\x00'}, 0x58) r2 = accept4$alg(r0, 0x0, 0x0, 0x0) sendfile(r2, r1, 0x0, 0x78b5d00b) 04:29:21 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x90000, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r3 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$void(r1, 0xc0045c79) r4 = gettid() dup(r2) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r3, 0xc08c5335, &(0x7f0000000140)={0x3, 0x5, 0x9, 'queue0\x00', 0x80}) timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:29:21 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185502, 0x0) 04:29:22 executing program 0: r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r1, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r1, 0x40000000af01, 0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r1, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r2) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000400)=ANY=[@ANYPTR, @ANYRES32=r0, @ANYPTR64, @ANYPTR64=&(0x7f00000000c0)=ANY=[@ANYRESOCT=r0, @ANYBLOB, @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYPTR, @ANYRES32=r3, @ANYPTR, @ANYPTR64]], @ANYRES32=r1, @ANYRESOCT=r1, @ANYPTR64=&(0x7f0000000340)=ANY=[@ANYRESOCT, @ANYRES16=r3, @ANYRES64=r2, @ANYRESHEX=r1, @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYRES16, @ANYRES64=r0, @ANYPTR64, @ANYRES32=r2, @ANYBLOB="99b8ed5ff278038fae21ddfc1ff78460c43f129f24ef5ceb0fe042aea8ea45c7a1b24932d67ec9f887f5a585b775834fa3d33993eb065367d0b3f64b287002e6355d99e643d497319188315da235b9d5f47272466c3c10875dcc24e0abd137d21047d4c91ac0a8b0ea942bfefa0f3019f6d6b8bd3b6bdd502424cd59076144db19b22c21939b9ab5e4d88061d98d3a44dc6033a63adff95e3ea5f17abccfed66402453cabdd91fe44d89ae036846f35dadde5ad392af4678455614e0c820e7865ce0dcce283d121fe6", @ANYRES64=r0, @ANYRESDEC=r0], @ANYPTR64, @ANYRES32=r1, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYRES32=0x0, @ANYPTR64, @ANYBLOB="2dcbe50666", @ANYRESDEC=r2, @ANYBLOB="757c7ab6b39fafe7e388", @ANYRES64=r3, @ANYRESOCT=r1, @ANYRESHEX=r1]]]) ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, &(0x7f0000000180)={0x0, r2}) gettid() ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:29:22 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) stat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) quotactl(0x4, &(0x7f0000000140)='./file0\x00', r2, &(0x7f0000000240)) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r3 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r3, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) write$sndseq(r1, &(0x7f0000000080)=[{0x1, 0x5, 0x2, 0x80, @tick, {0x5, 0xbf7b}, {0x4, 0xaa}, @quote={{0x1, 0x81}, 0x7fff, &(0x7f0000000040)={0x8000, 0x81, 0x200, 0x4, @time={0x0, 0x989680}, {0x0, 0x9}, {0x7ff, 0x1000000000}, @note={0x800, 0x4, 0x8, 0xe2db, 0x80000001}}}}], 0x30) 04:29:22 executing program 3: socket$inet6_udp(0xa, 0x2, 0x0) r0 = socket$inet6(0xa, 0x6, 0x0) eventfd(0x8) socket$inet_dccp(0x2, 0x6, 0x0) listen(r0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200), 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 04:29:22 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185502, 0x0) 04:29:22 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185502, 0x0) 04:29:22 executing program 0: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r0, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r1) fsetxattr$security_ima(r0, &(0x7f0000000000)='security.ima\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB="02a1ce67701bba905cbb0bac535cc0b7c2a37156495a41059e7808c54d48dd529ffd19e4a24768c27650546a6007d97e0512f4cb1ff8c218f3bd633e92e75dc1b6c214db86e132c5c3cabc36796c4fcb59a31161504de0c7ec861b553b23efd7b7534ef6c5c4bc6a0095ab229864282da00671d70b8689571d996225d26a26086bd95224cd00304da247ec870176835838ab6ee5e9d8a9669ebb22b28ef58ef5c89290523ed5c930a92b9e058188efd2ca5d3fe0d75fa1626ed84f5f00cb86177b4f89499945f1e648506b12442c9015d1e240c956ab0cb06045bda522371a740c8fab4f608ad3de9b76b6b38000000000"], 0x12, 0x2) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) gettid() ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:29:22 executing program 1: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r1, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(0xffffffffffffffff, r0) 04:29:22 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185502, &(0x7f0000000000)) 04:29:23 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x404000, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffc) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:29:23 executing program 0: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r0, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1000000, 0x10, r0, 0x0) gettid() ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:29:23 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185502, &(0x7f0000000000)) 04:29:23 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x100, 0x0) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:29:23 executing program 0: r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) fcntl$getown(r0, 0x9) r1 = getpid() sched_setaffinity(r1, 0x8, &(0x7f0000000140)=0x5) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000400)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r2, 0x40000000af01, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_NUM(r2, 0x4008af10, &(0x7f0000000000)={0x2, 0x7b}) preadv(r2, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r3) sync_file_range(r2, 0x1f, 0x1ff, 0x5) ioctl$RTC_ALM_SET(r3, 0x40247007, &(0x7f00000000c0)={0x2b, 0x23, 0xe, 0x1, 0xa, 0x81, 0x2, 0x4b}) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r3}) gettid() ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$EVIOCGMASK(r3, 0x80104592, &(0x7f0000000300)={0x14, 0xb7, &(0x7f0000000240)="5cd249a7c5df9289a0a81c0df847351804e127136b8099b878e1e9e17a1fbc2d02a8467ff6e6e0844cd49f8d15c6abecda7de8a4768d54c0a63640f3ac3782865b7fb634efd7d2532f45cc0fa4effc7ee358b89ff4f76098dce090b65743b9f86f633ff220ef58a80820ad83a4bac35584d4c7df588391d2759fed310dd1181b13fa6d0f261ed80f81303c72f991af9c839087b630897dc9f9106a5c3423d250aa01c5074ed0e040dd44a4c158b71ddb8f9905ab2ee180"}) setsockopt$IP_VS_SO_SET_DELDEST(r3, 0x0, 0x488, &(0x7f00000001c0)={{0x87, @rand_addr=0x200, 0x4e23, 0x1, 'nq\x00', 0x2d, 0x0, 0x5b}, {@loopback, 0x4e24, 0x2001, 0xfffffffffffffff8, 0x100, 0x3}}, 0x44) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:29:23 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0xc0185502, &(0x7f0000000000)) 04:29:23 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='proc\x00', 0x0, 0x0) r1 = open(&(0x7f0000032ff8)='./file0\x00', 0x0, 0x0) faccessat(r1, &(0x7f0000000000)='./bus\x00', 0x3, 0x0) 04:29:23 executing program 0: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r0, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r1) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) gettid() ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:29:23 executing program 4: 04:29:23 executing program 3: 04:29:23 executing program 1: pipe2(0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r1, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(0xffffffffffffffff, r0) 04:29:23 executing program 0: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r0, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) openat$vimc2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/video2\x00', 0x2, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) gettid() ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) write$FUSE_DIRENT(r1, &(0x7f0000000000)={0x38, 0xfffffffffffffff5, 0x7, [{0x2, 0x1, 0xf, 0xfff, '/dev/vhost-net\x00'}]}, 0x38) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 495.702250] net_ratelimit: 26 callbacks suppressed [ 495.702265] protocol 88fb is buggy, dev hsr_slave_0 [ 495.703065] protocol 88fb is buggy, dev hsr_slave_1 [ 495.707732] protocol 88fb is buggy, dev hsr_slave_1 [ 495.713379] protocol 88fb is buggy, dev hsr_slave_0 [ 495.729604] protocol 88fb is buggy, dev hsr_slave_1 04:29:23 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffc) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:29:23 executing program 4: 04:29:23 executing program 3: 04:29:23 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r2, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r3 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) ioctl$CAPI_SET_FLAGS(r1, 0x80044324, &(0x7f0000000040)=0x1) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r2, 0x6, 0x15, &(0x7f0000000080)=0x80000000, 0x4) tkill(r3, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:29:24 executing program 4: [ 495.948781] protocol 88fb is buggy, dev hsr_slave_0 [ 495.954234] protocol 88fb is buggy, dev hsr_slave_1 04:29:24 executing program 3: 04:29:24 executing program 0: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x5, &(0x7f0000000000)=0x1) r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000200)='/dev/cachefiles\x00', 0x480000, 0x0) pipe2$9p(&(0x7f0000000340), 0x0) r1 = open(&(0x7f0000000240)='./file0\x00', 0x80, 0x180) sendmsg$key(r1, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$DRM_IOCTL_AUTH_MAGIC(r0, 0x40046411, &(0x7f0000000280)=0x8000) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000080)=0x200000000) ptrace$setopts(0xffffffffffffffff, 0x0, 0x6, 0x41) mmap$perf(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000000, 0x850, r1, 0x5a) ioctl$int_in(r2, 0x40000000af01, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r3, 0x29, 0x45, &(0x7f00000002c0)={'icmp6\x00'}, &(0x7f0000000300)=0x1e) preadv(r2, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r3) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x6) socket$packet(0x11, 0x800000007, 0x300) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000180)={0xffffffffffffffff, r3}) ioctl$DRM_IOCTL_AGP_ALLOC(r3, 0xc0206434, &(0x7f00000000c0)={0x1280000000000, 0x0, 0x10000, 0x1}) ioctl$DRM_IOCTL_AGP_UNBIND(r3, 0x40106437, &(0x7f00000001c0)={r4, 0x9}) gettid() ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r3, 0x5501, 0x0) 04:29:24 executing program 3: [ 496.182141] protocol 88fb is buggy, dev hsr_slave_0 [ 496.187650] protocol 88fb is buggy, dev hsr_slave_1 [ 496.193401] protocol 88fb is buggy, dev hsr_slave_0 04:29:24 executing program 4: 04:29:24 executing program 3: 04:29:24 executing program 1: pipe2(0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r1, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(0xffffffffffffffff, r0) 04:29:24 executing program 4: 04:29:24 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffc) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:29:24 executing program 3: 04:29:24 executing program 4: 04:29:24 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r2 = gettid() ioctl$sock_inet_SIOCGIFBRDADDR(r1, 0x8919, &(0x7f0000000040)={'bpq0\x00', {0x2, 0x4e23, @multicast1}}) timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)=0x0) timer_settime(r3, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:29:25 executing program 3: 04:29:25 executing program 4: 04:29:25 executing program 0: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xffffffffffffffff, 0x0) r2 = fcntl$getown(r0, 0x9) write$P9_RGETLOCK(r1, &(0x7f00000000c0)={0x29, 0x37, 0x2, {0x0, 0xfff, 0x81, r2, 0xb, '/dev/audio\x00'}}, 0x29) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r0, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r3) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r3}) gettid() ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f00000001c0)={0x3, r3}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vga_arbiter\x00', 0x20007c, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:29:25 executing program 3: 04:29:25 executing program 3: 04:29:25 executing program 4: 04:29:25 executing program 1: pipe2(0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r1, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(0xffffffffffffffff, r0) 04:29:25 executing program 0: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r0, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) gettid() ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:29:25 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(0x0, 0xfffffffffffffffc) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:29:25 executing program 0: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r0, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) r2 = request_key(&(0x7f0000000000)='.request_key_auth\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f00000001c0)='{[@\x00', 0xfffffffffffffff9) r3 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f0000000240)={'syz', 0x3}, &(0x7f0000000280)="20ca4997d377f1f79d80184e491b2b2669a5376f5cfe061408302feb82f5074980e1e41325ac035e3de86394343e2727ad80761d0c7d662df67536c65b42d72414dc421d680c41f0277b9010bb1e82d376caf39147b4dad922bb8d88f64c592ae4d79008e4e296475e9edd885af2e7a9821632ffa722c781b023afc559800be262f379a460a2e0b0d21b486f7830dbf4f936df6df2e69a9f463e6ca3c15b352e5862bdecd7cd9ddd5edab003c9ec4c155b0218f82bbf90f64d8bca8891d57c5c9890c3f7075036a330a37c9d", 0xcc, 0xffffffffffffffff) r4 = add_key$user(&(0x7f0000000380)='user\x00', &(0x7f0000000400)={'syz', 0x0}, &(0x7f0000000440)="5af672733eb8f09a2231d5a9c57b0f87723b1d7d2b01", 0x16, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f0000000480)={r2, r3, r4}, &(0x7f00000004c0)=""/170, 0xaa, &(0x7f0000000680)={&(0x7f0000000580)={'sha256-generic\x00'}, &(0x7f00000005c0)="0c8ea95143de6904ca734fdd27ce44bde2fd738d8393d5a957ac119acd59e56b880d3fd74669bf526c77b849ae60a218225769c86c0ea7bb29603f2aacf723e2b1f819a41861853f1c3f874f2e767ec35e3e736978728d7fc73cf3040740b1e004352f4aeffbc6bed2275cf80f0d8aec0e0a5e47f3f0651817596955c35fafd11b245311433cebd332ff9bbe7af2697a82653dc15b6fbf0f6ed7d6607db3bf2bddc172", 0xa3}) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) gettid() ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:29:25 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) setsockopt$TIPC_GROUP_LEAVE(r1, 0x10f, 0x88) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:29:25 executing program 4: 04:29:25 executing program 3: 04:29:25 executing program 4: 04:29:26 executing program 3: 04:29:26 executing program 0: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r0, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r1) r2 = socket$packet(0x11, 0xffff, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) gettid() fsetxattr$security_evm(r2, &(0x7f0000000000)='security.evm\x00', &(0x7f00000000c0)=@sha1={0x1, "356aee8249c8065e01cc902cb45730c047639844"}, 0x15, 0x1) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:29:26 executing program 3: 04:29:26 executing program 4: 04:29:26 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) 04:29:26 executing program 3: 04:29:26 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(0x0, 0xfffffffffffffffc) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:29:26 executing program 4: 04:29:26 executing program 0: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_CAPBSET_DROP(0x18, 0x14) sendmsg$key(0xffffffffffffffff, 0x0, 0xfffffffffffffffc) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r0, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) fstat(r1, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x4, &(0x7f00000000c0)=[0xee00, 0xee01, 0xee00, 0xffffffffffffffff]) chown(&(0x7f0000000000)='./file0\x00', r2, r3) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) gettid() ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) mount(&(0x7f0000000240)=@sg0='/dev/sg0\x00', &(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)='ext3\x00', 0x40400, &(0x7f0000000300)='/dev/vhost-net\x00') ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:29:26 executing program 3: 04:29:26 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) 04:29:26 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r2 = gettid() r3 = add_key(&(0x7f0000000040)='syzkaller\x00', &(0x7f0000000080)={'syz', 0x2}, &(0x7f0000000140)="e6ce45d5237c14facfed45d40f0160f94c8f6fd4ea06eb83ee9709ed0dd066f59fcf6e4915d095da66a37c5c1cd275201bb1e6714f0970705d760425f7743f60b6c58f7f921d7b4ad57814a72f2ceb1b17d9f70f285de17b7f581fc239b2e0d393c92125c018c3aff9ff68aafdd716eb82ee3f55dead28bb67a383c8986deb86214b32", 0x83, 0xfffffffffffffffd) r4 = request_key(&(0x7f0000000200)='cifs.idmap\x00', &(0x7f0000000240)={'syz', 0x0}, &(0x7f0000000280)='/dev/cec#\x00', 0xfffffffffffffffc) r5 = request_key(&(0x7f00000002c0)='ceph\x00', &(0x7f0000000300)={'syz', 0x3}, &(0x7f0000000340)='em1\x00', 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000380)={r3, r4, r5}, &(0x7f0000000480)=""/207, 0xcf, 0x0) timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:29:26 executing program 3: 04:29:26 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) 04:29:26 executing program 4: 04:29:26 executing program 0: r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x7ffff, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) socket$bt_hidp(0x1f, 0x3, 0x6) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0xfff, 0x0) r1 = syz_open_dev$mice(&(0x7f00000000c0)='/dev/input/mice\x00', 0x0, 0x400000) ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, &(0x7f0000000240)={0x2, r1}) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r2, 0x40000000af01, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r2, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r0) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000180)={0x0, r3}) gettid() ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:29:27 executing program 3: 04:29:27 executing program 4: 04:29:27 executing program 4: 04:29:27 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(0x0, 0xfffffffffffffffc) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:29:27 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x10, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) 04:29:27 executing program 3: 04:29:27 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = accept(r0, &(0x7f00000001c0)=@tipc=@name, &(0x7f0000000240)=0x80) ioctl$IMCTRLREQ(r1, 0x80044945, &(0x7f0000000280)={0x4009, 0x8, 0x800, 0x8}) r2 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r2, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r3 = gettid() getsockopt$bt_BT_RCVMTU(r2, 0x112, 0xd, &(0x7f0000000140)=0x254a, &(0x7f0000000180)=0x2) timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) ioctl$KVM_GET_PIT2(r2, 0x8070ae9f, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r3, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x4001fd) 04:29:27 executing program 0: 04:29:27 executing program 3: 04:29:27 executing program 4: 04:29:28 executing program 0: 04:29:28 executing program 3: 04:29:28 executing program 4: 04:29:28 executing program 0: 04:29:28 executing program 4: 04:29:28 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) [ 501.942139] net_ratelimit: 25 callbacks suppressed [ 501.942157] protocol 88fb is buggy, dev hsr_slave_0 [ 501.942213] protocol 88fb is buggy, dev hsr_slave_0 [ 501.949576] protocol 88fb is buggy, dev hsr_slave_1 [ 501.952674] protocol 88fb is buggy, dev hsr_slave_1 [ 501.959880] protocol 88fb is buggy, dev hsr_slave_0 [ 501.973016] protocol 88fb is buggy, dev hsr_slave_1 [ 502.182237] protocol 88fb is buggy, dev hsr_slave_0 [ 502.187572] protocol 88fb is buggy, dev hsr_slave_1 [ 502.422215] protocol 88fb is buggy, dev hsr_slave_0 [ 502.427520] protocol 88fb is buggy, dev hsr_slave_1 04:29:30 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x10, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) 04:29:30 executing program 3: 04:29:30 executing program 0: 04:29:30 executing program 4: 04:29:30 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f00000001c0)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) ioctl$TIOCGPTPEER(r1, 0x5441, 0x7) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) sched_getparam(r2, &(0x7f0000000040)) ioctl$DRM_IOCTL_GEM_FLINK(r1, 0xc008640a, &(0x7f0000000080)={0x0}) ioctl$DRM_IOCTL_GEM_FLINK(r1, 0xc008640a, &(0x7f0000000140)={r3}) 04:29:30 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:29:30 executing program 0: 04:29:30 executing program 3: 04:29:30 executing program 4: 04:29:31 executing program 0: 04:29:31 executing program 4: 04:29:31 executing program 3: 04:29:33 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x10, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) 04:29:33 executing program 0: 04:29:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:29:33 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f023c123f3188a070") socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='/\x02roup.stap\x00', 0x2761, 0x0) r1 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000040), 0x2, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x7fffffff) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) 04:29:33 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0x2, 0x2) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) fallocate(r1, 0x0, 0xfffffffffffffffd, 0xff77) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:29:33 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) [ 505.940668] binder: 21631 RLIMIT_NICE not set [ 505.955065] binder: 21629:21631 tried to acquire reference to desc 0, got 1 instead 04:29:34 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) dup2(r0, r1) clone(0x3102001ff2, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) futex(&(0x7f0000000340)=0x1, 0x0, 0x1, 0x0, 0x0, 0x0) [ 505.993054] binder: 21629:21638 unknown command 536872576 [ 505.993658] binder: 21643 RLIMIT_NICE not set [ 505.998723] binder: 21629:21638 ioctl c0306201 20008fd0 returned -22 04:29:34 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semget(0xffffffffffffffff, 0x0, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f00000001c0)={{0x0, 0x2, 0x0, 0x0, 'syz0\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz1\x00', 0x0, 0x0, [], [0x1]}) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x1, 0x2) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, 0x0, 0xffffffffffffff82) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000000040)=0x80000002) process_vm_writev(0x0, 0x0, 0x0, &(0x7f0000000000), 0x0, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x100000000000000}, 0xfffffefd) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0x0) [ 506.042469] binder: 21629:21645 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:29:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:29:34 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000140), 0x1000000f5) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000100)) [ 506.310058] binder: 21663 RLIMIT_NICE not set 04:29:34 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6100) ftruncate(r1, 0x208200) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8000fffffffe) syz_open_procfs(0x0, 0x0) 04:29:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) [ 506.525010] binder: 21674 RLIMIT_NICE not set [ 508.182177] net_ratelimit: 26 callbacks suppressed [ 508.182200] protocol 88fb is buggy, dev hsr_slave_0 [ 508.182570] protocol 88fb is buggy, dev hsr_slave_1 [ 508.187849] protocol 88fb is buggy, dev hsr_slave_1 [ 508.202821] protocol 88fb is buggy, dev hsr_slave_0 [ 508.209287] protocol 88fb is buggy, dev hsr_slave_1 [ 508.421869] protocol 88fb is buggy, dev hsr_slave_0 [ 508.427153] protocol 88fb is buggy, dev hsr_slave_1 [ 508.662080] protocol 88fb is buggy, dev hsr_slave_0 [ 508.667390] protocol 88fb is buggy, dev hsr_slave_1 [ 508.672983] protocol 88fb is buggy, dev hsr_slave_0 04:29:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:29:37 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) 04:29:37 executing program 0: clone(0x200, 0x0, 0x0, 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x1042, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file1\x00', 0x0, 0x0) pause() mknod$loop(&(0x7f0000000140)='./file1\x00', 0x10c, 0xffffffffffffffff) open$dir(&(0x7f0000000240)='./file0\x00', 0x841, 0x0) 04:29:37 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:29:37 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f0000000040)={{r2, r3+10000000}, {0x0, 0x9}}, 0x0) tkill(r1, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:29:37 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6100) ftruncate(r1, 0x208200) r2 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x11, r2, 0x0) r3 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(r1, r3, 0x0, 0x8000fffffffe) [ 509.059630] binder: 21682 RLIMIT_NICE not set 04:29:37 executing program 3: r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r0) socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$cgroup(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000903000)={0x9, 0x3, &(0x7f0000519fa8)=ANY=[@ANYBLOB="180000000000000000000000000000006500000000000000"], 0x0, 0x8000, 0x1000, &(0x7f000062b000)=""/4096}, 0x48) 04:29:37 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) 04:29:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) [ 509.274995] binder: 21712 RLIMIT_NICE not set 04:29:37 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes-aesni)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f0000001380)={0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000300)=ANY=[], 0xffffffaa) recvmmsg(r1, &(0x7f0000004740)=[{{0x0, 0x0, &(0x7f0000000e00)=[{&(0x7f0000000840)=""/82, 0x52}, {&(0x7f00000008c0)=""/115, 0x73}], 0x2}}], 0x1, 0x0, 0x0) 04:29:37 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) 04:29:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) [ 509.533901] binder: 21725:21726 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:29:37 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) 04:29:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) [ 509.707604] binder: 21735:21736 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:29:37 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f023c123f3188a070") bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x8, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000000000000000000000950000000000000092e33bf40e10a6458b9b48e4d1709798ec612314aa8910e330d321fcc17e65fb3e1b3898f7e756668a"], 0x0, 0x1}, 0x48) socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'rmd160\x00'}, 0xffffffffffffffef) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='/\x02roup.stap\x00', 0x2761, 0x0) r1 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000040), 0x2, 0x0) write$cgroup_int(r1, &(0x7f00000002c0), 0x12) sendfile(r1, r1, &(0x7f0000002580), 0x7fffffff) sendfile(r1, r1, &(0x7f0000000240), 0x8000) pipe(&(0x7f0000000140)) 04:29:38 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:29:40 executing program 0: clone(0x200, 0x0, 0x0, 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x1042, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file1\x00', 0x0, 0x0) pause() mknod$loop(&(0x7f0000000140)='./file1\x00', 0x10c, 0xffffffffffffffff) open$dir(&(0x7f0000000240)='./file0\x00', 0x841, 0x0) 04:29:40 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x31) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:29:40 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) 04:29:40 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:29:40 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:29:40 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2000000032002908000045f400000000040000000c00130008000900b154d1d3a6bf7ef59c6fba4a44cbeaeaf9f4bd53e3c2164ea2fcb82b102c3c81eca486750be9e86afbf5bbac7578782dcc53e5eafecb40f24b33073ba25b7790e36e68602873226cd04484bb8e8d1ccfb5912ead0dd51a70090bea1d4f24cc34da84ca433a5695c1e886c43130a8c5f66fdf8671784d82ed1a277fe99753af5a8cfd2ecf7cc13ffd8b569fa90658e3ee3b986d81e5eaa9f43bcf04c7f989511ed07c255acb711ef9a4c3022343cb943464dd89d6157ba33da03ac0b0622d0d87bdfa4f79efea06704419dfa5a5fb0ff905332711c67d0c98", @ANYRES32=0x0], 0x2}}, 0x0) [ 512.100877] binder: 21769:21771 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:29:40 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f023c123f3188a070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x2, &(0x7f0000000140)=0x101, 0x4) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @local}}, 0x1c) listen(r1, 0x0) 04:29:40 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:29:40 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) 04:29:40 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0, 0x2}) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r3 = semget$private(0x0, 0x3, 0x0) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) semtimedop(r3, &(0x7f0000000080), 0x0, &(0x7f0000000180)={r4, r5+30000000}) tkill(r2, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x8000) [ 512.323626] binder: 21792 RLIMIT_NICE not set 04:29:40 executing program 3: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000100)='/dev/uhid\x00', 0x802, 0x0) ptrace$getregset(0x4204, 0x0, 0x0, 0x0) write$UHID_CREATE(r0, &(0x7f0000000340)={0x0, 'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xec\xff\xff\xff\xff\xff\xff\xff\x00', 'syz1\x00', 'syz0\x00', &(0x7f0000000480)=""/195, 0x1d4}, 0xfffffde3) perf_event_open(&(0x7f0000000180)={0x0, 0xfffffc55, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000000040)={{0xa, 0x0, 0x0, @ipv4}, {0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}}, 0x5c) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000040), 0x21c}], 0x8) [ 512.370081] binder: 21790:21796 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:29:40 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$kcm(0x10, 0x2, 0x0) recvmsg$kcm(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)=""/168, 0xffffff84}, {&(0x7f00000001c0)=""/56, 0x38}], 0x2, &(0x7f0000002c80)=""/72, 0xffffffffffffff71}, 0x0) sendmsg$kcm(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e000000120081aee4050cecdb4cb90425485e510befccd77f3e9cf0758ef9000600b0eba06ac400040003000000", 0x2e}], 0x1}, 0x0) recvmsg$kcm(r1, &(0x7f0000000b80)={0x0, 0x0, 0x0}, 0x0) recvmsg$kcm(r1, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) 04:29:40 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) [ 512.524823] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.531884] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.538709] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.545571] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.552425] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.559235] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.566187] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.573032] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.579835] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.586712] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.593577] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.600382] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.607252] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.614099] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.620899] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.627778] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 512.627819] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.627919] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.634794] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 512.641319] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.648076] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 512.654727] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.661435] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 512.668116] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.674905] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 512.681485] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.688201] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 512.694875] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.694975] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.701718] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 512.708354] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.715062] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 512.721733] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.728416] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 512.735157] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.741892] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 512.748532] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.755262] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 512.761924] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.768614] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 512.775298] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.782036] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 512.788683] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.795428] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 512.802604] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.809297] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 512.815983] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.822819] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 512.829377] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.836108] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 512.842813] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.849479] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 512.856158] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.862902] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 512.869548] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.876287] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 512.882954] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.889668] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 512.896360] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.903102] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 512.909745] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.916492] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 512.923148] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.929854] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 512.936532] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.943270] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 512.949921] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.956776] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 512.963332] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.970031] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 512.976724] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.983477] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 512.990107] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 512.996919] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.003548] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.010259] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.016944] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.023763] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.030338] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.037072] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.043743] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.050429] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.057110] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.083940] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.087420] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.090733] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.097461] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.104147] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.110846] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.117525] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.124242] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.130890] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.137576] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.144302] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.150985] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.157664] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.164390] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.171043] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.177768] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.184432] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.191127] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.197812] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.204542] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.211538] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.218253] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.224928] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.231663] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.238304] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.244984] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.251661] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.258345] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.265001] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.271739] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.278377] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.285095] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.291780] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.298474] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.305169] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.311890] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.318546] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.325268] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.331949] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.338635] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.345318] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.352033] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.358691] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.365406] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.372088] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.378790] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.385456] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.392169] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.398827] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.405557] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.412247] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.418929] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.425603] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.432357] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.439006] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.445732] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.452395] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.459086] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.465769] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.472490] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.479139] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.485872] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.492550] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.499237] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.505916] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.512637] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.519294] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.526015] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.532704] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.539396] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.546073] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.552810] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.559457] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.566200] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.572886] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.579591] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.586274] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.592998] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.599644] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.606361] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.613053] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.619759] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.626422] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.633144] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.640129] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.646876] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.653540] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.660227] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.666914] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.673826] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.680473] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.687196] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.693882] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.700583] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.707260] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.713975] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.720629] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.727362] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.734037] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.740751] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.747415] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.754140] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.760792] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.767520] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.774207] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.780909] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.787584] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.794311] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.801388] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.808136] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.814822] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.821530] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.828210] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.834934] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.841600] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.848313] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.854953] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.861691] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.868343] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.875013] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.881782] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.888472] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.895141] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.901871] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.908542] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.915270] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.921947] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.928637] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.935319] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.942027] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.948672] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.955402] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.962078] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.968782] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.975449] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.982165] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 513.988814] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 513.995717] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.002384] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.009078] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.015762] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.022488] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.029134] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.035864] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.042547] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.049261] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.055937] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.062659] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.069323] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.076042] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.082728] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.089407] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.096083] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.102814] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.109461] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.116184] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.122866] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.129566] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.136251] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.142965] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.149615] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.156333] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.163034] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.169739] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.176402] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.183116] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.189768] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.196498] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.203184] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.209890] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.216565] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.223288] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.229943] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.236657] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.243337] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.250022] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.256723] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.263437] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.270089] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.276832] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.283499] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.290201] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.296883] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.303602] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.310259] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.316975] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.323644] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.330331] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.337014] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.343764] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.350407] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.357149] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.363837] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.370538] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.377210] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.383924] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.390571] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.397292] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.403970] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.410661] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.417341] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.424050] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.430702] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.437418] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.444112] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.450818] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.457481] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.464203] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.470850] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.477574] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.484263] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.490946] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.497628] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.504351] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.510969] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.517742] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.524398] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.531088] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.537776] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.544506] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.551151] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.557884] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.564566] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.571323] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.577952] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.584707] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.591344] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.598071] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.604754] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.611452] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.618133] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.624867] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.631508] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.638225] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.644904] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.651636] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.658280] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.664975] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.671661] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.678341] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.684988] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.691767] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.698390] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.705114] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.711805] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.718495] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.725177] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.731900] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.738508] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.745259] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.751936] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.758670] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.765332] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.772065] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.778729] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.785454] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.792141] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.798846] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.805521] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.812286] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.818937] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.825663] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.832350] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.839048] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.845729] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.852438] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.859095] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.865827] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.872493] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.879190] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.885874] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.892602] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.899275] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.905991] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.912668] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.919354] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.926036] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.932772] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.939410] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.946136] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.952828] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.959520] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.966161] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.972916] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.979573] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.986295] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 514.992977] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 514.999667] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.006344] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.013076] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.019719] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.026461] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.033144] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.039847] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.046542] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.053263] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.059917] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.066640] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.073327] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.080013] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.086697] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.093412] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.100062] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.106804] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.113488] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.120187] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.126876] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.133709] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.140792] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.147514] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.154188] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.160879] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.167560] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.174285] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.180942] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.187699] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.194368] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.201056] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.207738] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.214462] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.221103] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.227854] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.234515] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.241249] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.247886] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.254621] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.261279] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.268001] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.274676] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.281378] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.288062] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.294810] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.301450] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.308175] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.314856] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.321556] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.328325] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.335017] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.341714] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.348404] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.355089] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.361821] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.368473] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.375197] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.381883] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.388569] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.395247] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.401965] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.408614] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.415339] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.422029] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.428732] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.435395] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.442110] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.448764] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.455481] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.462161] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.468842] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.475520] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.482245] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.488903] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.495625] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.502307] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.508995] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.515674] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.522396] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.529061] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.535801] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.542486] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.549219] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.555867] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.562597] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.569264] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.576001] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.582678] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.589469] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.596150] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.602881] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.609531] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.616271] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.622958] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.629645] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.636682] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.643402] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.650041] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.656773] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.663452] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.670147] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.676836] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.683538] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.690198] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.697018] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.703712] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.710411] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.717087] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.723817] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.730463] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.737185] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.743868] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.750560] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.757241] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.763954] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.770602] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.777319] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.784005] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.790705] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.797372] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.804507] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.811159] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.817876] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.824556] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.831256] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.837939] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.844668] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.851312] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.858043] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.864733] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.871422] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.878105] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.884837] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.891490] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.898246] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.904935] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.911669] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.918305] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.924989] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.931674] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.938368] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.945012] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.951751] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.958393] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.965116] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.971805] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.978493] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.985180] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 515.991906] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 515.998561] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.005287] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.011966] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.018672] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.025353] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.032098] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.038730] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.045445] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.052228] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.058919] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.065602] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.072326] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.078983] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.085718] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.092378] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.099080] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.105767] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.112488] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.119136] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.125879] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.132548] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.139230] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.145905] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.152630] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.159289] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.166017] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.172712] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.179402] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.186082] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.192816] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.199467] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.206203] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.212882] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.219572] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.226258] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.232974] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.239620] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.246334] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.253014] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.259723] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.266387] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.273111] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.279769] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.286494] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.293171] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.299858] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.306533] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.313255] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.319905] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.326624] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.333301] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.339950] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.346662] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.353387] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.360044] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.366880] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.373558] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.380238] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.386911] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.393679] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.400285] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.407005] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.413693] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.420373] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.427052] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.433781] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.440422] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.447157] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.453853] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.460544] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.467225] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.473941] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.480590] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.487317] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.494009] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.500718] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.507386] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.514110] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.520774] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.527506] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.534184] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.540878] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.547563] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.554286] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.560948] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.567642] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.574361] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.581077] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.587761] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.594490] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.601140] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.607872] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.614553] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.621258] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.627945] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.634674] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.641334] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.648071] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.654763] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.661453] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.668132] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.674881] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.681525] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.688250] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.694937] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.701699] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.708333] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.715022] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.721719] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.728410] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.735126] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.741860] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.748595] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.755321] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.762006] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.768713] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.775375] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.782179] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.788832] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.795569] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.802251] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.808942] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.815624] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.822342] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.829003] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.835752] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.842419] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.849108] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.855875] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.862592] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.869254] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.875980] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.882664] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.889364] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.896054] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.902797] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.909437] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.916183] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.922865] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.929552] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.936233] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.942955] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.949624] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.956354] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.963038] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.969744] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.976419] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.983159] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 516.989825] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 516.996557] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.003241] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.009922] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.016594] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.023315] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.029971] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.036702] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.043376] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.050061] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.056746] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.063456] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.070105] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.076843] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.083514] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.090211] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.096903] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.103614] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.110265] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.116985] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.123660] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.130357] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.137040] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.143767] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.150407] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.157134] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.163824] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.170523] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.177205] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.183922] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.190569] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.197289] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.203980] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.210665] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.217353] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.224075] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.230738] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.237451] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.244127] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.250901] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.257581] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.264302] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.271045] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.277785] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.284463] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.291170] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.297855] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.304590] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.311247] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.317983] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.324667] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.331359] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.338034] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.344774] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.351409] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.358126] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.364815] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.371522] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.378211] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.385034] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.391733] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.398408] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.405086] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.411821] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.418470] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.425194] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.431872] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.438563] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.445257] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.451981] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.458633] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.465360] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.472046] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.478747] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.485411] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.492132] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.498794] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.505527] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.512213] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.518900] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.525577] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.532299] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.538957] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.545720] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.552392] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.559096] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.565774] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.572532] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.579148] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.585883] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.592577] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.599271] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.605965] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.612714] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.619359] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.626089] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.632780] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.640008] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.646690] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.653390] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.660045] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.666773] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.673431] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.680115] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.686796] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.693532] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.700183] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.706906] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.713579] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.720261] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.726940] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.733666] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.740325] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.747049] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.753748] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.760436] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.767118] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.773854] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.780508] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.787246] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.793937] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.800625] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.807879] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.814610] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.821236] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.827953] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.834628] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.841331] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.848007] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.854761] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.861392] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.868111] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.874795] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.881495] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.888189] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.894925] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.901580] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.908294] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.914936] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.921675] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.928345] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.935044] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.941696] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.948431] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.955109] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.961842] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.968492] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.975221] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.981899] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 517.988582] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 517.995277] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.001989] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.008635] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.015357] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.022047] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.028756] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.035422] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.042169] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.048824] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.055543] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.062229] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.068911] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.075598] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.082316] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.088972] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.095720] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.102385] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.109071] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.115765] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.122487] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.129146] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.135877] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.142553] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.149235] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.155907] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.162624] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.169358] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.176133] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.182821] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.189510] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.196198] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.202912] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.209562] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.216287] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.222984] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.229677] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.236363] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.243089] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.249748] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.256460] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.263134] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.269831] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.276507] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.283227] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.289874] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.296777] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.303437] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.310127] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.316809] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.323537] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.330190] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.336915] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.343596] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.350281] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.356973] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.363760] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.370354] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.377075] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.383769] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.390494] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.397097] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.403894] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.410544] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.417266] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.423941] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.430631] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.437315] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.444024] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.450674] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.457400] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.464086] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.470785] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.477462] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.484199] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.490845] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.497564] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.504247] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.510926] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.517599] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.524380] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.530972] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.537703] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.544369] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.551070] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.557762] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.564495] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.571146] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.577915] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.584561] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.591252] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.597933] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.604659] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.611309] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.618026] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.624717] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.631406] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.638084] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.644830] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.651557] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.658267] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.664930] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 518.671648] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.682087] net_ratelimit: 19 callbacks suppressed [ 518.682101] protocol 88fb is buggy, dev hsr_slave_0 [ 518.684995] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.690035] protocol 88fb is buggy, dev hsr_slave_1 [ 518.694930] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.701928] protocol 88fb is buggy, dev hsr_slave_0 [ 518.706630] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.713448] protocol 88fb is buggy, dev hsr_slave_1 [ 518.718310] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.725262] protocol 88fb is buggy, dev hsr_slave_0 [ 518.730036] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.736900] protocol 88fb is buggy, dev hsr_slave_1 [ 518.741803] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.748488] clocksource: timekeeping watchdog on CPU1: Marking clocksource 'tsc' as unstable because the skew is too large: [ 518.753517] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.760090] clocksource: 'acpi_pm' wd_now: 3e09f5 wd_last: e962d7 mask: ffffff [ 518.771483] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.778071] clocksource: 'tsc' cs_now: 11a03bb383d cs_last: 116acc9df9b mask: ffffffffffffffff [ 518.778094] tsc: Marking TSC unstable due to clocksource watchdog [ 518.787510] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.800883] protocol 88fb is buggy, dev hsr_slave_0 [ 518.804924] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.812928] protocol 88fb is buggy, dev hsr_slave_1 [ 518.817875] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.824682] protocol 88fb is buggy, dev hsr_slave_0 [ 518.829545] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.834750] protocol 88fb is buggy, dev hsr_slave_1 [ 518.841263] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.864822] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.871720] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.878578] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 518.885443] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 04:29:47 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) eventfd(0x9) 04:29:47 executing program 0: epoll_create1(0x0) writev(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001fc0)='./file0\x00', 0x40, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, 0x0, 0x0) close(r0) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000040)={'\x00', {0x2, 0x0, @local}}) stat(0x0, 0x0) getgroups(0x0, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, 0x0) 04:29:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:29:47 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:29:47 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) [ 519.203938] binder: 21823 RLIMIT_NICE not set [ 519.211883] hid-generic 0000:0000:0000.0005: hidraw0: HID v0.00 Device [syz0] on syz1 04:29:47 executing program 0: socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6(0xa, 0x6, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) socket$rxrpc(0x21, 0x2, 0x2) write(r1, &(0x7f0000000340), 0x41395527) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000340)) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 519.249976] TSC found unstable after boot, most likely due to broken BIOS. Use 'tsc=unstable'. [ 519.259080] sched_clock: Marking unstable (519308415840, -58455502)<-(519369396107, -119435382) [ 519.259960] binder: 21822:21830 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:29:47 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) [ 519.335144] clocksource: Switched to clocksource acpi_pm 04:29:47 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) 04:29:47 executing program 3: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x94}], 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000280)='net/icmp\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000177, 0x0) [ 519.467699] hid-generic 0000:0000:0000.0006: hidraw0: HID v0.00 Device [syz0] on syz1 04:29:47 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) 04:29:47 executing program 3: r0 = perf_event_open(&(0x7f000025c000)={0x400000001, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf8f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r3, 0x0) sendto$inet6(r2, &(0x7f0000f6f000), 0x0, 0x20000003, 0x0, 0x0) 04:29:47 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) 04:29:48 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:29:48 executing program 3: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee67, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000055000)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000041000)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r0, 0x5, 0x0) close(r2) 04:29:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:29:48 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:29:48 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) [ 520.214816] binder: 21869 RLIMIT_NICE not set [ 520.272169] binder: 21867:21875 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:29:48 executing program 0: r0 = memfd_create(&(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x0) write$binfmt_elf32(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="7f454c46000000000000000000000000030003006f360000000000003800000000000000e8ff00000000200001"], 0x2d) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) 04:29:48 executing program 3: sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'bpq0\x00', 0x21}) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='ns\x00') ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) getdents(r0, &(0x7f0000000040)=""/46, 0x2e) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) r1 = openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r0, 0x800442d3, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1f, 0x0, 0x16e) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x4010, r1, 0x4f) tee(r0, r1, 0xdd4, 0x2) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x61ca7827, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PPPIOCGFLAGS(r1, 0x8004745a, 0x0) ioctl$HDIO_GETGEO(r1, 0x301, &(0x7f0000000000)) ioctl$EXT4_IOC_GROUP_EXTEND(r1, 0x40086607, &(0x7f0000000140)=0x1) socketpair(0x1, 0x5, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) setfsgid(0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000340)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, 0x0, 0x40000) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x89f1, &(0x7f0000000080)='ip6tnl0\x00') r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = syz_open_dev$admmidi(&(0x7f00000000c0)='/dev/admmidi#\x00', 0xffff, 0x400) ioctl$KDGKBMODE(r4, 0x4b44, 0x0) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r1, 0x4010ae68, &(0x7f0000000100)={0x5001, 0x11000}) ioctl$sock_inet_SIOCSIFNETMASK(r3, 0x891c, &(0x7f0000000000)={'lo\x00\n\xcc\x00\x00\x00\x00\x00\x00\x00\x00\x00&\x00', {0x2, 0x3, @rand_addr=0xfffffffffffffffe}}) 04:29:48 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) 04:29:48 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) 04:29:48 executing program 0: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_LOG_BASE(r0, 0x4008af04, &(0x7f0000000080)=0x0) 04:29:48 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(0x0, 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) 04:29:49 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket(0x10, 0x20000000000003, 0x0) recvmmsg(r1, &(0x7f0000001cc0), 0x0, 0x0, 0x0) sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000003080)={0x14, 0x1a, 0x201}, 0x14}}, 0x0) 04:29:49 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) ioctl$sock_inet_SIOCSARP(r1, 0x8955, &(0x7f0000000180)={{0x2, 0x4e24, @local}, {0x1, @local}, 0x18, {0x2, 0x4e24, @loopback}, 'lo\x00'}) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x14) write$UHID_DESTROY(r1, &(0x7f0000000040), 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) fsetxattr$trusted_overlay_nlink(r1, &(0x7f0000000080)='trusted.overlay.nlink\x00', &(0x7f0000000140)={'U+', 0x1a4}, 0x28, 0x2) 04:29:49 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(0x0, 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) 04:29:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) [ 521.210126] binder: 21917 RLIMIT_NICE not set 04:29:49 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:29:49 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(0x0, 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) [ 521.256772] binder: 21916:21920 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:29:49 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(0xffffffffffffffff, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) 04:29:49 executing program 3: openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$KDDELIO(0xffffffffffffffff, 0x4b35, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x0, 0x0) r2 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(r2, &(0x7f0000000340), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS64(r1, 0x125f, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, 0x0) 04:29:49 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(0xffffffffffffffff, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) 04:29:49 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="3c000000110001010000000000000000e0000001000000000000000000000000000000000a00000014000d0008000000000000000000000000000000"], 0x1}, 0x8}, 0x0) 04:29:49 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x200002, 0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000080)={0x0, r1}) 04:29:49 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(0xffffffffffffffff, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) 04:29:49 executing program 0: clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfff, 0xbe}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 04:29:50 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000580)='net/if_inet6\x00') sendfile(r0, r0, &(0x7f0000000000)=0x1000, 0x2000000000585e) 04:29:50 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r2, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r3 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) fcntl$F_SET_RW_HINT(r1, 0x40c, &(0x7f0000000040)=0x5) tkill(r3, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x2400, 0xde) 04:29:50 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)={0x81}) [ 522.236019] usb usb9: usbfs: process 21971 (syz-executor0) did not claim interface 0 before use 04:29:50 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:29:50 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:29:50 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, 0x0, 0x0) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) 04:29:50 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$inet6(0xa, 0x3, 0x81) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x9}, 0x1c) sendmsg(r1, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) [ 522.333504] binder: 21977 RLIMIT_NICE not set 04:29:50 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)={0x81}) [ 522.388061] binder: 21976:21985 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 522.418385] usb usb9: usbfs: process 21987 (syz-executor0) did not claim interface 0 before use 04:29:50 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, 0x0, 0x0) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) 04:29:50 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)={0x81}) 04:29:50 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000dddfc8)={0x0, 0x0, &(0x7f00008a7000)={&(0x7f0000000080)=ANY=[@ANYBLOB="2c00000010000501ff0488fffdffff2e0a0000000c000100060000007d5500010c000200000022ff02f10000"], 0x2c}}, 0x0) 04:29:50 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, 0x0, 0x0) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) [ 522.625145] usb usb9: usbfs: process 21997 (syz-executor0) did not claim interface 0 before use [ 522.696100] netlink: 'syz-executor3': attribute type 1 has an invalid length. 04:29:50 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)={0x81}) [ 522.880165] usb usb9: usbfs: process 22007 (syz-executor0) did not claim interface 0 before use 04:29:51 executing program 2: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) ioctl$TCSBRKP(r1, 0x5425, 0x7) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r2, 0x7f, &(0x7f0000000140)=""/243) tkill(r2, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$UI_SET_PHYS(r1, 0x4008556c, &(0x7f0000000040)='syz1\x00') 04:29:51 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x828002102011ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'lo\x00', 0x0}) bind$packet(r1, &(0x7f0000000280)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @link_local}, 0x14) r4 = dup3(r2, r1, 0x0) read(r4, &(0x7f0000000340)=""/4, 0x1009e) 04:29:51 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(0x0, 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:29:51 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2), 0x0) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) 04:29:51 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x80045515, &(0x7f0000000000)={0x81}) 04:29:51 executing program 3: r0 = socket$inet6(0xa, 0x3, 0x81) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x9}, 0x1c) sendmsg(r0, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) 04:29:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) [ 523.275323] binder: 22025 RLIMIT_NICE not set 04:29:51 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2), 0x0) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) [ 523.324277] binder: 22023:22031 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:29:51 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x80045515, &(0x7f0000000000)={0x81}) 04:29:51 executing program 3: dup2(0xffffffffffffff9c, 0xffffffffffffffff) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) write$eventfd(0xffffffffffffffff, 0x0, 0x0) getgroups(0x1, &(0x7f0000000180)=[0xffffffffffffffff]) getgid() setresgid(0x0, r0, 0x0) getresuid(0x0, 0x0, 0x0) fgetxattr(0xffffffffffffffff, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, 0x0) 04:29:51 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x80045515, &(0x7f0000000000)={0x81}) 04:29:51 executing program 3: r0 = syz_open_dev$evdev(&(0x7f0000001680)='/dev/input/event#\x00', 0x0, 0x5) write$binfmt_elf64(r0, &(0x7f00000000c0)=ANY=[], 0xffffffe8) r1 = gettid() r2 = fcntl$dupfd(r0, 0x0, r0) timer_create(0x0, &(0x7f0000000300)={0x0, 0x8000000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000340)) ioctl$TIOCLINUX2(r2, 0x541c, 0x0) timer_settime(0x0, 0x0, &(0x7f00000000c0)={{0x0, 0x8}, {0x0, 0x1c9c380}}, 0x0) tkill(r1, 0x401004000000016) [ 524.902258] net_ratelimit: 26 callbacks suppressed [ 524.902276] protocol 88fb is buggy, dev hsr_slave_0 [ 524.912824] protocol 88fb is buggy, dev hsr_slave_1 [ 524.918441] protocol 88fb is buggy, dev hsr_slave_0 [ 524.923911] protocol 88fb is buggy, dev hsr_slave_1 [ 525.542184] protocol 88fb is buggy, dev hsr_slave_0 [ 525.542195] protocol 88fb is buggy, dev hsr_slave_0 [ 525.542599] protocol 88fb is buggy, dev hsr_slave_1 [ 525.547707] protocol 88fb is buggy, dev hsr_slave_1 [ 525.563036] protocol 88fb is buggy, dev hsr_slave_0 [ 525.570556] protocol 88fb is buggy, dev hsr_slave_1 04:29:54 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f00000001c0)='/dev/cec#\x00', 0x1, 0x2) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x0) tkill(r2, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:29:54 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2), 0x0) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) 04:29:54 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x80045515, &(0x7f0000000000)={0x81}) 04:29:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:29:54 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(0x0, 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) [ 526.172809] usb usb9: usbfs: process 22063 (syz-executor0) did not claim interface 0 before use [ 526.211214] binder: 22066:22067 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:29:54 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(0x0) link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) [ 526.260853] binder: 22072 RLIMIT_NICE not set 04:29:54 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x80045515, &(0x7f0000000000)={0x81}) [ 526.304572] binder: 22066:22067 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:29:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) [ 526.468710] usb usb9: usbfs: process 22080 (syz-executor0) did not claim interface 0 before use [ 526.521193] binder: 22082:22084 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:29:54 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(0x0) link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) [ 526.567987] binder: 22085 RLIMIT_NICE not set 04:29:54 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x80045515, &(0x7f0000000000)={0x81}) [ 526.601994] binder: 22082:22084 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:29:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) [ 526.760374] usb usb9: usbfs: process 22092 (syz-executor0) did not claim interface 0 before use [ 526.877988] binder: 22095:22096 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 526.915932] binder: 22096 RLIMIT_NICE not set [ 526.962868] binder: 22095:22098 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:29:55 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6100) ftruncate(r1, 0x208200) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x11, 0xffffffffffffffff, 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8000fffffffe) 04:29:55 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(0x0) link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, r1) 04:29:55 executing program 0: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x80045515, &(0x7f0000000000)={0x81}) 04:29:55 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(0x0, 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:29:55 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x200000, 0x10) ioctl$DRM_IOCTL_MODESET_CTL(r1, 0x40086408, &(0x7f0000000140)={0x400, 0x20}) r2 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r2, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r3 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r2, 0x40086408, &(0x7f0000000040)={0x6, 0x9}) tkill(r3, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 527.424379] usb usb9: usbfs: process 22107 (syz-executor0) did not claim interface 0 before use 04:29:55 executing program 0: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x80045515, &(0x7f0000000000)={0x81}) 04:29:55 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(0x0, &(0x7f0000000400)='./file0\x00') dup2(r0, r1) 04:29:55 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = accept(r0, 0x0, &(0x7f0000000840)) getsockopt$IP6T_SO_GET_REVISION_TARGET(r1, 0x29, 0x45, &(0x7f0000000880)={'HL\x00'}, &(0x7f00000008c0)=0x1e) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r2, 0x8955, &(0x7f0000000180)={{}, {0x20000000304, @link_local}, 0x0, {0x2, 0x0, @local}, '\x00\x00\x00\x00\x01\x00\x00\x01\x00'}) connect$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) ioctl$sock_inet_SIOCDARP(r2, 0x8953, &(0x7f0000000100)={{0x2, 0x0, @empty}, {0x0, @remote}, 0x0, {0x2, 0x0, @broadcast}, 'gretap0\x00'}) [ 527.655192] usb usb9: usbfs: process 22124 (syz-executor0) did not claim interface 0 before use 04:29:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r1 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:29:55 executing program 0: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x80045515, &(0x7f0000000000)={0x81}) 04:29:55 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(0x0, &(0x7f0000000400)='./file0\x00') dup2(r0, r1) 04:29:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r1 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) [ 527.905182] usb usb9: usbfs: process 22136 (syz-executor0) did not claim interface 0 before use 04:29:56 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x80045515, &(0x7f0000000000)={0x81}) 04:29:56 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(0x0, &(0x7f0000000400)='./file0\x00') dup2(r0, r1) [ 528.086593] usb usb9: usbfs: process 22145 (syz-executor0) did not claim interface 0 before use 04:29:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r1 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:29:56 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x80045515, &(0x7f0000000000)={0x81}) 04:29:56 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r2, &(0x7f0000011fd2), 0xffffffee) read(r1, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:29:56 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r2, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r3 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) ioctl$sock_SIOCSPGRP(r1, 0x8902, &(0x7f0000000040)=r3) tkill(r3, 0x15) fcntl$lock(r2, 0x5, &(0x7f0000000080)={0x0, 0x0, 0x75dd78e9, 0xa043, r3}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:29:56 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', 0x0) dup2(r0, r1) [ 528.387191] usb usb9: usbfs: process 22158 (syz-executor0) did not claim interface 0 before use 04:29:56 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0xffffffffffffffff}, 0x1c) 04:29:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:29:56 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r0 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r0, 0x80045515, &(0x7f0000000000)={0x81}) [ 528.607913] binder: 22174:22175 Acquire 1 refcount change on invalid ref 0 ret -22 [ 528.645440] usb usb9: usbfs: process 22177 (syz-executor0) did not claim interface 0 before use [ 528.662787] binder: 22174:22175 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 528.670342] binder: 22175 RLIMIT_NICE not set 04:29:56 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)={0x81}) 04:29:56 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', 0x0) dup2(r0, r1) [ 528.716681] binder: 22174:22180 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:29:56 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f023c123f3188a070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x2, &(0x7f0000000140)=0x101, 0x4) listen(r1, 0x0) [ 528.877825] usb usb9: usbfs: process 22186 (syz-executor0) did not claim interface 0 before use 04:29:57 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)={0x81}) 04:29:57 executing program 3: ioprio_set$uid(0x1, 0x0, 0x0) 04:29:57 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', 0x0) dup2(r0, r1) [ 529.087599] usb usb9: usbfs: process 22199 (syz-executor0) did not claim interface 0 before use 04:29:57 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)={0x81}) 04:29:57 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r2, &(0x7f0000011fd2), 0xffffffee) read(r1, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:29:57 executing program 3: mkdir(&(0x7f0000001a00)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', r0, &(0x7f0000000040)='./file0\x00', 0x0) 04:29:57 executing program 2: init_module(&(0x7f0000000140)='/dev/cec#\x00', 0xa, &(0x7f00000001c0)='/dev/cec#\x00') r0 = syz_open_dev$cec(&(0x7f0000000180)='/dev/cec#\x00', 0x3, 0x2) ioctl$KVM_IOEVENTFD(r0, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r1 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r1, 0x15) flistxattr(r0, &(0x7f0000000080)=""/49, 0x31) ioctl$DRM_IOCTL_AGP_FREE(r0, 0x40206435, &(0x7f0000000100)={0x1, 0x0, 0x10000, 0x6}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ptrace$peekuser(0x3, r1, 0x7f) [ 529.438777] usb usb9: usbfs: process 22217 (syz-executor0) did not claim interface 0 before use 04:29:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:29:57 executing program 1: pipe2(&(0x7f0000000140), 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r1, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(0xffffffffffffffff, r0) 04:29:57 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0adc1f121e0d3f3188a070") r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000100)=0xea, 0x4) getsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000b67000), &(0x7f00007d0000)=0xffffff74) 04:29:57 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)={0x81}) [ 529.578566] binder: 22231:22232 Acquire 1 refcount change on invalid ref 0 ret -22 [ 529.612410] binder: 22231:22232 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 529.638528] binder: 22232 RLIMIT_NICE not set 04:29:57 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x2c, r1, 0xd, 0x0, 0x0, {{}, 0x0, 0x4102, 0x0, {0x10, 0x13, @udp='udp:syz1\x00'}}}, 0x2c}}, 0x0) [ 529.662041] usb usb9: usbfs: process 22238 (syz-executor0) did not claim interface 0 before use [ 529.692403] binder: 22231:22240 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:29:57 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)={0x81}) 04:29:57 executing program 3: creat(&(0x7f0000000180)='./file1\x00', 0x0) [ 529.871510] usb usb9: usbfs: process 22247 (syz-executor0) did not claim interface 0 before use 04:29:58 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)={0x81}) 04:29:58 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f00000000c0)=""/88, 0x58) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000300)) r1 = fcntl$dupfd(r0, 0x0, r0) clone(0x3103001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_execute_func(&(0x7f0000000240)="3666440f50f564ff0941c3c4e2c9975842c4c2a37d794e005cc4c1b62ac13e0f1110c442019dccd3196f27") socket$inet6(0xa, 0x0, 0x0) ioctl$sock_inet_SIOCGIFNETMASK(r1, 0x891b, 0x0) [ 530.045910] usb usb9: usbfs: process 22253 (syz-executor0) did not claim interface 0 before use 04:29:58 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r2, &(0x7f0000011fd2), 0xffffffee) read(r1, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:29:58 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)) r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)={0x81}) 04:29:58 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x15) setsockopt$TIPC_IMPORTANCE(r1, 0x10f, 0x7f, &(0x7f0000000040)=0x4, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:29:58 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:29:58 executing program 1: pipe2(&(0x7f0000000140), 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r1, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(0xffffffffffffffff, r0) [ 530.436121] usb usb9: usbfs: process 22269 (syz-executor0) did not claim interface 0 before use [ 530.503023] binder: 22275:22276 Acquire 1 refcount change on invalid ref 0 ret -22 04:29:58 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)) r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)={0x81}) [ 530.560012] binder: 22275:22276 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 530.570571] binder: 22276 RLIMIT_NICE not set [ 530.616518] binder: 22275:22280 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 530.627829] usb usb9: usbfs: process 22285 (syz-executor0) did not claim interface 0 before use 04:29:58 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)) r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)={0x81}) [ 530.799322] usb usb9: usbfs: process 22291 (syz-executor0) did not claim interface 0 before use 04:29:58 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c12") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)={0x81}) 04:29:59 executing program 3: sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'bpq0\x00', 0x21}) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='ns\x00') ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) getdents(r0, &(0x7f0000000040)=""/46, 0x2e) write$P9_RRENAME(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r0, 0x800442d3, &(0x7f00000005c0)={0x5, 0xd06, 0x2, @empty, 'ip6gretap0\x00'}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1f, 0x0, 0x16e) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x4010, 0xffffffffffffffff, 0x4f) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x61ca7827, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PPPIOCGFLAGS(0xffffffffffffffff, 0x8004745a, 0x0) ioctl$HDIO_GETGEO(0xffffffffffffffff, 0x301, &(0x7f0000000000)) socketpair(0x1, 0x5, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) setfsgid(0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000340)='TIPCv2\x00') getsockopt$EBT_SO_GET_ENTRIES(r1, 0x0, 0x81, &(0x7f0000000280)={'broute\x00', 0x0, 0x3, 0x54, [], 0x1, &(0x7f0000000100)=[{}], &(0x7f0000000200)=""/84}, &(0x7f0000000140)=0x78) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, 0x0, 0x40000) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x89f1, &(0x7f0000000080)='ip6tnl0\x00') r2 = socket$inet_tcp(0x2, 0x1, 0x0) syz_open_dev$admmidi(&(0x7f00000000c0)='/dev/admmidi#\x00', 0xffff, 0x400) ioctl$sock_inet_SIOCSIFNETMASK(r2, 0x891c, &(0x7f0000000000)={'lo\x00\n\xcc\x00\x00\x00\x00\x00\x00\x00\x00\x00&\x00', {0x2, 0x0, @rand_addr=0xfffffffffffffffe}}) [ 530.974346] usb usb9: usbfs: process 22299 (syz-executor0) did not claim interface 0 before use 04:29:59 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c12") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)={0x81}) [ 531.142465] net_ratelimit: 26 callbacks suppressed [ 531.142482] protocol 88fb is buggy, dev hsr_slave_0 [ 531.153064] protocol 88fb is buggy, dev hsr_slave_1 [ 531.158751] protocol 88fb is buggy, dev hsr_slave_0 [ 531.164349] protocol 88fb is buggy, dev hsr_slave_1 [ 531.184294] usb usb9: usbfs: process 22307 (syz-executor0) did not claim interface 0 before use 04:29:59 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c12") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)={0x81}) 04:29:59 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r2 = gettid() mq_timedreceive(r1, &(0x7f0000000140)=""/147, 0x93, 0x7fffffff, &(0x7f0000000040)={0x0, 0x989680}) timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 531.330619] usb usb9: usbfs: process 22311 (syz-executor0) did not claim interface 0 before use 04:29:59 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, 0x0, 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:29:59 executing program 3: r0 = memfd_create(&(0x7f0000000400)='\xe87y\xd8\x0e\xfaE\xbb\x7fH\xbe\xbc\x95\x87\v\xd0\xcd9\xbd(0\xeeG\xaf\xe7\xb3?\xc7x\xbd\xe2R\xc5\r.', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x0) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r2, 0xc0505350, &(0x7f0000000000)={{0x0, 0x4a01}, 'port0\x00'}) 04:29:59 executing program 1: pipe2(&(0x7f0000000140), 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r1, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(0xffffffffffffffff, r0) 04:29:59 executing program 4: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r1 = dup(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:29:59 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)={0x81}) [ 531.564732] usb usb9: usbfs: process 22321 (syz-executor0) did not claim interface 0 before use 04:29:59 executing program 4: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r1 = dup(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:29:59 executing program 3: 04:29:59 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)={0x81}) 04:29:59 executing program 3: [ 531.782258] protocol 88fb is buggy, dev hsr_slave_0 [ 531.782551] protocol 88fb is buggy, dev hsr_slave_0 [ 531.787780] protocol 88fb is buggy, dev hsr_slave_1 [ 531.792890] protocol 88fb is buggy, dev hsr_slave_1 [ 531.803800] protocol 88fb is buggy, dev hsr_slave_0 [ 531.812076] protocol 88fb is buggy, dev hsr_slave_1 04:29:59 executing program 3: [ 531.859158] usb usb9: usbfs: process 22345 (syz-executor0) did not claim interface 0 before use 04:29:59 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)={0x81}) [ 532.027458] usb usb9: usbfs: process 22351 (syz-executor0) did not claim interface 0 before use 04:30:00 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x15) getuid() ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:30:00 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, 0x0, 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:00 executing program 4: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r1 = dup(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:00 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20\x00', 0x0, 0x0) read(r0, 0x0, 0x0) 04:30:00 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a0") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)={0x81}) 04:30:00 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, 0xffffffffffffffff) [ 532.546062] usb usb9: usbfs: process 22364 (syz-executor0) did not claim interface 0 before use 04:30:00 executing program 4: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:00 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0xc0010058, 0x0, 0x1000}]}) 04:30:00 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a0") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)={0x81}) [ 532.706202] kvm [22374]: vcpu0, guest rIP: 0xfff0 unimplemented MMIO_CONF_BASE wrmsr: 0x1000 04:30:00 executing program 4: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) [ 532.764512] kvm: SMP vm created on host with unstable TSC; guest TSC will not be reliable [ 532.796247] usb usb9: usbfs: process 22384 (syz-executor0) did not claim interface 0 before use 04:30:00 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a0") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)={0x81}) 04:30:00 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) socketpair$unix(0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000f9a000/0x1000)=nil, 0x1000, 0x0, 0x32, r0, 0x0) [ 533.005492] usb usb9: usbfs: process 22391 (syz-executor0) did not claim interface 0 before use 04:30:01 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x24, 0x0, @tid=r2}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x15) ioctl$KDADDIO(r1, 0x4b34, 0x5) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:30:01 executing program 3: 04:30:01 executing program 4: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:01 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, 0x0, 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:01 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(0x0, 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)={0x81}) 04:30:01 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$IMDELTIMER(r1, 0x80044941, &(0x7f0000000040)=0x2) 04:30:01 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, 0xffffffffffffffff) 04:30:01 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(0x0, 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)={0x81}) 04:30:01 executing program 3: 04:30:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:01 executing program 3: 04:30:01 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(0x0, 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)={0x81}) [ 533.739448] binder: 22428:22429 Acquire 1 refcount change on invalid ref 0 ret -22 [ 533.797374] binder: 22428:22433 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 533.831267] binder: 22429 RLIMIT_NICE not set 04:30:01 executing program 3: 04:30:01 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x0, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)={0x81}) [ 533.881066] binder: 22428:22433 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:02 executing program 3: 04:30:02 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r2, &(0x7f0000011fd2), 0xffffffee) read(r1, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:02 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x0, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)={0x81}) 04:30:02 executing program 3: 04:30:02 executing program 1: pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000080)='./file0\x00') link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') dup2(r0, 0xffffffffffffffff) 04:30:02 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r0, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r1 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r1, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x20) 04:30:02 executing program 3: 04:30:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:02 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x0, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)={0x81}) 04:30:02 executing program 3: [ 534.668423] binder: 22468:22469 Acquire 1 refcount change on invalid ref 0 ret -22 04:30:02 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x0) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)={0x81}) [ 534.722981] binder: 22468:22469 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:30:02 executing program 3: [ 534.786823] binder: 22473 RLIMIT_NICE not set [ 534.793588] binder: 22468:22469 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:02 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x0) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)={0x81}) 04:30:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:03 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r2, &(0x7f0000011fd2), 0xffffffee) read(r1, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:03 executing program 3: 04:30:03 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x0) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)={0x81}) 04:30:03 executing program 1: 04:30:03 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000040)=0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000140)={{{@in6, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}, &(0x7f0000000080)=0xe8) r4 = getgid() setsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={r2, r3, r4}, 0xc) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) ioctl$sock_inet_SIOCRTMSG(r1, 0x890d, &(0x7f0000000280)={0x0, {0x2, 0x4e23, @broadcast}, {0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x2, 0x4e21, @empty}, 0x30b, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x700000000000, 0x2, 0x8}) r5 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)=0x0) timer_settime(r6, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r5, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 535.445581] binder: 22491:22496 Acquire 1 refcount change on invalid ref 0 ret -22 04:30:03 executing program 3: 04:30:03 executing program 1: [ 535.515312] binder: 22491:22501 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 535.590385] binder: 22496 RLIMIT_NICE not set 04:30:03 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x80045515, &(0x7f0000000000)={0x81}) 04:30:03 executing program 1: [ 535.639644] binder: 22491:22501 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:03 executing program 3: 04:30:03 executing program 1: 04:30:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:04 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r2, &(0x7f0000011fd2), 0xffffffee) read(r1, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:04 executing program 3: 04:30:04 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x80045515, &(0x7f0000000000)={0x81}) 04:30:04 executing program 1: 04:30:04 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000180)={{{@in6=@local, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@mcast1}}, &(0x7f0000000280)=0xe8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000480)={0x0, @in6={{0xa, 0x4e21, 0x8, @dev={0xfe, 0x80, [], 0xd}, 0x2}}, 0xa67, 0x2, 0x0, 0x9, 0x1}, &(0x7f0000000140)=0x98) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f00000003c0)={0x10000, 0x20c, 0x7, 0xfffffffffffffffc, r3}, &(0x7f0000000400)=0x10) sendmsg$can_raw(r1, &(0x7f0000000380)={&(0x7f00000002c0)={0x1d, r2}, 0x10, &(0x7f0000000340)={&(0x7f0000000300)=@can={{0x1, 0x9, 0x5, 0x8}, 0x5, 0x3, 0x0, 0x0, "56fe30e4261de3a2"}, 0x10}, 0x1, 0x0, 0x0, 0x5}, 0x20040000) r4 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) ioctl$KVM_ENABLE_CAP_CPU(r1, 0x4068aea3, &(0x7f0000000040)={0x0, 0x0, [0x7, 0x72c, 0x3fff80000000, 0x8]}) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 536.369463] binder: 22523:22524 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 536.379714] binder: 22524 RLIMIT_NICE not set [ 536.426700] binder: 22523:22529 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:04 executing program 3: 04:30:04 executing program 1: 04:30:04 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x80045515, &(0x7f0000000000)={0x81}) 04:30:04 executing program 3: 04:30:04 executing program 1: 04:30:04 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, 0x0) 04:30:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) [ 537.233859] binder: 22557:22558 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 537.243122] binder: 22558 RLIMIT_NICE not set [ 537.290067] binder: 22557:22559 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:05 executing program 1: 04:30:05 executing program 3: 04:30:05 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:05 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, 0x0) 04:30:05 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000040)=0xa7) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:30:05 executing program 1: [ 537.382138] net_ratelimit: 26 callbacks suppressed [ 537.382225] protocol 88fb is buggy, dev hsr_slave_0 [ 537.392792] protocol 88fb is buggy, dev hsr_slave_1 [ 537.398460] protocol 88fb is buggy, dev hsr_slave_0 [ 537.404008] protocol 88fb is buggy, dev hsr_slave_1 04:30:05 executing program 3: 04:30:05 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, 0x0) 04:30:05 executing program 1: 04:30:05 executing program 3: 04:30:05 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)) 04:30:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:06 executing program 1: 04:30:06 executing program 3: [ 538.022335] protocol 88fb is buggy, dev hsr_slave_0 [ 538.027821] protocol 88fb is buggy, dev hsr_slave_1 [ 538.031432] protocol 88fb is buggy, dev hsr_slave_0 [ 538.033473] protocol 88fb is buggy, dev hsr_slave_0 [ 538.038391] protocol 88fb is buggy, dev hsr_slave_1 [ 538.045320] protocol 88fb is buggy, dev hsr_slave_1 [ 538.196787] binder: 22593:22595 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 538.210988] binder: 22595 RLIMIT_NICE not set [ 538.260161] binder: 22593:22597 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:06 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:06 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)) 04:30:06 executing program 1: 04:30:06 executing program 3: 04:30:06 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0, 0x0, r1, 0x8}) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r1, 0x84, 0x1e, &(0x7f0000000040), &(0x7f0000000080)=0x4) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:30:06 executing program 1: 04:30:06 executing program 3: 04:30:06 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0af51f023c123f3188a070") r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) ioctl$FS_IOC_FSGETXATTR(r1, 0x80045515, &(0x7f0000000000)) 04:30:06 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f0000000040)={0x3000, 0x0, 0x0, r1}) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @tid=r2}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) fsetxattr$security_selinux(r1, &(0x7f0000000080)='security.selinux\x00', &(0x7f00000000c0)='system_u:object_r:gpg_helper_exec_t:s0\x00', 0x27, 0x2) 04:30:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:07 executing program 1: 04:30:07 executing program 3: [ 539.099550] binder: 22629:22630 ioctl c0306201 0 returned -14 [ 539.118495] binder: 22629:22630 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 539.146248] binder: 22630 RLIMIT_NICE not set [ 539.193330] binder: 22629:22633 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:07 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:07 executing program 0: 04:30:07 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(0x0, 0x41) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$KVM_SET_MP_STATE(r1, 0x4004ae99, &(0x7f0000000040)) 04:30:07 executing program 3: 04:30:07 executing program 1: 04:30:07 executing program 1: 04:30:07 executing program 3: 04:30:07 executing program 0: 04:30:07 executing program 1: 04:30:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:07 executing program 3: 04:30:07 executing program 0: [ 539.998588] binder: 22659:22660 ioctl c0306201 0 returned -14 [ 540.038056] binder: 22659:22660 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 540.069464] binder: 22660 RLIMIT_NICE not set [ 540.115838] binder: 22659:22663 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:08 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(0x0, 0x0) write$sndseq(0xffffffffffffffff, &(0x7f0000011fd2), 0xffffffee) read(0xffffffffffffffff, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:08 executing program 1: 04:30:08 executing program 3: 04:30:08 executing program 0: 04:30:08 executing program 2: socketpair$unix(0x1, 0xfffffffffffffffe, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x15) ioctl$TCGETA(r1, 0x5405, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:30:08 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x2, 0x73) r1 = socket$kcm(0x2, 0x2, 0x73) close(r1) 04:30:08 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair(0x0, 0x0, 0x0, 0x0) accept$unix(r1, &(0x7f0000000180), &(0x7f0000000240)=0x6e) setsockopt$sock_timeval(r0, 0x1, 0x0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='/\x00~WMzU\xed\xbb\xc8\x00\x030\x80\x90\"\xcf\xde&U]\xc9\xec\xfe\x19t@n\xda\xd3\x83dx-c\xb6a(T\xb9\xe4\x9d\xbd\xca\xefq\x81\x97\xe3~\x87\n0\x8b\x1e:y\x8f\xa7\x88\xa4m0%\xef\x93>Q\x82\x8a\xb6u\x06N*\xdb\xe9\x12d#\xb4\xa7=h\xfb\xe9\x9cm\xb2\xb1`\xd4\x9c\xb6\xcc\xe7l\'(\x9aO\x9d\x19sT\xaa\xa5\x86\r#\x83\xdf\x87Rk\xaa\x18M\x90\xbbw)6d\x17\xbc3\xd7e\xe9\xbc/\x88*\x13\xf3\xa9\xc1\xf6\x06`\xbdO\xd2\xfa1\xd2\xc0\xa7u$\"\x89\xbc\xe0b\xd1\r$\xde\xd5@i\x18\xa6k,u\xc4?\xe1\xffE\x8a\xe5\xcd\x9f\xecc\x03\x9b\xa5\xa7\xb6j`\xed\xe5\xcc\xda\xbc~\xe7v`\xef#X\xcc\xdf\xf0\"&\x02\x13\x84\xb0\xc25\xf1\xf7\xff\xff\xff\xff\xff\xff\xff\xc2V\xac\xde\xb6\x10\xdfB\xe7\x16\x9f$\x03W\xf75\xae_\xe2\x90\x17\xe5\x1e\'%/H\xb9[\xfb\xbb:\x86U5)\x8b\xdc6\xd7\x1d\xb65\xf4\x1cWw\x1d\xb7z\xea\xff\x88?\xeb=\xc3\xcc$\xbd<\x03n9j\xd3\xaf7\x94PX\x83\x9e\x81\"p\xbc@\x90\x1f\xa6T\xe7\xcc2\x92\xa8/\xc8\f7M\xc0qB\xa1\xc2\xe9\xd3\xe2R\x8eO\xda\xc3+\xca\xef\xe9\x10\xeb\xd3\xb9H\xa3\xbf\xeb\xef_\xa8\xd8$s\xc7\xfb\xf3\xecv:\x1ba=\xd7G\xd5)\xeap\xef\x02\x98\xff\xf5f\x160\xb9\x9ay\xec\x82i\xaf\x9b\xe1x\xae\xca\x17\xfe\xfb\x14\xfd=\x00\x97Z\x99\x9dy\xba\x89M\xba\xe4\xc1\xa6\x06\x00\x00\x00\x00\x00\x00\x00x\"m\a\xe6:?E\x96~\x0e\xe8Y\xbbn\x0f0xffffffffffffffff}) shmget(0xffffffffffffffff, 0x1000, 0x0, &(0x7f0000fff000/0x1000)=nil) dup2(r0, r2) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, 0x0) ioctl$sock_SIOCGIFBR(0xffffffffffffffff, 0x8940, 0x0) fadvise64(0xffffffffffffffff, 0x0, 0x0, 0x0) lstat(0x0, 0x0) shmget$private(0x0, 0x1000, 0x0, &(0x7f0000fff000/0x1000)=nil) write$nbd(0xffffffffffffffff, 0x0, 0x0) ioctl$TIOCSBRK(0xffffffffffffffff, 0x5427) preadv(r2, 0x0, 0x0, 0x0) 04:30:08 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(0x0, 0x0) write$sndseq(0xffffffffffffffff, &(0x7f0000011fd2), 0xffffffee) read(0xffffffffffffffff, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:08 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000040)=0x100, 0xdbdc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendto$inet6(r0, &(0x7f0000000140)="0303000007005b0000000000fff55b4202938207d9bb37c81e1bbbed5bcc7cb26111b8301ee616d5c01843000000000053c0f485472da7222a2bb401000000c3b5003500f55dc667b3009b000000faffff0c01000000aeb46245004bad2a66c9c19bc6e3408804", 0x67, 0x0, 0x0, 0x0) 04:30:08 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x2, 0x73) r1 = socket$kcm(0x2, 0x2, 0x73) close(r1) 04:30:08 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x2, 0x73) r1 = socket$kcm(0x2, 0x2, 0x73) close(r1) 04:30:08 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(0x0, 0x0) write$sndseq(0xffffffffffffffff, &(0x7f0000011fd2), 0xffffffee) read(0xffffffffffffffff, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:09 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x2, 0x73) r1 = socket$kcm(0x2, 0x2, 0x73) close(r1) [ 540.923797] binder: 22699:22700 ioctl c0306201 0 returned -14 04:30:09 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x2, 0x73) r1 = socket$kcm(0x2, 0x2, 0x73) close(r1) [ 540.991381] binder: 22699:22700 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 541.023743] binder: 22700 RLIMIT_NICE not set [ 541.071867] binder: 22699:22709 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:09 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) times(&(0x7f0000000080)) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x3, 0x2) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0, 0x2}) r2 = gettid() ioctl$VIDIOC_S_FREQUENCY(r1, 0x402c5639, &(0x7f0000000140)={0x10001, 0x5, 0xff}) ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f0000000040)=r2) timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:30:09 executing program 0: socketpair$unix(0x1, 0x4000000000002, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee67, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmmsg$unix(r1, &(0x7f0000000140), 0x492492492492531, 0x0) connect$unix(r0, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) 04:30:09 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) write$sndseq(0xffffffffffffffff, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:09 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x2, 0x73) r1 = socket$kcm(0x2, 0x2, 0x73) close(r1) 04:30:09 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x2, 0x73) r1 = socket$kcm(0x2, 0x2, 0x73) close(r1) 04:30:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:09 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x2, 0x73) close(0xffffffffffffffff) 04:30:09 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) [ 541.769058] binder: 22738 RLIMIT_NICE not set 04:30:09 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$kcm(0x2, 0x2, 0x73) close(r1) 04:30:09 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x2, 0x73) [ 541.815906] binder: 22735:22742 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 541.839199] binder: 22743:22744 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 541.876235] binder: 22744 RLIMIT_NICE not set [ 541.922099] binder: 22743:22751 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:10 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x2, 0x73) 04:30:10 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r2 = gettid() timer_create(0x403, &(0x7f0000000040)={0x0, 0x12, 0x8000, @tid=r2}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:30:10 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$kcm(0x2, 0x2, 0x73) close(r1) 04:30:10 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x2, 0x73) 04:30:10 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) write$sndseq(0xffffffffffffffff, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:10 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) r0 = socket$kcm(0x2, 0x2, 0x73) close(r0) 04:30:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:10 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:10 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) r0 = socket$kcm(0x2, 0x2, 0x73) close(r0) 04:30:10 executing program 0: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) [ 542.705467] binder: 22782:22784 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 542.713615] binder: 22784 RLIMIT_NICE not set 04:30:10 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) r0 = socket$kcm(0x2, 0x2, 0x73) close(r0) 04:30:10 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) [ 542.765741] binder: 22782:22786 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:10 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = socket$kcm(0x2, 0x2, 0x73) close(r0) [ 543.622023] net_ratelimit: 26 callbacks suppressed [ 543.622035] protocol 88fb is buggy, dev hsr_slave_0 [ 543.632431] protocol 88fb is buggy, dev hsr_slave_1 [ 543.637788] protocol 88fb is buggy, dev hsr_slave_0 [ 543.643255] protocol 88fb is buggy, dev hsr_slave_1 [ 544.262202] protocol 88fb is buggy, dev hsr_slave_0 [ 544.262213] protocol 88fb is buggy, dev hsr_slave_0 [ 544.262641] protocol 88fb is buggy, dev hsr_slave_1 [ 544.267598] protocol 88fb is buggy, dev hsr_slave_1 [ 544.282783] protocol 88fb is buggy, dev hsr_slave_0 [ 544.288904] protocol 88fb is buggy, dev hsr_slave_1 04:30:13 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000180)='/dev/rtc0\x00', 0x803, 0x0) setsockopt$EBT_SO_SET_COUNTERS(r0, 0x0, 0x81, &(0x7f0000000240)={'broute\x00', 0x0, 0x0, 0x0, [], 0xa, &(0x7f00000001c0)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}, 0x118) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r2, 0xc0045516, &(0x7f0000000140)=0xd9) ioctl$KVM_IOEVENTFD(r2, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r3 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) splice(r2, &(0x7f0000000040), r1, &(0x7f0000000080), 0x5, 0x4) tkill(r3, 0x15) ioctl$VIDIOC_S_EXT_CTRLS(r2, 0xc0205648, &(0x7f00000003c0)={0x0, 0xfff, 0x0, [], &(0x7f0000000380)={0x9f0bf7, 0x56, [], @value64=0x6}}) getpgrp(r3) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:30:13 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:13 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = socket$kcm(0x2, 0x2, 0x73) close(r0) 04:30:13 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) write$sndseq(0xffffffffffffffff, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:13 executing program 0: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:13 executing program 3: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) [ 545.366791] binder: 22806:22807 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 545.379964] binder: 22807 RLIMIT_NICE not set 04:30:13 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = socket$kcm(0x2, 0x2, 0x73) close(r0) [ 545.426976] binder: 22806:22817 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:13 executing program 3: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:13 executing program 1: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$kcm(0x2, 0x2, 0x73) close(r1) 04:30:13 executing program 3: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:13 executing program 1: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$kcm(0x2, 0x2, 0x73) close(r1) 04:30:14 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x15) ioctl$IMGETCOUNT(r0, 0x80044943, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) write$FUSE_INIT(r1, &(0x7f0000000180)={0x50, 0x0, 0x1, {0x7, 0x1c, 0x800, 0x2000, 0xfffffffffffff000, 0x1, 0x3, 0x4}}, 0x50) ioctl$IMSETDEVNAME(r1, 0x80184947, &(0x7f0000000080)={0x8, 'syz1\x00'}) write$P9_RCREATE(r1, &(0x7f0000000040)={0x18, 0x73, 0x2, {{0x2, 0x0, 0x8}, 0xff}}, 0x18) 04:30:14 executing program 3: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:14 executing program 1: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$kcm(0x2, 0x2, 0x73) close(r1) 04:30:14 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, 0x0, 0x0) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) [ 546.322628] binder: 22849:22850 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 546.362721] binder: 22850 RLIMIT_NICE not set 04:30:14 executing program 0: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:14 executing program 1: socketpair$unix(0x1, 0x3, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = socket$kcm(0x2, 0x2, 0x73) close(r0) 04:30:14 executing program 3: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) [ 546.409831] binder: 22849:22854 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:14 executing program 1: socketpair$unix(0x1, 0x3, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = socket$kcm(0x2, 0x2, 0x73) close(r0) 04:30:14 executing program 3: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:14 executing program 1: socketpair$unix(0x1, 0x3, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = socket$kcm(0x2, 0x2, 0x73) close(r0) 04:30:14 executing program 3: socketpair$unix(0x1, 0x3, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:15 executing program 2: r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm_plock\x00', 0x2500, 0x0) fcntl$addseals(r0, 0x409, 0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r2, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r3 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r3, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 04:30:15 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = socket$kcm(0x2, 0x2, 0x73) close(r0) 04:30:15 executing program 3: socketpair$unix(0x1, 0x3, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:15 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, 0x0, 0x0) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) [ 547.272909] binder: 22886:22887 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 547.302651] binder: 22887 RLIMIT_NICE not set [ 547.350105] binder: 22886:22894 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:15 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) r0 = socket$kcm(0x2, 0x2, 0x73) close(r0) 04:30:15 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = socket$kcm(0x2, 0x2, 0x73) close(r0) 04:30:15 executing program 3: socketpair$unix(0x1, 0x3, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:15 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = socket$kcm(0x2, 0x2, 0x73) close(r0) 04:30:15 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:15 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:15 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) r1 = socket$kcm(0x2, 0x2, 0x73) close(r1) 04:30:16 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) r1 = socket$kcm(0x2, 0x2, 0x73) close(r1) 04:30:16 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:16 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f0000000040), &(0x7f0000000080)=0x4) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:30:16 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:16 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, 0x0, 0x0) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:16 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) r1 = socket$kcm(0x2, 0x2, 0x73) close(r1) [ 548.209228] binder: 22925:22926 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 548.237781] binder: 22926 RLIMIT_NICE not set 04:30:16 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:16 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) [ 548.285273] binder: 22925:22937 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:16 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:16 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$kcm(0x2, 0x0, 0x73) close(r1) 04:30:16 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x2, 0x73) 04:30:16 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x2, 0x73) 04:30:16 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:17 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) setsockopt$IP_VS_SO_SET_STOPDAEMON(r1, 0x0, 0x48c, &(0x7f0000000040)={0x2, 'rose0\x00', 0x3}, 0x18) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:30:17 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x2, 0x73) close(0xffffffffffffffff) 04:30:17 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x2, 0x73) 04:30:17 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:17 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r2, &(0x7f0000011fd2), 0xffffffee) read(0xffffffffffffffff, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) [ 549.108815] binder: 22975 RLIMIT_NICE not set 04:30:17 executing program 1: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:17 executing program 0: socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) [ 549.161771] binder: 22971:22984 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:17 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:17 executing program 0: socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:17 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:17 executing program 0: socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) [ 549.862707] net_ratelimit: 26 callbacks suppressed [ 549.862725] protocol 88fb is buggy, dev hsr_slave_0 [ 549.873422] protocol 88fb is buggy, dev hsr_slave_1 [ 549.879205] protocol 88fb is buggy, dev hsr_slave_0 [ 549.884939] protocol 88fb is buggy, dev hsr_slave_1 04:30:18 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r2 = gettid() timer_create(0x0, &(0x7f0000000080)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000100)={0x0, 0x0, 0x9, 0x100, 0x6, 0x3}, &(0x7f0000000340)=0x14) getsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f00000004c0)={r3, 0x200000}, &(0x7f0000000500)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000400)={0x0, @in={{0x2, 0x4e20, @multicast2}}, 0x4, 0x1}, &(0x7f0000000380)=0x90) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000140)={r4, @in={{0x2, 0x4e21, @multicast1}}}, &(0x7f0000000040)=0xfffffffffffffc35) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000200)={r5, 0xbe8, 0x20}, &(0x7f0000000240)=0xc) openat$tun(0xffffffffffffff9c, &(0x7f0000000540)='/dev/net/tun\x00', 0x80000, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x600000000) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r1, 0x408c5333, &(0x7f0000000280)={0x9b, 0x5, 0x9, 'queue0\x00', 0x800}) 04:30:18 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x0, 0x73) 04:30:18 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r2, &(0x7f0000011fd2), 0xffffffee) read(0xffffffffffffffff, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:18 executing program 0: socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) [ 550.155490] binder: 23030 RLIMIT_NICE not set [ 550.218033] binder: 23029:23039 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:18 executing program 1: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:18 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x0, 0x73) 04:30:18 executing program 0: socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x0, 0x73) [ 550.502308] protocol 88fb is buggy, dev hsr_slave_0 [ 550.507929] protocol 88fb is buggy, dev hsr_slave_1 [ 550.512119] protocol 88fb is buggy, dev hsr_slave_0 [ 550.513614] protocol 88fb is buggy, dev hsr_slave_0 [ 550.518422] protocol 88fb is buggy, dev hsr_slave_1 [ 550.524651] protocol 88fb is buggy, dev hsr_slave_1 04:30:18 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x0, 0x73) 04:30:18 executing program 0: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:19 executing program 3: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffc) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:19 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r2, &(0x7f0000011fd2), 0xffffffee) read(0xffffffffffffffff, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:19 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) sched_setscheduler(r2, 0x3, &(0x7f0000000040)=0x5) epoll_create(0x4) syz_open_pts(r1, 0x260400) 04:30:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) [ 551.289513] binder: 23090 RLIMIT_NICE not set [ 551.358717] binder: 23089:23093 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:19 executing program 1: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:20 executing program 0: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:20 executing program 3: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffc) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:20 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:20 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$KVM_IOEVENTFD(r1, 0xc0386106, &(0x7f00000000c0)={0x0, 0x0}) r2 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) fcntl$setown(r0, 0x8, r2) tkill(r2, 0x15) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$KVM_GET_MSRS(r1, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="06000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000714d5c99e222f69f00000000000000000000000000"]) [ 552.337302] binder: 23118 RLIMIT_NICE not set [ 552.384794] binder: 23116:23121 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:20 executing program 1: r0 = socket$kcm(0xa, 0x20000000000003, 0x11) recvmsg(r0, &(0x7f0000001480)={&(0x7f0000000200)=@nfc_llcp, 0x80, &(0x7f0000000580), 0x0, &(0x7f0000000000)=""/207, 0xcf}, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffc) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r4, &(0x7f0000011fd2), 0xffffffee) read(r3, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(r0, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:21 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:21 executing program 2: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r0, 0x40000000af01, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x20300, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r0, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) r2 = getpid() process_vm_writev(r2, &(0x7f0000000580)=[{&(0x7f00000001c0)=""/203, 0xcb}, {&(0x7f00000016c0)=""/4096, 0x1000}, {&(0x7f00000026c0)=""/4096, 0x1000}, {&(0x7f00000002c0)=""/117, 0x75}, {&(0x7f0000000400)=""/250, 0xfa}, {&(0x7f0000000340)=""/83, 0x53}, {&(0x7f0000000500)=""/111, 0x6f}], 0x7, &(0x7f00000059c0)=[{&(0x7f00000036c0)=""/4096, 0x1000}, {&(0x7f0000000600)=""/154, 0x9a}, {&(0x7f00000046c0)=""/4096, 0x1000}, {&(0x7f00000056c0)=""/182, 0xb6}, {&(0x7f0000005780)}, {&(0x7f00000057c0)=""/116, 0x74}, {&(0x7f0000005840)=""/122, 0x7a}, {&(0x7f00000058c0)=""/158, 0x9e}, {&(0x7f0000005980)=""/38, 0x26}], 0x9, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0)='/dev/input/mouse#\x00', 0x9, 0x604102) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) gettid() ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) ioctl$VIDIOC_S_INPUT(r1, 0xc0045627, &(0x7f0000005780)) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000005ac0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000005a80)={0xffffffffffffffff}, 0x106, 0x100a}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r3, &(0x7f0000005b00)={0x4, 0x8, 0xfa00, {r4, 0xffffffff}}, 0x10) 04:30:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:21 executing program 0: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:21 executing program 3: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffc) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) [ 553.362223] binder: 23140 RLIMIT_NICE not set 04:30:21 executing program 2: r0 = socket$kcm(0xa, 0x20000000000003, 0x11) recvmsg(r0, &(0x7f0000001480)={&(0x7f0000000200)=@nfc_llcp, 0x80, &(0x7f0000000580), 0x0, &(0x7f0000000000)=""/207, 0xcf}, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x404000, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r1, 0x84, 0x1c, &(0x7f00000003c0), &(0x7f0000000340)=0x3267d8a06e258185) mkdir(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffc) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r5, &(0x7f0000011fd2), 0xffffffee) read(r4, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(r0, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) [ 553.408758] binder: 23136:23144 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:21 executing program 1: r0 = socket$kcm(0xa, 0x20000000000003, 0x11) recvmsg(r0, &(0x7f0000001480)={&(0x7f0000000200)=@nfc_llcp, 0x80, &(0x7f0000000580), 0x0, &(0x7f0000000000)=""/207, 0xcf}, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffc) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r4, &(0x7f0000011fd2), 0xffffffee) read(r3, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(r0, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:22 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) [ 554.535473] binder: 23172 RLIMIT_NICE not set 04:30:22 executing program 3: r0 = socket$kcm(0xa, 0x20000000000003, 0x11) recvmsg(r0, &(0x7f0000001480)={&(0x7f0000000200)=@nfc_llcp, 0x80, &(0x7f0000000580), 0x0, &(0x7f0000000000)=""/207, 0xcf}, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x404000, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r1, 0x84, 0x1c, &(0x7f00000003c0), &(0x7f0000000340)=0x3267d8a06e258185) mkdir(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffc) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) ioctl$VHOST_SET_OWNER(r2, 0xaf01, 0x0) openat$cgroup_procs(r2, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000300), &(0x7f0000000400)=0x8) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r4, &(0x7f0000011fd2), 0xffffffee) read(r3, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(r0, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:22 executing program 0: r0 = socket$kcm(0xa, 0x20000000000003, 0x11) recvmsg(r0, &(0x7f0000001480)={&(0x7f0000000200)=@nfc_llcp, 0x80, &(0x7f0000000580), 0x0, &(0x7f0000000000)=""/207, 0xcf}, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x404000, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r1, 0x84, 0x1c, &(0x7f00000003c0), &(0x7f0000000340)=0x3267d8a06e258185) mkdir(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffc) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) ioctl$VHOST_SET_OWNER(r2, 0xaf01, 0x0) openat$cgroup_procs(r2, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000300), &(0x7f0000000400)=0x8) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r4, &(0x7f0000011fd2), 0xffffffee) read(r3, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(r0, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) [ 554.577554] binder: 23171:23173 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:22 executing program 2: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r0, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r1) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) sysinfo(&(0x7f00000001c0)=""/111) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) gettid() ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) fcntl$getown(r2, 0x9) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:22 executing program 1: r0 = socket$kcm(0xa, 0x20000000000003, 0x11) recvmsg(r0, &(0x7f0000001480)={&(0x7f0000000200)=@nfc_llcp, 0x80, &(0x7f0000000580), 0x0, &(0x7f0000000000)=""/207, 0xcf}, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffc) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r4, &(0x7f0000011fd2), 0xffffffee) read(r3, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(r0, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:23 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0xfcb) socket(0x0, 0xfffffffffffffffd, 0x0) 04:30:23 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:30:23 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0xfcb) socket(0x0, 0xfffffffffffffffd, 0x0) 04:30:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) [ 555.518597] binder: 23210:23211 ioctl c0306201 0 returned -14 04:30:23 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0xfcb) socket(0x0, 0xfffffffffffffffd, 0x0) [ 555.559311] binder: 23211 RLIMIT_NICE not set [ 555.606485] binder: 23210:23212 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:23 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0xfcb) 04:30:23 executing program 0: r0 = socket$kcm(0xa, 0x20000000000003, 0x11) recvmsg(r0, &(0x7f0000001480)={&(0x7f0000000200)=@nfc_llcp, 0x80, &(0x7f0000000580), 0x0, &(0x7f0000000000)=""/207, 0xcf}, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x404000, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r1, 0x84, 0x1c, &(0x7f00000003c0), &(0x7f0000000340)=0x3267d8a06e258185) mkdir(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffc) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) ioctl$VHOST_SET_OWNER(r2, 0xaf01, 0x0) openat$cgroup_procs(r2, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000300), &(0x7f0000000400)=0x8) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r4, &(0x7f0000011fd2), 0xffffffee) read(r3, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(r0, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:24 executing program 3: r0 = socket$kcm(0xa, 0x20000000000003, 0x11) recvmsg(r0, &(0x7f0000001480)={&(0x7f0000000200)=@nfc_llcp, 0x80, &(0x7f0000000580), 0x0, &(0x7f0000000000)=""/207, 0xcf}, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x404000, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r1, 0x84, 0x1c, &(0x7f00000003c0), &(0x7f0000000340)=0x3267d8a06e258185) mkdir(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffc) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) ioctl$VHOST_SET_OWNER(r2, 0xaf01, 0x0) openat$cgroup_procs(r2, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000300), &(0x7f0000000400)=0x8) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r4, &(0x7f0000011fd2), 0xffffffee) read(r3, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(r0, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:24 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) gettid() ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:24 executing program 5: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:30:24 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ftruncate(r0, 0xfcb) [ 556.102182] net_ratelimit: 26 callbacks suppressed [ 556.102199] protocol 88fb is buggy, dev hsr_slave_0 [ 556.112904] protocol 88fb is buggy, dev hsr_slave_1 [ 556.118519] protocol 88fb is buggy, dev hsr_slave_0 [ 556.124121] protocol 88fb is buggy, dev hsr_slave_1 04:30:24 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ftruncate(r0, 0xfcb) 04:30:24 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) gettid() ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:24 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) gettid() ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:24 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ftruncate(r0, 0xfcb) [ 556.574871] binder: 23253:23254 ioctl c0306201 0 returned -14 [ 556.606607] binder: 23254 RLIMIT_NICE not set [ 556.684337] binder: 23253:23261 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:24 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) gettid() ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) [ 556.742323] protocol 88fb is buggy, dev hsr_slave_0 [ 556.743067] protocol 88fb is buggy, dev hsr_slave_1 [ 556.747874] protocol 88fb is buggy, dev hsr_slave_1 [ 556.758313] protocol 88fb is buggy, dev hsr_slave_0 [ 556.765032] protocol 88fb is buggy, dev hsr_slave_1 [ 556.771934] protocol 88fb is buggy, dev hsr_slave_0 04:30:24 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ftruncate(0xffffffffffffffff, 0xfcb) 04:30:25 executing program 0: r0 = socket$kcm(0xa, 0x20000000000003, 0x11) recvmsg(r0, &(0x7f0000001480)={&(0x7f0000000200)=@nfc_llcp, 0x80, &(0x7f0000000580), 0x0, &(0x7f0000000000)=""/207, 0xcf}, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x404000, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r1, 0x84, 0x1c, &(0x7f00000003c0), &(0x7f0000000340)=0x3267d8a06e258185) mkdir(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffc) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) ioctl$VHOST_SET_OWNER(r2, 0xaf01, 0x0) openat$cgroup_procs(r2, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000300), &(0x7f0000000400)=0x8) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r4, &(0x7f0000011fd2), 0xffffffee) read(r3, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(r0, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:25 executing program 3: r0 = socket$kcm(0xa, 0x20000000000003, 0x11) recvmsg(r0, &(0x7f0000001480)={&(0x7f0000000200)=@nfc_llcp, 0x80, &(0x7f0000000580), 0x0, &(0x7f0000000000)=""/207, 0xcf}, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x404000, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r1, 0x84, 0x1c, &(0x7f00000003c0), &(0x7f0000000340)=0x3267d8a06e258185) mkdir(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffc) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) ioctl$VHOST_SET_OWNER(r2, 0xaf01, 0x0) openat$cgroup_procs(r2, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000300), &(0x7f0000000400)=0x8) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r4, &(0x7f0000011fd2), 0xffffffee) read(r3, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(r0, &(0x7f0000001440)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000001740)}, 0x0) 04:30:25 executing program 5: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) gettid() ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:25 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ftruncate(0xffffffffffffffff, 0xfcb) 04:30:25 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) gettid() ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:25 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ftruncate(0xffffffffffffffff, 0xfcb) 04:30:25 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:25 executing program 5: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) gettid() ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:25 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:25 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0xfcb) [ 557.572155] binder: 23310:23314 ioctl c0306201 0 returned -14 [ 557.604091] binder: 23314 RLIMIT_NICE not set 04:30:25 executing program 5: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) gettid() ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 557.650729] binder: 23310:23321 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:26 executing program 0 (fault-call:8 fault-nth:0): openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:30:26 executing program 3 (fault-call:3 fault-nth:0): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:26 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0xfcb) 04:30:26 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:26 executing program 5: r0 = socket$kcm(0xa, 0x20000000000003, 0x11) recvmsg(r0, &(0x7f0000001480)={&(0x7f0000000200)=@nfc_llcp, 0x80, &(0x7f0000000580), 0x0, &(0x7f0000000000)=""/207, 0xcf}, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x404000, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r1, 0x84, 0x1c, &(0x7f00000003c0), &(0x7f0000000340)=0x3267d8a06e258185) mkdir(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffc) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) ioctl$VHOST_SET_OWNER(r2, 0xaf01, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000300), &(0x7f0000000400)=0x8) write$cgroup_pid(r3, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r5, &(0x7f0000011fd2), 0xffffffee) read(r4, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(r0, &(0x7f0000000e80)={&(0x7f0000000180)=@un=@abs, 0x80, &(0x7f00000024c0), 0x0, &(0x7f0000002540)}, 0x0) recvmsg$kcm(r0, &(0x7f00000006c0)={&(0x7f0000000580)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f0000000600), 0x0, &(0x7f0000000640)=""/109, 0x6d}, 0x0) 04:30:26 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0xfcb) 04:30:26 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 558.379629] FAULT_INJECTION: forcing a failure. [ 558.379629] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 558.391831] CPU: 0 PID: 23352 Comm: syz-executor0 Not tainted 4.20.0-rc7+ #2 [ 558.399060] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 558.401632] Call Trace: [ 558.401632] dump_stack+0x173/0x1d0 [ 558.401632] should_fail+0xa19/0xb20 [ 558.401632] __alloc_pages_nodemask+0x7b0/0x5f20 [ 558.401632] ? __kernel_text_address+0x250/0x350 [ 558.401632] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 558.401632] ? __save_stack_trace+0x99e/0xb90 [ 558.401632] ? entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 558.401632] ? alloc_pages_vma+0x108/0x1970 [ 558.401632] alloc_pages_vma+0xd26/0x1970 [ 558.401632] handle_mm_fault+0x5593/0x9ef0 [ 558.454762] __do_page_fault+0xf26/0x1a60 [ 558.454762] do_page_fault+0xe9/0x5c0 [ 558.454762] ? kmsan_unpoison_pt_regs+0x13/0x20 [ 558.454762] ? page_fault+0x2b/0x50 [ 558.454762] page_fault+0x3d/0x50 [ 558.475117] RIP: 0010:copy_user_enhanced_fast_string+0xe/0x20 [ 558.475117] Code: 89 d1 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 31 c0 0f 1f 00 c3 0f 1f 80 00 00 00 00 0f 1f 00 83 fa 40 0f 82 70 ff ff ff 89 d1 a4 31 c0 0f 1f 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 83 [ 558.499218] RSP: 0018:ffff8881ea31f978 EFLAGS: 00010206 [ 558.499218] RAX: ffffffff847eedec RBX: ffff888096caa788 RCX: 0000000000001000 [ 558.510761] RDX: 0000000000001000 RSI: ffff8881f128e000 RDI: 0000000020001000 [ 558.519510] RBP: ffff8881ea31f9e8 R08: 0000000000000000 R09: 0000000000000000 [ 558.519510] R10: 0000000000000000 R11: ffffffff820bd850 R12: 0000000000001000 [ 558.529697] R13: ffff8881f128e000 R14: ffff8881ea31f980 R15: 0000000020001000 [ 558.529697] ? generic_pipe_buf_get+0x110/0x110 [ 558.529697] ? copyout+0xcc/0x1f0 [ 558.529697] ? copyout+0x113/0x1f0 [ 558.529697] copy_page_to_iter+0x654/0x17e0 [ 558.529697] pipe_read+0x4dc/0x1290 [ 558.529697] ? __ia32_sys_pipe+0x90/0x90 [ 558.565190] __vfs_read+0x874/0xaf0 [ 558.565190] vfs_read+0x35f/0x6b0 [ 558.565190] __se_sys_read+0x17a/0x370 [ 558.565190] __x64_sys_read+0x4a/0x70 [ 558.565190] do_syscall_64+0xbc/0xf0 [ 558.565190] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 558.565190] RIP: 0033:0x457ec9 [ 558.565190] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 558.602537] binder: 23367 RLIMIT_NICE not set [ 558.565190] RSP: 002b:00007f4d8e500c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 04:30:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:26 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0xfcb) [ 558.565190] RAX: ffffffffffffffda RBX: 00007f4d8e500c90 RCX: 0000000000457ec9 [ 558.565190] RDX: 00000000fffffd6d RSI: 0000000020000000 RDI: 0000000000000005 [ 558.565190] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 558.565190] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f4d8e5016d4 [ 558.565190] R13: 00000000004c37c0 R14: 00000000004d7c18 R15: 0000000000000007 [ 558.676763] FAULT_INJECTION: forcing a failure. [ 558.676763] name failslab, interval 1, probability 0, space 0, times 0 [ 558.688270] CPU: 1 PID: 23358 Comm: syz-executor3 Not tainted 4.20.0-rc7+ #2 [ 558.695490] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 558.698121] Call Trace: [ 558.698121] dump_stack+0x173/0x1d0 [ 558.698121] ? __should_failslab+0x278/0x2a0 [ 558.713226] should_fail+0xa19/0xb20 [ 558.713226] __should_failslab+0x278/0x2a0 [ 558.713226] should_failslab+0x29/0x70 04:30:26 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 558.713226] kmem_cache_alloc+0xf9/0xb90 [ 558.713226] ? sock_alloc_inode+0x61/0x330 [ 558.713226] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 558.713226] ? sockfs_mount+0xa0/0xa0 [ 558.713226] sock_alloc_inode+0x61/0x330 [ 558.713226] ? sockfs_mount+0xa0/0xa0 [ 558.751856] new_inode_pseudo+0x95/0x460 [ 558.753831] __sock_create+0x2fa/0xf30 [ 558.753831] ? __sys_socket+0x70/0x640 [ 558.753831] __sys_socket+0x174/0x640 [ 558.753831] __se_sys_socket+0x8d/0xb0 [ 558.753831] __x64_sys_socket+0x4a/0x70 [ 558.753831] do_syscall_64+0xbc/0xf0 [ 558.753831] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 558.753831] RIP: 0033:0x457ec9 [ 558.753831] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 558.790329] RSP: 002b:00007fb71a11bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 558.790329] RAX: ffffffffffffffda RBX: 00007fb71a11bc90 RCX: 0000000000457ec9 [ 558.823154] RDX: 0000000000000073 RSI: 0000000000000002 RDI: 0000000000000002 04:30:26 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0xfcb) [ 558.827895] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 558.832102] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb71a11c6d4 [ 558.840324] R13: 00000000004c605e R14: 00000000004dad38 R15: 0000000000000005 04:30:26 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:27 executing program 0: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_ADD_CTX(r3, 0xc0086420, &(0x7f0000000080)={0x0}) ioctl$DRM_IOCTL_GET_CTX(r2, 0xc0086423, &(0x7f00000000c0)={r4}) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:30:27 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0xfcb) 04:30:27 executing program 3 (fault-call:3 fault-nth:1): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:27 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:27 executing program 5: r0 = socket$kcm(0xa, 0x20000000000003, 0x11) recvmsg(r0, &(0x7f0000001480)={&(0x7f0000000200)=@nfc_llcp, 0x80, &(0x7f0000000580), 0x0, &(0x7f0000000000)=""/207, 0xcf}, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x404000, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r1, 0x84, 0x1c, &(0x7f00000003c0), &(0x7f0000000340)=0x3267d8a06e258185) mkdir(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffc) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) ioctl$VHOST_SET_OWNER(r2, 0xaf01, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000300), &(0x7f0000000400)=0x8) write$cgroup_pid(r3, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r5, &(0x7f0000011fd2), 0xffffffee) read(r4, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(r0, &(0x7f0000000e80)={&(0x7f0000000180)=@un=@abs, 0x80, &(0x7f00000024c0), 0x0, &(0x7f0000002540)}, 0x0) recvmsg$kcm(r0, &(0x7f00000006c0)={&(0x7f0000000580)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f0000000600), 0x0, &(0x7f0000000640)=""/109, 0x6d}, 0x0) [ 559.276159] FAULT_INJECTION: forcing a failure. [ 559.276159] name failslab, interval 1, probability 0, space 0, times 0 [ 559.287692] CPU: 1 PID: 23402 Comm: syz-executor3 Not tainted 4.20.0-rc7+ #2 [ 559.294920] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 559.297468] Call Trace: [ 559.297468] dump_stack+0x173/0x1d0 [ 559.297468] should_fail+0xa19/0xb20 [ 559.297468] __should_failslab+0x278/0x2a0 [ 559.297468] should_failslab+0x29/0x70 04:30:27 executing program 2: perf_event_open(&(0x7f0000000080)={0x0, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0xfcb) [ 559.297468] kmem_cache_alloc_trace+0x125/0xb90 [ 559.297468] ? kmem_cache_alloc+0x572/0xb90 [ 559.297468] ? sock_alloc_inode+0x101/0x330 [ 559.297468] sock_alloc_inode+0x101/0x330 [ 559.297468] ? sockfs_mount+0xa0/0xa0 [ 559.297468] new_inode_pseudo+0x95/0x460 [ 559.297468] __sock_create+0x2fa/0xf30 [ 559.349817] ? __sys_socket+0x70/0x640 [ 559.354621] __sys_socket+0x174/0x640 [ 559.354621] __se_sys_socket+0x8d/0xb0 [ 559.354621] __x64_sys_socket+0x4a/0x70 [ 559.366951] do_syscall_64+0xbc/0xf0 [ 559.366951] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 559.366951] RIP: 0033:0x457ec9 [ 559.366951] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 559.381275] RSP: 002b:00007fb71a11bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 559.381275] RAX: ffffffffffffffda RBX: 00007fb71a11bc90 RCX: 0000000000457ec9 [ 559.381275] RDX: 0000000000000073 RSI: 0000000000000002 RDI: 0000000000000002 [ 559.418477] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 559.418477] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb71a11c6d4 [ 559.418477] R13: 00000000004c605e R14: 00000000004dad38 R15: 0000000000000005 04:30:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:27 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 559.679251] binder: 23420 RLIMIT_NICE not set 04:30:27 executing program 2: perf_event_open(&(0x7f0000000080)={0x0, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0xfcb) [ 559.729380] binder: 23419:23422 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:28 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(0xffffffffffffffff) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:28 executing program 3 (fault-call:3 fault-nth:2): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:28 executing program 2: perf_event_open(&(0x7f0000000080)={0x0, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0xfcb) [ 560.260797] FAULT_INJECTION: forcing a failure. [ 560.260797] name failslab, interval 1, probability 0, space 0, times 0 [ 560.278078] CPU: 1 PID: 23441 Comm: syz-executor3 Not tainted 4.20.0-rc7+ #2 [ 560.282105] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 560.282105] Call Trace: [ 560.282105] dump_stack+0x173/0x1d0 [ 560.282105] ? __should_failslab+0x278/0x2a0 [ 560.282105] should_fail+0xa19/0xb20 [ 560.282105] __should_failslab+0x278/0x2a0 [ 560.282105] should_failslab+0x29/0x70 [ 560.315818] kmem_cache_alloc+0xf9/0xb90 [ 560.315818] ? sk_prot_alloc+0xf1/0x500 [ 560.315818] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 560.315818] ? __msan_poison_alloca+0x1f0/0x2a0 [ 560.315818] sk_prot_alloc+0xf1/0x500 [ 560.315818] sk_alloc+0xde/0xb90 [ 560.315818] inet_create+0x76f/0x1320 [ 560.315818] ? ipip_gro_complete+0x7e0/0x7e0 [ 560.315818] __sock_create+0x65f/0xf30 [ 560.315818] __sys_socket+0x174/0x640 [ 560.315818] __se_sys_socket+0x8d/0xb0 [ 560.315818] __x64_sys_socket+0x4a/0x70 [ 560.315818] do_syscall_64+0xbc/0xf0 [ 560.315818] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 560.315818] RIP: 0033:0x457ec9 [ 560.315818] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 560.398188] RSP: 002b:00007fb71a11bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 04:30:28 executing program 0: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f00000003c0)) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000080)={0x0, 0xab, "fda15ae36e38430d2fe6b362cd0d624fbb888fd9657bd9e8661f515f737bc0e299cd4b40d713dfa361b1035a2d3c551c114e9cccfd3e070fc7edf98dcdbe550506c7b8663b489ed21209c3dd5f10c2209e988c98dd0d386887383de0533a29235314cd70eccb7d2933c6343d9bc95f643cc68620dd832df328e25f8658711355bc8973f221e225bc25f084c9392dea337e66569e803a568f5935b45552444e047e69b3e1efc31d2550ed33"}, &(0x7f0000000240)=0xb3) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000280)=ANY=[@ANYRES32=r2, @ANYBLOB="b50000006c33a742ee7f5bb8b52fdc052bdfebf31b854655e205ef00a93501d329c797574088135cea243d1f09a0a9655dcfb18a7cb1270b6b8de8b0d59168ca6869d5242b8292a55ee933364e52dd1b0e5147ee66b321081654f1006954762e101e39c0f7b007e98600195357dbbbf7ca922e35284566a07c68dc50aff134634e4a666c885ba0e19d870c7ece26aa790ab82f09e648c6a6cc8d44a29f53acb107c0428e9dfd2d4819ddab9a26abc4d3065362b5f0ad5f05dc"], &(0x7f0000000340)=0xbd) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r4, &(0x7f0000011fd2), 0xffffffee) read(r3, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:30:28 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(0xffffffffffffffff) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:28 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0xfcb) 04:30:28 executing program 5: r0 = socket$kcm(0xa, 0x20000000000003, 0x11) recvmsg(r0, &(0x7f0000001480)={&(0x7f0000000200)=@nfc_llcp, 0x80, &(0x7f0000000580), 0x0, &(0x7f0000000000)=""/207, 0xcf}, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x404000, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r1, 0x84, 0x1c, &(0x7f00000003c0), &(0x7f0000000340)=0x3267d8a06e258185) mkdir(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffc) mount(&(0x7f00000007c0)=ANY=[], &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) ioctl$VHOST_SET_OWNER(r2, 0xaf01, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000300), &(0x7f0000000400)=0x8) write$cgroup_pid(r3, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r5, &(0x7f0000011fd2), 0xffffffee) read(r4, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(r0, &(0x7f0000000e80)={&(0x7f0000000180)=@un=@abs, 0x80, &(0x7f00000024c0), 0x0, &(0x7f0000002540)}, 0x0) recvmsg$kcm(r0, &(0x7f00000006c0)={&(0x7f0000000580)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f0000000600), 0x0, &(0x7f0000000640)=""/109, 0x6d}, 0x0) 04:30:28 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0xfcb) [ 560.399530] RAX: ffffffffffffffda RBX: 00007fb71a11bc90 RCX: 0000000000457ec9 [ 560.407805] RDX: 0000000000000073 RSI: 0000000000000002 RDI: 0000000000000002 [ 560.407805] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 560.407805] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb71a11c6d4 [ 560.430060] R13: 00000000004c605e R14: 00000000004dad38 R15: 0000000000000005 04:30:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:28 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0xfcb) 04:30:28 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(0xffffffffffffffff) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 560.653859] binder: 23463 RLIMIT_NICE not set [ 560.702511] binder: 23461:23471 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:28 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0xfcb) 04:30:28 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:29 executing program 3 (fault-call:3 fault-nth:3): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:29 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0xfcb) [ 561.275231] FAULT_INJECTION: forcing a failure. [ 561.275231] name failslab, interval 1, probability 0, space 0, times 0 [ 561.286762] CPU: 0 PID: 23493 Comm: syz-executor3 Not tainted 4.20.0-rc7+ #2 [ 561.294011] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 561.301707] Call Trace: [ 561.301707] dump_stack+0x173/0x1d0 [ 561.301707] should_fail+0xa19/0xb20 [ 561.301707] __should_failslab+0x278/0x2a0 [ 561.317002] should_failslab+0x29/0x70 [ 561.317002] kmem_cache_alloc_trace+0x125/0xb90 [ 561.317002] ? memcg_kmem_put_cache+0x49/0x2d0 [ 561.317002] ? apparmor_sk_alloc_security+0xe4/0x1e0 [ 561.317002] apparmor_sk_alloc_security+0xe4/0x1e0 [ 561.317002] ? apparmor_setprocattr+0x13a0/0x13a0 [ 561.317002] security_sk_alloc+0x125/0x1f0 [ 561.317002] sk_prot_alloc+0x269/0x500 [ 561.317002] sk_alloc+0xde/0xb90 [ 561.317002] inet_create+0x76f/0x1320 [ 561.317002] ? ipip_gro_complete+0x7e0/0x7e0 [ 561.317002] __sock_create+0x65f/0xf30 [ 561.317002] __sys_socket+0x174/0x640 [ 561.317002] __se_sys_socket+0x8d/0xb0 [ 561.317002] __x64_sys_socket+0x4a/0x70 [ 561.317002] do_syscall_64+0xbc/0xf0 [ 561.317002] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 561.317002] RIP: 0033:0x457ec9 [ 561.317002] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 561.317002] RSP: 002b:00007fb71a11bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 561.317002] RAX: ffffffffffffffda RBX: 00007fb71a11bc90 RCX: 0000000000457ec9 [ 561.317002] RDX: 0000000000000073 RSI: 0000000000000002 RDI: 0000000000000002 [ 561.317002] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 561.317002] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb71a11c6d4 [ 561.317002] R13: 00000000004c605e R14: 00000000004dad38 R15: 0000000000000005 04:30:29 executing program 0: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0xfffffffffffffffc) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:30:29 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:29 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0xfcb) 04:30:29 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:29 executing program 5 (fault-call:1 fault-nth:0): socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:29 executing program 3 (fault-call:3 fault-nth:4): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:29 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 561.640092] binder: 23502 RLIMIT_NICE not set [ 561.687455] binder: 23498:23515 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 561.710558] FAULT_INJECTION: forcing a failure. [ 561.710558] name failslab, interval 1, probability 0, space 0, times 0 [ 561.722166] CPU: 0 PID: 23514 Comm: syz-executor5 Not tainted 4.20.0-rc7+ #2 [ 561.729379] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 561.735989] Call Trace: [ 561.735989] dump_stack+0x173/0x1d0 [ 561.735989] ? __should_failslab+0x278/0x2a0 [ 561.735989] should_fail+0xa19/0xb20 [ 561.735989] __should_failslab+0x278/0x2a0 [ 561.735989] should_failslab+0x29/0x70 [ 561.735989] kmem_cache_alloc+0xf9/0xb90 [ 561.764524] ? sock_alloc_inode+0x61/0x330 [ 561.764524] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 561.764524] ? sockfs_mount+0xa0/0xa0 [ 561.764524] sock_alloc_inode+0x61/0x330 [ 561.764524] ? sockfs_mount+0xa0/0xa0 [ 561.764524] new_inode_pseudo+0x95/0x460 [ 561.764524] __sock_create+0x2fa/0xf30 [ 561.764524] ? __sys_socket+0x70/0x640 [ 561.764524] __sys_socket+0x174/0x640 [ 561.764524] __se_sys_socket+0x8d/0xb0 [ 561.764524] __x64_sys_socket+0x4a/0x70 [ 561.764524] do_syscall_64+0xbc/0xf0 [ 561.764524] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 561.764524] RIP: 0033:0x457ec9 [ 561.823038] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 561.832971] FAULT_INJECTION: forcing a failure. [ 561.832971] name failslab, interval 1, probability 0, space 0, times 0 [ 561.823038] RSP: 002b:00007f2109b59c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 561.823038] RAX: ffffffffffffffda RBX: 00007f2109b59c90 RCX: 0000000000457ec9 [ 561.823038] RDX: 0000000000000073 RSI: 0000000000000002 RDI: 0000000000000002 [ 561.823038] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 561.823038] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f2109b5a6d4 [ 561.861602] R13: 00000000004c605e R14: 00000000004dad38 R15: 0000000000000004 [ 561.898173] CPU: 1 PID: 23519 Comm: syz-executor3 Not tainted 4.20.0-rc7+ #2 [ 561.898325] net_ratelimit: 27 callbacks suppressed [ 561.898333] socket: no more sockets [ 561.901586] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 561.901586] Call Trace: [ 561.901586] dump_stack+0x173/0x1d0 [ 561.901586] should_fail+0xa19/0xb20 [ 561.911279] __should_failslab+0x278/0x2a0 04:30:29 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0xfcb) 04:30:30 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000380), 0x12) statx(r0, &(0x7f0000000080)='./file0\x00', 0x1000, 0x42, &(0x7f0000000240)) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r4, &(0x7f0000011fd2), 0xffffffee) read(r3, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, 0x0, 0x0) [ 561.911279] should_failslab+0x29/0x70 [ 561.911279] kmem_cache_alloc+0xf9/0xb90 [ 561.911279] ? __d_alloc+0x98/0xc30 [ 561.946941] ? __msan_poison_alloca+0x1f0/0x2a0 [ 561.950405] __d_alloc+0x98/0xc30 [ 561.950405] ? __msan_poison_alloca+0x1f0/0x2a0 [ 561.950405] d_alloc_pseudo+0x68/0x80 [ 561.950405] alloc_file_pseudo+0x19f/0x4e0 [ 561.950405] sock_alloc_file+0x1b2/0x5f0 [ 561.971819] __sys_socket+0x252/0x640 [ 561.971819] __se_sys_socket+0x8d/0xb0 [ 561.971819] __x64_sys_socket+0x4a/0x70 [ 561.984896] do_syscall_64+0xbc/0xf0 [ 561.984896] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 561.984896] RIP: 0033:0x457ec9 [ 561.996954] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 562.013814] RSP: 002b:00007fb71a11bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 562.013814] RAX: ffffffffffffffda RBX: 00007fb71a11bc90 RCX: 0000000000457ec9 04:30:30 executing program 5 (fault-call:1 fault-nth:1): socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) [ 562.013814] RDX: 0000000000000073 RSI: 0000000000000002 RDI: 0000000000000002 [ 562.039970] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 562.039970] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb71a11c6d4 [ 562.054115] R13: 00000000004c605e R14: 00000000004dad38 R15: 0000000000000005 [ 562.136952] FAULT_INJECTION: forcing a failure. [ 562.136952] name failslab, interval 1, probability 0, space 0, times 0 [ 562.148598] CPU: 0 PID: 23531 Comm: syz-executor5 Not tainted 4.20.0-rc7+ #2 [ 562.155858] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 562.159710] Call Trace: [ 562.159710] dump_stack+0x173/0x1d0 [ 562.171217] should_fail+0xa19/0xb20 [ 562.171217] __should_failslab+0x278/0x2a0 [ 562.171217] should_failslab+0x29/0x70 [ 562.171217] kmem_cache_alloc_trace+0x125/0xb90 [ 562.188044] ? kmem_cache_alloc+0x572/0xb90 [ 562.188044] ? sock_alloc_inode+0x101/0x330 [ 562.188044] sock_alloc_inode+0x101/0x330 [ 562.188044] ? sockfs_mount+0xa0/0xa0 [ 562.188044] new_inode_pseudo+0x95/0x460 [ 562.188044] __sock_create+0x2fa/0xf30 [ 562.188044] ? __sys_socket+0x70/0x640 [ 562.188044] __sys_socket+0x174/0x640 [ 562.188044] __se_sys_socket+0x8d/0xb0 [ 562.188044] __x64_sys_socket+0x4a/0x70 [ 562.188044] do_syscall_64+0xbc/0xf0 [ 562.188044] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 562.188044] RIP: 0033:0x457ec9 [ 562.188044] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 562.188044] RSP: 002b:00007f2109b59c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 562.188044] RAX: ffffffffffffffda RBX: 00007f2109b59c90 RCX: 0000000000457ec9 [ 562.188044] RDX: 0000000000000073 RSI: 0000000000000002 RDI: 0000000000000002 04:30:30 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0xfcb) [ 562.188044] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 562.188044] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f2109b5a6d4 [ 562.188044] R13: 00000000004c605e R14: 00000000004dad38 R15: 0000000000000004 [ 562.305068] socket: no more sockets 04:30:30 executing program 3 (fault-call:3 fault-nth:5): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) [ 562.342189] protocol 88fb is buggy, dev hsr_slave_0 [ 562.348914] protocol 88fb is buggy, dev hsr_slave_1 [ 562.355675] protocol 88fb is buggy, dev hsr_slave_0 [ 562.361474] protocol 88fb is buggy, dev hsr_slave_1 04:30:30 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:30 executing program 5 (fault-call:1 fault-nth:2): socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:30 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0xfcb) 04:30:30 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) [ 562.534744] FAULT_INJECTION: forcing a failure. [ 562.534744] name failslab, interval 1, probability 0, space 0, times 0 [ 562.546268] CPU: 0 PID: 23548 Comm: syz-executor3 Not tainted 4.20.0-rc7+ #2 [ 562.553502] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 562.556035] Call Trace: [ 562.556035] dump_stack+0x173/0x1d0 [ 562.556035] ? __should_failslab+0x278/0x2a0 [ 562.570387] FAULT_INJECTION: forcing a failure. [ 562.570387] name failslab, interval 1, probability 0, space 0, times 0 [ 562.556035] should_fail+0xa19/0xb20 [ 562.556035] __should_failslab+0x278/0x2a0 [ 562.556035] should_failslab+0x29/0x70 [ 562.556035] kmem_cache_alloc+0xf9/0xb90 [ 562.556035] ? __alloc_file+0xa3/0x6c0 [ 562.556035] __alloc_file+0xa3/0x6c0 [ 562.556035] alloc_empty_file+0x1f5/0x4b0 [ 562.556035] alloc_file+0xa5/0x7b0 [ 562.556035] ? __msan_metadata_ptr_for_store_1+0x13/0x20 [ 562.556035] alloc_file_pseudo+0x3ff/0x4e0 [ 562.556035] sock_alloc_file+0x1b2/0x5f0 [ 562.556035] __sys_socket+0x252/0x640 [ 562.556035] __se_sys_socket+0x8d/0xb0 [ 562.556035] __x64_sys_socket+0x4a/0x70 [ 562.556035] do_syscall_64+0xbc/0xf0 [ 562.556035] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 562.556035] RIP: 0033:0x457ec9 [ 562.556035] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 562.556035] RSP: 002b:00007fb71a11bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 562.556035] RAX: ffffffffffffffda RBX: 00007fb71a11bc90 RCX: 0000000000457ec9 [ 562.556035] RDX: 0000000000000073 RSI: 0000000000000002 RDI: 0000000000000002 [ 562.556035] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 562.556035] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb71a11c6d4 [ 562.556035] R13: 00000000004c605e R14: 00000000004dad38 R15: 0000000000000005 [ 562.718093] CPU: 1 PID: 23550 Comm: syz-executor5 Not tainted 4.20.0-rc7+ #2 [ 562.721656] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 562.733061] Call Trace: [ 562.733061] dump_stack+0x173/0x1d0 [ 562.733061] ? __should_failslab+0x278/0x2a0 [ 562.733061] should_fail+0xa19/0xb20 [ 562.733061] __should_failslab+0x278/0x2a0 [ 562.751096] should_failslab+0x29/0x70 [ 562.751096] kmem_cache_alloc+0xf9/0xb90 [ 562.751096] ? ___slab_alloc+0x1ba1/0x2060 [ 562.751096] ? sk_prot_alloc+0xf1/0x500 [ 562.751096] ? __msan_poison_alloca+0x1f0/0x2a0 [ 562.751096] sk_prot_alloc+0xf1/0x500 [ 562.751096] sk_alloc+0xde/0xb90 [ 562.751096] inet_create+0x76f/0x1320 [ 562.751096] ? ipip_gro_complete+0x7e0/0x7e0 [ 562.751096] __sock_create+0x65f/0xf30 [ 562.751096] __sys_socket+0x174/0x640 [ 562.797773] __se_sys_socket+0x8d/0xb0 [ 562.797773] __x64_sys_socket+0x4a/0x70 [ 562.804218] do_syscall_64+0xbc/0xf0 [ 562.809772] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 562.809776] RIP: 0033:0x457ec9 [ 562.809776] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 562.836238] RSP: 002b:00007f2109b59c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 562.836238] RAX: ffffffffffffffda RBX: 00007f2109b59c90 RCX: 0000000000457ec9 [ 562.848758] RDX: 0000000000000073 RSI: 0000000000000002 RDI: 0000000000000002 [ 562.848758] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 562.864928] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f2109b5a6d4 [ 562.864928] R13: 00000000004c605e R14: 00000000004dad38 R15: 0000000000000004 04:30:31 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ftruncate(0xffffffffffffffff, 0xfcb) [ 562.955314] binder: 23556:23561 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 562.982219] protocol 88fb is buggy, dev hsr_slave_0 [ 562.982253] protocol 88fb is buggy, dev hsr_slave_0 [ 562.987858] protocol 88fb is buggy, dev hsr_slave_1 [ 562.992852] protocol 88fb is buggy, dev hsr_slave_1 04:30:31 executing program 5 (fault-call:1 fault-nth:3): socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:31 executing program 3 (fault-call:3 fault-nth:6): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:31 executing program 0: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) r2 = getpgrp(0xffffffffffffffff) write$cgroup_pid(r1, &(0x7f00000000c0)=r2, 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r4, &(0x7f0000011fd2), 0xffffffee) read(r3, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCADDDLCI(r4, 0x8980, &(0x7f0000000080)={'bpq0\x00', 0x8}) 04:30:31 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r3) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000180)={0x0, r3}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) [ 563.201318] FAULT_INJECTION: forcing a failure. [ 563.201318] name failslab, interval 1, probability 0, space 0, times 0 [ 563.212750] CPU: 1 PID: 23572 Comm: syz-executor5 Not tainted 4.20.0-rc7+ #2 [ 563.219983] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 563.222607] Call Trace: [ 563.222607] dump_stack+0x173/0x1d0 [ 563.222607] should_fail+0xa19/0xb20 [ 563.222607] __should_failslab+0x278/0x2a0 [ 563.239529] binder: 23575:23576 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) [ 563.222607] should_failslab+0x29/0x70 [ 563.222607] kmem_cache_alloc_trace+0x125/0xb90 [ 563.222607] ? memcg_kmem_put_cache+0x49/0x2d0 [ 563.222607] ? apparmor_sk_alloc_security+0xe4/0x1e0 [ 563.222607] apparmor_sk_alloc_security+0xe4/0x1e0 [ 563.222607] ? apparmor_setprocattr+0x13a0/0x13a0 [ 563.222607] security_sk_alloc+0x125/0x1f0 [ 563.222607] sk_prot_alloc+0x269/0x500 [ 563.222607] sk_alloc+0xde/0xb90 [ 563.222607] inet_create+0x76f/0x1320 [ 563.292730] ? ipip_gro_complete+0x7e0/0x7e0 [ 563.292730] __sock_create+0x65f/0xf30 [ 563.292730] __sys_socket+0x174/0x640 [ 563.292730] __se_sys_socket+0x8d/0xb0 [ 563.292730] __x64_sys_socket+0x4a/0x70 [ 563.292730] do_syscall_64+0xbc/0xf0 [ 563.292730] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 563.321339] RIP: 0033:0x457ec9 [ 563.321339] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 563.328094] RSP: 002b:00007f2109b59c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 563.328094] RAX: ffffffffffffffda RBX: 00007f2109b59c90 RCX: 0000000000457ec9 [ 563.328094] RDX: 0000000000000073 RSI: 0000000000000002 RDI: 0000000000000002 [ 563.328094] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 563.372306] binder: 23579:23580 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 563.328094] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f2109b5a6d4 [ 563.328094] R13: 00000000004c605e R14: 00000000004dad38 R15: 0000000000000004 [ 563.453488] FAULT_INJECTION: forcing a failure. [ 563.453488] name failslab, interval 1, probability 0, space 0, times 0 [ 563.464983] CPU: 1 PID: 23584 Comm: syz-executor3 Not tainted 4.20.0-rc7+ #2 [ 563.472216] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 563.474826] Call Trace: [ 563.474826] dump_stack+0x173/0x1d0 [ 563.474826] should_fail+0xa19/0xb20 [ 563.491903] __should_failslab+0x278/0x2a0 [ 563.491903] should_failslab+0x29/0x70 04:30:31 executing program 5 (fault-call:1 fault-nth:4): socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) [ 563.491903] kmem_cache_alloc_trace+0x125/0xb90 [ 563.491903] ? apparmor_file_alloc_security+0x23b/0x6e0 [ 563.491903] ? kmsan_internal_unpoison_shadow+0x2f/0x40 [ 563.491903] apparmor_file_alloc_security+0x23b/0x6e0 [ 563.520316] ? apparmor_file_permission+0x490/0x490 [ 563.520316] security_file_alloc+0xcf/0x1a0 [ 563.520316] __alloc_file+0x16d/0x6c0 [ 563.520316] alloc_empty_file+0x1f5/0x4b0 [ 563.520316] alloc_file+0xa5/0x7b0 [ 563.520316] ? __msan_metadata_ptr_for_store_1+0x13/0x20 [ 563.520316] alloc_file_pseudo+0x3ff/0x4e0 [ 563.520316] sock_alloc_file+0x1b2/0x5f0 [ 563.520316] __sys_socket+0x252/0x640 [ 563.520316] __se_sys_socket+0x8d/0xb0 [ 563.561803] __x64_sys_socket+0x4a/0x70 [ 563.566351] do_syscall_64+0xbc/0xf0 [ 563.566351] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 563.566351] RIP: 0033:0x457ec9 [ 563.566351] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 04:30:31 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ftruncate(0xffffffffffffffff, 0xfcb) [ 563.566351] RSP: 002b:00007fb71a11bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 563.566351] RAX: ffffffffffffffda RBX: 00007fb71a11bc90 RCX: 0000000000457ec9 [ 563.566351] RDX: 0000000000000073 RSI: 0000000000000002 RDI: 0000000000000002 [ 563.566351] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 563.566351] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb71a11c6d4 [ 563.566351] R13: 00000000004c605e R14: 00000000004dad38 R15: 0000000000000005 [ 563.660598] FAULT_INJECTION: forcing a failure. [ 563.660598] name failslab, interval 1, probability 0, space 0, times 0 [ 563.672282] CPU: 0 PID: 23595 Comm: syz-executor5 Not tainted 4.20.0-rc7+ #2 [ 563.679507] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 563.682071] Call Trace: [ 563.682071] dump_stack+0x173/0x1d0 [ 563.682071] should_fail+0xa19/0xb20 [ 563.682071] __should_failslab+0x278/0x2a0 [ 563.682071] should_failslab+0x29/0x70 [ 563.682071] kmem_cache_alloc+0xf9/0xb90 [ 563.682071] ? __d_alloc+0x98/0xc30 [ 563.682071] ? __msan_poison_alloca+0x1f0/0x2a0 [ 563.682071] __d_alloc+0x98/0xc30 [ 563.682071] ? __msan_poison_alloca+0x1f0/0x2a0 [ 563.682071] d_alloc_pseudo+0x68/0x80 [ 563.682071] alloc_file_pseudo+0x19f/0x4e0 [ 563.682071] sock_alloc_file+0x1b2/0x5f0 [ 563.682071] __sys_socket+0x252/0x640 [ 563.682071] __se_sys_socket+0x8d/0xb0 [ 563.682071] __x64_sys_socket+0x4a/0x70 [ 563.682071] do_syscall_64+0xbc/0xf0 [ 563.682071] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 563.682071] RIP: 0033:0x457ec9 [ 563.682071] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 563.682071] RSP: 002b:00007f2109b59c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 563.682071] RAX: ffffffffffffffda RBX: 00007f2109b59c90 RCX: 0000000000457ec9 [ 563.682071] RDX: 0000000000000073 RSI: 0000000000000002 RDI: 0000000000000002 04:30:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:31 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r3) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000180)={0x0, r3}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 563.682071] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 563.682071] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f2109b5a6d4 [ 563.682071] R13: 00000000004c605e R14: 00000000004dad38 R15: 0000000000000004 04:30:32 executing program 5 (fault-call:1 fault-nth:5): socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) [ 563.933731] binder: 23600:23602 ioctl c0306201 0 returned -14 [ 563.972431] binder: 23600:23602 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:32 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ftruncate(0xffffffffffffffff, 0xfcb) [ 564.044837] FAULT_INJECTION: forcing a failure. [ 564.044837] name failslab, interval 1, probability 0, space 0, times 0 [ 564.056349] CPU: 1 PID: 23607 Comm: syz-executor5 Not tainted 4.20.0-rc7+ #2 [ 564.063576] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 564.066168] Call Trace: [ 564.066168] dump_stack+0x173/0x1d0 [ 564.066168] ? __should_failslab+0x278/0x2a0 [ 564.066168] should_fail+0xa19/0xb20 [ 564.066168] __should_failslab+0x278/0x2a0 [ 564.066168] should_failslab+0x29/0x70 [ 564.066168] kmem_cache_alloc+0xf9/0xb90 [ 564.066168] ? __alloc_file+0xa3/0x6c0 [ 564.066168] __alloc_file+0xa3/0x6c0 [ 564.066168] alloc_empty_file+0x1f5/0x4b0 [ 564.066168] alloc_file+0xa5/0x7b0 [ 564.066168] ? __msan_metadata_ptr_for_store_1+0x13/0x20 [ 564.066168] alloc_file_pseudo+0x3ff/0x4e0 [ 564.066168] sock_alloc_file+0x1b2/0x5f0 [ 564.066168] __sys_socket+0x252/0x640 [ 564.066168] __se_sys_socket+0x8d/0xb0 [ 564.136150] __x64_sys_socket+0x4a/0x70 [ 564.140261] do_syscall_64+0xbc/0xf0 04:30:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) [ 564.140261] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 564.140261] RIP: 0033:0x457ec9 [ 564.140261] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 564.140261] RSP: 002b:00007f2109b59c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 564.140261] RAX: ffffffffffffffda RBX: 00007f2109b59c90 RCX: 0000000000457ec9 [ 564.140261] RDX: 0000000000000073 RSI: 0000000000000002 RDI: 0000000000000002 [ 564.140261] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 564.140261] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f2109b5a6d4 [ 564.140261] R13: 00000000004c605e R14: 00000000004dad38 R15: 0000000000000004 04:30:32 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x283, 0x0) ioctl$VIDIOC_G_FBUF(r1, 0x8030560a, &(0x7f0000000180)={0x8, 0x0, &(0x7f0000000040)="17e3def5e4989eab7eb4fa9c3cdb0e60e94edad532c8d52249029a307aa1052c86e41aaef7a90829245f720544b3ac15ce3c149709c15601eecbe8ec148e2d4846a65699cec438f4d6b9852836d91a5a2324ffcffb1766ae026e3cb105dcbb2b83061a4dfd3f6788148053f70ea3f2ed6c1787ff1c353aa1754a001dc3e9e2df446deaae37659be413e736c764356af4faeb770e4ca9147f2ac0df3735b6485f340a88e32d4be67b27096d0e6b54d91c6ccf10f82e7862bbb7372a63aa1313638112828d7de02a333c6c4b5baf6a77c0635725f30115f2958fa1e8cccccbde8d77834a3005154c103c55c98f", {0x7, 0xeaa6, 0x43373179, 0xb, 0xdd, 0x2, 0x5, 0x6}}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) [ 564.290551] binder: 23613:23614 ioctl c0306201 0 returned -14 [ 564.342965] binder: 23613:23614 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:32 executing program 5 (fault-call:1 fault-nth:6): socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:32 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r3) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000180)={0x0, r3}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:32 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000080)={0x0, 0x0}) prctl$PR_SET_PTRACER(0x59616d61, r1) r2 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r5, &(0x7f0000011fd2), 0xffffffee) read(r4, &(0x7f0000000000)=""/126, 0x7e) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:30:32 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ftruncate(r0, 0xfcb) 04:30:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) [ 564.540806] binder: 23627:23633 ioctl c0306201 0 returned -14 [ 564.560509] binder: 23627:23633 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 564.638201] FAULT_INJECTION: forcing a failure. [ 564.638201] name failslab, interval 1, probability 0, space 0, times 0 [ 564.649647] CPU: 1 PID: 23638 Comm: syz-executor5 Not tainted 4.20.0-rc7+ #2 [ 564.656880] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 564.659530] Call Trace: [ 564.659530] dump_stack+0x173/0x1d0 [ 564.659530] should_fail+0xa19/0xb20 [ 564.659530] __should_failslab+0x278/0x2a0 [ 564.659530] should_failslab+0x29/0x70 04:30:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:32 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x5, 0x73) 04:30:32 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ftruncate(r0, 0xfcb) [ 564.682431] kmem_cache_alloc_trace+0x125/0xb90 [ 564.688818] ? apparmor_file_alloc_security+0x23b/0x6e0 [ 564.688818] ? kmsan_internal_unpoison_shadow+0x2f/0x40 [ 564.688818] apparmor_file_alloc_security+0x23b/0x6e0 [ 564.688818] ? apparmor_file_permission+0x490/0x490 [ 564.688818] security_file_alloc+0xcf/0x1a0 [ 564.688818] __alloc_file+0x16d/0x6c0 [ 564.717926] alloc_empty_file+0x1f5/0x4b0 [ 564.717926] alloc_file+0xa5/0x7b0 [ 564.717926] ? __msan_metadata_ptr_for_store_1+0x13/0x20 [ 564.717926] alloc_file_pseudo+0x3ff/0x4e0 [ 564.717926] sock_alloc_file+0x1b2/0x5f0 [ 564.717926] __sys_socket+0x252/0x640 [ 564.741811] __se_sys_socket+0x8d/0xb0 [ 564.741811] __x64_sys_socket+0x4a/0x70 [ 564.741811] do_syscall_64+0xbc/0xf0 [ 564.741811] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 564.741811] RIP: 0033:0x457ec9 [ 564.741811] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 564.777891] binder: 23640:23641 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 564.741811] RSP: 002b:00007f2109b59c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 564.741811] RAX: ffffffffffffffda RBX: 00007f2109b59c90 RCX: 0000000000457ec9 [ 564.741811] RDX: 0000000000000073 RSI: 0000000000000002 RDI: 0000000000000002 [ 564.741811] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 564.741811] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f2109b5a6d4 [ 564.741811] R13: 00000000004c605e R14: 00000000004dad38 R15: 0000000000000004 04:30:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:33 executing program 5 (fault-call:1 fault-nth:7): socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:33 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:33 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ftruncate(r0, 0xfcb) [ 565.115061] binder: 23660:23661 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:33 executing program 5: socket$kcm(0x2, 0x2, 0x73) r0 = accept$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @remote}, &(0x7f0000000100)=0x10) setsockopt$inet_dccp_int(r0, 0x21, 0x0, &(0x7f0000000140)=0x8, 0x4) setrlimit(0x9, &(0x7f0000000080)={0xd9, 0xffffffffffffffff}) socket$kcm(0x2, 0x2, 0x73) syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x7, 0x100) socket$kcm(0x29, 0x5, 0x0) 04:30:33 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$kcm(0x2, 0x0, 0x73) r2 = socket$kcm(0x2, 0x2, 0x73) ioctl$FS_IOC_ENABLE_VERITY(r2, 0x6685) getsockopt$IP_VS_SO_GET_DAEMON(r1, 0x0, 0x487, &(0x7f0000000000), &(0x7f0000000040)=0x30) 04:30:33 executing program 0: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) ioctl$SIOCGIFHWADDR(r0, 0x8927, &(0x7f0000000080)) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:30:33 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) ftruncate(r0, 0xfcb) 04:30:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:33 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:33 executing program 5: socket$kcm(0x2, 0x2, 0x73) r0 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0xb, 0x40) write$P9_RRENAMEAT(r0, &(0x7f0000000300)={0x7, 0x4b, 0x2}, 0x7) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r0, 0x800448d2, &(0x7f00000002c0)={0x4, &(0x7f0000000040)=[{}, {}, {}, {}]}) socket$kcm(0x2, 0x7, 0x73) [ 565.526061] binder: 23692:23693 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:33 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$unix(0x1, 0x5, 0x0) socket$kcm(0x2, 0x2, 0x73) 04:30:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:33 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:33 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) ftruncate(r0, 0xfcb) [ 565.865672] binder: 23714:23719 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:34 executing program 5: socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x0, 0x73) 04:30:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:34 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) ftruncate(r0, 0xfcb) 04:30:34 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r4, &(0x7f0000011fd2), 0xffffffee) read(r3, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(r0, 0x0, 0x0) 04:30:34 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) r1 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x9a, 0x400000) ioctl$RTC_IRQP_READ(r1, 0x8008700b, &(0x7f0000000040)) ioctl(r0, 0x8, &(0x7f0000000080)="1b83c3f54fb9bc1c68d4e714fd2515f6bfa84d99c7019049e00b632fa39e56e0f5ebf540b8cd1e09ac3d514a193bf0cc2051f5277945b5da5af270903d2d05113b38f8e5003361f05fd30b83d09cd3499a4dafe9e7af4fc16a6c3ea62b859b97a9656ce416ff30c258a937b4f479e2075452a8fab606cfaed76bc6") socket$kcm(0x2, 0x7, 0x73) 04:30:34 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(0xffffffffffffffff, 0xfcb) 04:30:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:34 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:34 executing program 5: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @remote}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) unshare(0x2060000) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000140)='ns/mnt\x00') openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x82000, 0x0) setns(r1, 0x0) clone(0x70024100, 0x0, 0x0, 0x0, 0x0) r2 = socket$kcm(0x2, 0x2, 0x73) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f00000000c0)={0x0, 0x65, "fea6e9ff61630710110f53122ceac49fa27edd7a9cf236edda8e602f61807ba277d2c375039dde3845063a9f49ed15abe23715ff7d95323d6710016ceb57eaf18f90457c8f5d1cd8dfdc06d591da6eb5b64370b7f52e0a939fd4af176ca3ca15fe35ded549"}, &(0x7f0000000140)=0x6d) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, &(0x7f0000000000)={r3}, &(0x7f0000000180)=0x8) setsockopt$inet_sctp_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f0000000080)={r4, 0x400000000000008}, 0xdf7c6ca6ba5cf493) socket$kcm(0x2, 0x2, 0x73) [ 566.560974] IPVS: ftp: loaded support on port[0] = 21 04:30:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, 0x0}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:34 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(0xffffffffffffffff, 0xfcb) 04:30:34 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:34 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) syz_emit_ethernet(0x2a, &(0x7f0000000240)={@local, @local, [], {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x2, @random="7722fe237460", @multicast2, @remote, @multicast1}}}}, &(0x7f00000001c0)) socket$kcm(0x2, 0x2, 0x73) kexec_load(0x1, 0x4, &(0x7f0000000240)=[{&(0x7f0000000000)="489e7f2d1bd3dc18f452", 0xa, 0xffffffffffffff00, 0x9}, {&(0x7f0000000040)="0917a964", 0x4, 0x80000000, 0x7}, {&(0x7f0000000080)="deddbd7f78137ac99de2d9806f8beaeab46be8052740f8a7501e82707a7d36c5d794510abfbb7f4cb939fec4648d3e1ec158021e1f76640be852905dec3b96d11dbfd53bad7e22b257a2a66bebfcb12387b7392f6d2550065049aae2c986323200bf98d89357ed2e4b22555d48bdcdedbf10343cce777ab7a2ba8b1a96614040d69108ec8b82bf35c87256670564dc5e40aaeb454fed5c074b7aae26ba62b8c437691738bf08150cb3c91e301675b957f61ba49a86d80eb623b413", 0xbb, 0xfffffffffffffffb, 0x100}, {&(0x7f0000000180)="f6c232878e154511b53a2597cf1d7411e873fd9538e163a0e5c681c5a2635478a495792b1032e28468d82a65f40849d2c3d0710b9b6dd20ef20b8f834553661b054ca205621fc80e8e83f3dc62b257229ace7a67d3ac21de917edd5416953d3fcadeac6f2ee338d4b4e5c55a6e712b16166a09a8c08dc07ec0fd36d36726e499db61", 0x82, 0x8, 0x401}], 0x1f0000) 04:30:34 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(0xffffffffffffffff, 0xfcb) 04:30:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, 0x0}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:35 executing program 5: socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) mlock(&(0x7f0000ff8000/0x6000)=nil, 0x6000) r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x0, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000040)={0xa28ba327ec7a5234, 0xffffffffffffffe1, 0x8, 0x4}) [ 567.142274] net_ratelimit: 20 callbacks suppressed [ 567.142291] protocol 88fb is buggy, dev hsr_slave_0 [ 567.142354] protocol 88fb is buggy, dev hsr_slave_0 [ 567.147893] protocol 88fb is buggy, dev hsr_slave_1 [ 567.152872] protocol 88fb is buggy, dev hsr_slave_1 [ 567.168285] protocol 88fb is buggy, dev hsr_slave_0 [ 567.173999] protocol 88fb is buggy, dev hsr_slave_1 [ 567.179828] protocol 88fb is buggy, dev hsr_slave_0 [ 567.185483] protocol 88fb is buggy, dev hsr_slave_1 04:30:35 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) recvfrom(r0, &(0x7f0000000240)=""/219, 0xdb, 0x10000, &(0x7f0000000080)=@nl=@proc={0x10, 0x0, 0x25dfdbfe, 0x800}, 0x80) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r4, &(0x7f0000011fd2), 0xffffffee) read(r3, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:30:35 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) gettid() rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r2, 0x40000000af01, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r2, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r3) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000180)={0x0, r3}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:35 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x2, 0x420042) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f00000000c0)={0x0, 0x80000, 0xffffffffffffffff}) inotify_init1(0x800) ioctl$DRM_IOCTL_GEM_FLINK(0xffffffffffffffff, 0xc008640a, &(0x7f0000000100)={0x0, 0x0}) ioctl$DRM_IOCTL_GEM_FLINK(r1, 0xc008640a, &(0x7f0000000180)={r2, r4}) r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r1) ioctl$HDIO_GETGEO(r5, 0x301, &(0x7f0000000040)) socket$kcm(0x2, 0x0, 0x73) syz_open_dev$swradio(&(0x7f00000002c0)='/dev/swradio#\x00', 0x1, 0x2) socket$kcm(0x2, 0x2, 0x73) write$binfmt_script(r3, &(0x7f00000001c0)={'#! ', './file0', [{0x20, '/dev/amidi#\x00'}, {0x20, '][md5sum)vmnet0bdev:nodev\\cpuset:posix_acl_access'}], 0xa, "99b42d9a78bbe2a7c41d81c9a9bd5e5e33bd6de5b28988233510174eca7e4614a86bf9f58e35adcaa569e27287b56f0f1a7e739fef39627ec4454a4cc3e34d60c202ceb9d43f8cc7c94b1983a7d0d2e1f05a435b1c5b4eba04df33101289f3121d6a82cbc14c7b133b3b40503954c8d1b016160891147b51afab5c1fa3be8b9b"}, 0xca) 04:30:35 executing program 5: r0 = syz_open_pts(0xffffffffffffff9c, 0x20000) ioctl$TIOCOUTQ(r0, 0x5411, &(0x7f0000000000)) socket$kcm(0x2, 0x2, 0x73) r1 = syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0x0, 0x2) ioctl$KVM_SET_GUEST_DEBUG(r1, 0x4048ae9b, &(0x7f0000000080)={0x90000, 0x0, [0x7, 0xa9d, 0xad96, 0x400, 0xc56, 0xd2cd, 0x1dc, 0x4]}) socket$kcm(0x2, 0x2, 0x73) 04:30:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, 0x0}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:35 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0x0) 04:30:35 executing program 5: socket$kcm(0x2, 0x2, 0x73) r0 = socket$kcm(0x2, 0x2, 0x73) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000000), 0x4) ioctl$sock_SIOCSIFBR(r0, 0x8941, &(0x7f0000000100)=@get={0x1, &(0x7f0000000040)=""/139, 0x8}) 04:30:35 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x175a03, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/udplite\x00') ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0xffffffffffffff1c) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) [ 567.803475] binder: 23838 RLIMIT_NICE not set 04:30:35 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) tkill(0x0, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r2, 0x40000000af01, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r2, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r3) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000180)={0x0, r3}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:35 executing program 5: r0 = socket$inet(0x2, 0x1, 0x10001) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000000)=0x3f, 0x4) socket$kcm(0x2, 0x2, 0x73) r1 = socket$kcm(0x2, 0x40000000a, 0x73) socket$can_raw(0x1d, 0x3, 0x1) ioctl$sock_SIOCADDDLCI(r1, 0x8980, &(0x7f0000000040)={'bond0\x00', 0x100000004}) 04:30:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:36 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:36 executing program 5: r0 = dup(0xffffffffffffff9c) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000000200)={0x5}, 0x4) socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x240, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_FLUSH(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="a8000000a2703ee3c0047efe03e3ad843c14dd03fb340e03e9853e25a8aebdd201e79b7d3fcc2061a22c676efbd5acb1c49977c7e4c73c27fd19db11e815ac2c04d9f4f9ae3878aa9b24afc378b13400ad5e990ffccefd175573545dfb026846d05b3dbcb2c80ed6b3a269aca1627bb1", @ANYRES16=r2, @ANYBLOB="22002cbd7000fcdbdf2511000000040001006400030014000600ff010000000000000000000000000001080008000300000008000500ac1414bb080007004e21000014000200697064647030000000000000000000000800010001000000080008000200000008000400080000000800030002000000080006000400000008000500050000001c000300080001000100000008000100020000000800010002000000"], 0xa8}, 0x1, 0x0, 0x0, 0x10}, 0x1) 04:30:36 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f00000005c0)=0x0) capget(&(0x7f0000000600)={0x399f1336, r1}, &(0x7f0000000640)={0x4, 0x568, 0x0, 0x7fff, 0x6, 0x5}) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r2 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) lseek(r2, 0x0, 0x4) write$cgroup_pid(r3, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r5, &(0x7f0000011fd2), 0xffffffee) read(r4, &(0x7f0000000000)=""/126, 0xfffffd6d) prctl$PR_SET_UNALIGN(0x6, 0x1) sendmsg(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAXSEG(r3, 0x84, 0xd, &(0x7f0000000340)=@assoc_value={0x0, 0x3ff}, &(0x7f0000000540)=0x8) setsockopt$inet_sctp_SCTP_RESET_ASSOC(r0, 0x84, 0x78, &(0x7f0000000580)=r6, 0x4) lstat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(r5, 0x29, 0x22, &(0x7f00000003c0)={{{@in=@remote, @in6=@ipv4={[], [], @multicast1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@loopback}}, &(0x7f00000002c0)=0xe8) stat(&(0x7f0000000300)='./file0\x00', &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r10 = getegid() setxattr$system_posix_acl(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='system.posix_acl_access\x00', &(0x7f0000000780)=ANY=[@ANYBLOB="02000000010002000000000002000100868b3a6083e78c6b938d90f10e169e20afdafb89ff5a94db7303f4e4f8db76a6cfb3815a4aedbcc11d25746453a61e8cfb6838f1f1aab63efbdd526b3411a3ada571fb0a6b5fb4da91b7dada3e6470b975eb87c2063da732d1776f33367de2aff5e070e823847f1db503bb88c101129872152085e1360e732d4b5f760a377a0712702db820ab409fed77ededa078c477b709fb5d2fa6f342c831282f7cbd", @ANYRES32=r7, @ANYBLOB="02000000", @ANYRES32=r8, @ANYBLOB="040006000000000008000100", @ANYRES32=r9, @ANYBLOB="08000400", @ANYRES32=r10, @ANYBLOB="10000100000000002000060000000000def6d719baa247a83c0b198ecec6fd1114f7b20cc897d96cae2494289724b303871e9ce672bb52268e10e2d78247cec8fe8014d58570392b17b9db7127033cb1"], 0x44, 0x1) 04:30:36 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 568.496619] binder: 23867 RLIMIT_NICE not set [ 568.508061] binder_thread_write: 6 callbacks suppressed [ 568.508083] binder: 23866:23868 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 568.582249] protocol 88fb is buggy, dev hsr_slave_0 [ 568.588234] protocol 88fb is buggy, dev hsr_slave_1 04:30:36 executing program 5: socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) r0 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x5, 0x8000) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000000040)={0x5000000, {{0xa, 0x4e22, 0xd50, @empty, 0x9}}}, 0x88) 04:30:36 executing program 2 (fault-call:3 fault-nth:0): perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0x0) 04:30:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) 04:30:36 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r1 = gettid() tkill(r1, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r2, 0x40000000af01, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r2, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r3) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000180)={0x0, r3}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:36 executing program 5: socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) r0 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video2\x00', 0x2, 0x0) ioctl$VIDIOC_DBG_G_CHIP_INFO(r0, 0xc0c85666, &(0x7f0000000040)={{0x2, @addr=0xed}, "a84a730c0223d0a9d3d3e522bc06d889aecab40ddff63974f8222dd6308f3fc7", 0x2}) socket$kcm(0x29, 0xfffffffffffffffe, 0x0) [ 568.848905] binder: 23896 RLIMIT_NICE not set [ 568.910428] binder: 23894:23896 ioctl c0306201 0 returned -14 04:30:37 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x42) mkdirat$cgroup(r1, &(0x7f0000000580)='syz1\x00', 0x1ff) r2 = socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) write$P9_RREADDIR(r2, &(0x7f0000000040)={0xa6, 0x29, 0x2, {0x100000001, [{{0x4}, 0x6, 0x5, 0x7, './file0'}, {{0x0, 0x3}, 0x10000, 0x1f, 0x7, './file0'}, {{0x2, 0x2, 0x7}, 0x0, 0x1, 0x7, './file0'}, {{0x1f, 0x2, 0x2}, 0x400, 0xfffffffffffff801, 0x7, './file0'}, {{0x0, 0x4, 0x1}, 0x3, 0x1845, 0x7, './file0'}]}}, 0xa6) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x4) ioctl$KVM_SET_XSAVE(r3, 0x5000aea5, &(0x7f0000000180)={"0b54e12d5f4629dcd2e2febed79e9182282b2fb19c4547aae3028f4c21b3d7d752e711c3bb6aa79ee841b4bf8790e76c3c6b012aa280d9987571f5cc09d52b20ca15a552592b8d52c83e292696a4835dd04920a7ebaea55acaf6d7bd651021ba39f0cb4a3e868eb9c5f96b81fb1f2933d48b7481da3b91fb387624a07aac6a8b7725c355fae3de7df62df23ae3ab8fd29b7109328cf0f7c893875e65b3fd1ea99523c154e668c4b884e89e2aa63d8459ba3643c6fc2dda2ee5fadf90f03bf2c90d6f04bff21d6d90f976d8c9467b530861fa15bf3b5fcc9dc2d3a1b6889ccb1f5a5b338fc020c1c34fc7ead7a9dd77d0540c6f04959d562df985de0e9a25ce47ebf6557627f52bb06dc9cf0d2595970adb1f7c9035ba4114ecff7926cb2118b4a6d321aaeab20ad9ef7e8fd8bf21db9915351027bb9c9bee702eaac0de147452d97149f1dc0f82aae229382d06d61e4e7a6960a56a7fc34ab8b8f753a63059b1f74904034fb0cb272373b4361c98cd8ea0ec79536e7397a5089077b295a48b232963c1224c7fa5736dc02b93b0952ade2b675e25d3be2829c9ba10409ba6ad5e8b70b195f9553b104c3a583147a3576105b27e0f0eea48f7c99672923dc3a806257b82bed938681b7f1e4ea861a05109d19f848010a1c8c9b09c356464e0b1126fb67224868673c421ede66213468f10c9b91450717351dbefb40bf8d8fb3aeed72690baa2926874a9c3ad567bb88d66652b57865dd4f861204fceb649328c16c0f7987f9e7dbf28444c196c5723e641fe85e2cfea5a30e6a3f321312ee5ec218b6a8ef395a99a72cfc94c228221566cb7aac3ccef0926c951e909499dc1992aa35b97bfeb935b962db676cff238b281dd27faa149965baf2ab2c0d6e9f36f2075b2af35be15117fe6bc4ffe427d10c78e2a8d63a225171ae5628c3469dbb6f5f4d0b9b7506011f167f3e0a7e51f037ea7ac179c449faf050723f7bd41695e9152d1fdbc969ca40ef034186db167f77d929afd5dfa6b33a191a3bfc954cc2cc92e94f47e63ef1fbff6a3d7190ff4b34c8478e8fe147d4e064c7f53995f31ef25338b0dfab9352cd6c48edfb2365d55f4241bec8de87dc14d6e89549d926e819ad56aeb49a3ca64f1d8f91815329d3bed11d5b7d4df6a1b82fbe602a1082343409c3114a2efab1e80ae8dcbca0fa5b5402efb6e2490ebd793f7aed8e647506842620c21ebc11bb9949320f72fdf34cb744a1febcc7a2da74795a6dd41f00bed5955fed2e553536f4a2db98b7ff8c58c855586d96ad2590482ae917d2e13b7cfea38d81b697325cffa441e90920b8829305f5476233714aacaa95f4687d83fd1fbc7acaf664d0fc6d279bb5a13550ff7fe7dcc246b302d42ac9e68e7ad113c8a20e053bd49dda0dea161bd376f5f7faa57308cbac83d8b19e97a07e372bfbc523e"}) 04:30:37 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ftruncate(r0, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r3, 0x28, 0x0, &(0x7f0000000200)=0x3, 0x8) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x40002, 0x0) ioctl$VIDIOC_SUBDEV_G_DV_TIMINGS(r4, 0xc0845658, &(0x7f0000000100)={0x0, @reserved}) ioctl$sock_bt_bnep_BNEPCONNDEL(r2, 0x400442c9, &(0x7f0000000240)={0xffff}) 04:30:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 04:30:37 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r1 = gettid() tkill(r1, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r2, 0x40000000af01, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r2, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r3) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000180)={0x0, r3}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 569.269823] binder: 23923 RLIMIT_NICE not set 04:30:37 executing program 5: socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x7, 0x73) 04:30:37 executing program 0: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x20000, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x847ff) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, 0x0, 0x0) write$binfmt_elf64(r3, &(0x7f0000000940)={{0x7f, 0x45, 0x4c, 0x46, 0x2, 0xfffffffffffffeff, 0x3ac, 0x401, 0x16519949, 0x2, 0x3e, 0x2, 0x385, 0x40, 0x21c, 0x7, 0x6, 0x38, 0x2, 0x2, 0x242f, 0xfffffffffffffffa}, [{0x1, 0x20, 0xffffffffffffff81, 0xff, 0xffffffffffffcb3e, 0x1, 0x5, 0x6}], "c7bed3a71907fb063ce8d1d9206bc0cef8c9f75263ef78cb0ce7e0f05a96bc543dd7248cd891f2f5231802113bb9ee22f2eaf30410b457571afef77925b61b0a5a93d2b6bfbbce187bc9fe3502da4a5d50", [[], [], [], [], []]}, 0x5c9) 04:30:37 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) eventfd2(0x3, 0x80000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ftruncate(r1, 0x0) r2 = syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x9, 0x2000) syz_kvm_setup_cpu$x86(r0, r2, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000180)=[@textreal={0x8, &(0x7f0000000100)="66b9260a00000f320f01caf2a466b8005000000f23c80f21f866350000e0000f23f866b94a0300000f32650f01cfbaa00066b8cd5813ca66ef8bb604000f06dfa90300", 0x43}], 0x1, 0x0, &(0x7f0000000200)=[@efer={0x2, 0x8500}], 0x1) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x432000, 0x0) 04:30:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 04:30:37 executing program 5: pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(r0, 0xc0945662, &(0x7f0000000100)={0x8b2, 0x0, [], {0x0, @reserved}}) prctl$PR_SET_NAME(0xf, &(0x7f0000000000)='selinuxvboxnet0trusted\x00') mknod$loop(&(0x7f0000000080)='./file0\x00', 0x6000, 0x1) socket$kcm(0x2, 0x5, 0x73) socket$kcm(0x2, 0x2, 0x73) prctl$PR_SET_NAME(0xf, &(0x7f0000000040)=',\x00') 04:30:37 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x3, 0x73) [ 569.696845] binder: 23952 RLIMIT_NICE not set 04:30:37 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r1 = gettid() tkill(r1, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r2, 0x40000000af01, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r2, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r3) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000180)={0x0, r3}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 04:30:37 executing program 2: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ftruncate(r1, 0x0) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000040)=0x0) r3 = syz_open_dev$usbmon(&(0x7f0000000180)='/dev/usbmon#\x00', 0x3, 0x2000) ioctl$VIDIOC_S_AUDIO(r3, 0x40345622, &(0x7f0000000200)={0x1888ff05, "95a3dc778474def66318572dce4807423e92b6607b8d33b64ffd754451572a60", 0x1, 0x1}) perf_event_open(&(0x7f0000000100)={0x7, 0x70, 0xfffffffffffffffb, 0x6, 0x3, 0xffff, 0x0, 0x8, 0x90, 0x8, 0x7, 0x7f, 0x4, 0x0, 0x5, 0x8, 0xaa, 0xffffffffffffff83, 0x1, 0x6, 0x0, 0x3b16, 0x3, 0x1c4, 0x7, 0x4, 0x9, 0x592d, 0x81, 0x0, 0xfffffffffffffff9, 0x4, 0x899f, 0x0, 0x900, 0x5, 0x81, 0x100, 0x0, 0x1ff, 0x1, @perf_bp={&(0x7f0000000000), 0x1}, 0x100, 0x2, 0x80000000, 0x1, 0x7, 0x20b, 0x9}, r2, 0xe, r0, 0x8) 04:30:38 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$HDIO_GETGEO(r0, 0x301, &(0x7f0000000080)) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r4, &(0x7f0000011fd2), 0xffffffee) read(r3, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:30:38 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCGSOFTCAR(r0, 0x5419, &(0x7f0000000000)) ioctl$FIBMAP(r1, 0x1, &(0x7f0000000040)) r2 = socket$kcm(0x2, 0x0, 0x73) r3 = socket$kcm(0x2, 0x2, 0x73) r4 = dup(r2) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f0000000080)={0x0, 0xfffffffffffff800}, &(0x7f00000000c0)=0x8) getsockopt$inet6_opts(r4, 0x29, 0x3f, &(0x7f0000000240)=""/10, &(0x7f0000000280)=0xa) setsockopt$inet_sctp_SCTP_DELAYED_SACK(r4, 0x84, 0x10, &(0x7f0000000100)=@sack_info={r5, 0x0, 0x7}, 0xc) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f00000001c0)={0x7, 0x0, [{0xbd6, 0x0, 0x10000000}, {0x247, 0x0, 0x8}, {0x6fa, 0x0, 0x8001}, {0xfff, 0x0, 0x1}, {0xafb, 0x0, 0x80000000}, {0xbff, 0x0, 0xff}, {0x874, 0x0, 0x1}]}) syz_open_dev$dmmidi(&(0x7f0000000180)='/dev/dmmidi#\x00', 0x6, 0x0) [ 570.012891] binder: 23977 RLIMIT_NICE not set 04:30:38 executing program 5: socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) r0 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x5, 0x2) ioctl$TUNGETVNETHDRSZ(r0, 0x800454d7, &(0x7f0000000040)) 04:30:38 executing program 2: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r2, 0x0) r3 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x2000, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'bond_slave_1\x00', 0x20}) getuid() getpid() r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x80, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r1, &(0x7f0000000140)={0x10000000}) ioctl$LOOP_SET_CAPACITY(r4, 0x4c07) ioctl$HDIO_GETGEO(r4, 0x301, &(0x7f0000000180)) setsockopt$inet6_MCAST_JOIN_GROUP(r3, 0x29, 0x2a, &(0x7f0000000200)={0x78d, {{0xa, 0x4e24, 0x20, @ipv4={[], [], @empty}, 0x5}}}, 0x88) ioctl$RTC_PIE_ON(r3, 0x7005) 04:30:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000340), 0x0, 0x0, 0x0}) 04:30:38 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(0xffffffffffffffff, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r1 = gettid() tkill(r1, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r2, 0x40000000af01, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r2, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r3) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000180)={0x0, r3}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:38 executing program 5: socket$kcm(0x2, 0x2, 0x73) r0 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x7, 0x400000) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f00000000c0)) r1 = socket$kcm(0x2, 0x5, 0x73) getsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f0000000000), &(0x7f0000000080)=0x8) 04:30:38 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x1, 0x73) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000b80)='/dev/vcs\x00', 0x101000, 0x0) write$P9_RLERRORu(r2, &(0x7f0000000bc0)={0x17, 0x7, 0x2, {{0xa, 'vmnet0em0*'}, 0x4}}, 0x17) r3 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x0, 0x0) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000200)={{{@in6=@local, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000300)=0xe8) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000340)={0x0, 0x0, 0x0}, &(0x7f0000000380)=0xc) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000003c0)={{{@in=@initdev, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@multicast1}}, &(0x7f00000004c0)=0xe8) getgroups(0x8, &(0x7f0000000500)=[0xee00, 0xee00, 0x0, 0xee00, 0xee01, 0xee00, 0xffffffffffffffff, 0xee01]) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000540)={0x0, 0x0}, &(0x7f0000000580)=0xc) lstat(&(0x7f00000005c0)='./file0\x00', &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000680)={{{@in6=@mcast2, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@mcast1}}, &(0x7f0000000780)=0xe8) getgroups(0x1, &(0x7f00000007c0)=[0x0]) write$FUSE_DIRENTPLUS(r3, &(0x7f0000000800)={0x330, 0x0, 0x2, [{{0x6, 0x2, 0x4, 0x8, 0x0, 0x80, {0x0, 0x0, 0x73, 0x99a, 0x401, 0x400, 0x8, 0x4d5d1c6e, 0x7fffffff, 0x1f, 0xf984, r4, r5, 0xfffffffffffffffb, 0x5a4bcd6e}}, {0x0, 0x13deb700, 0x8, 0x3a1, '^selinux'}}, {{0x5, 0x2, 0x9, 0x400, 0x2, 0x6934bff5, {0x4, 0x2, 0x1, 0x0, 0x3f, 0x3, 0x2, 0xe0, 0x80, 0x7, 0x2, r6, r7, 0x2, 0x7}}, {0x5, 0x60000000000000, 0xa, 0x3f, 'vmnet0em0*'}}, {{0x5, 0x0, 0xfffffffffffff9e0, 0xa44, 0x101, 0x4, {0x4, 0x3f, 0x6, 0x1, 0x6f1, 0x3, 0x1ac7, 0x4, 0x401, 0xfe86, 0x7f, r8, r9, 0x6, 0xfffffffffffffffe}}, {0x59287988, 0x6, 0x10, 0x0, 'posix_acl_access'}}, {{0x3, 0x3, 0x3, 0x4, 0x3f, 0x7, {0x6, 0x0, 0xffff, 0x0, 0x7fd, 0x0, 0x200, 0x9, 0x5, 0x2, 0x3, r10, r11, 0x4, 0x3}}, {0x2, 0x3, 0x0, 0x1}}, {{0x4, 0x0, 0x7fffffff, 0xf3b, 0x9, 0xdf, {0x6, 0x0, 0x7, 0x8, 0x200, 0x2, 0xc7d0, 0x45be, 0x8, 0x9, 0xe25, r12, r13, 0x967, 0xff}}, {0x2, 0x1000, 0x0, 0x3}}]}, 0x330) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f0000000b40)=r3, 0x4) [ 570.430834] binder: 24005 RLIMIT_NICE not set 04:30:38 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0x4000000001) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0xc6400, 0x0) ioctl$TCGETS(r1, 0x5401, &(0x7f0000000100)) write$FUSE_NOTIFY_DELETE(r1, &(0x7f0000000140)={0x29, 0x6, 0x0, {0x5, 0x6}}, 0x29) 04:30:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000340), 0x0, 0x0, 0x0}) 04:30:38 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:38 executing program 5: socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x805, 0x73) openat$cuse(0xffffffffffffff9c, &(0x7f0000000180)='/dev/cuse\x00', 0x2, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x200040, 0x2) ioctl$VIDIOC_G_INPUT(r0, 0x80045626, &(0x7f0000000040)) [ 570.845228] binder: 24036 RLIMIT_NICE not set 04:30:39 executing program 0: openat$dsp(0xffffffffffffff9c, 0x0, 0x4001, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) ioctl$VHOST_GET_FEATURES(r2, 0x8008af00, &(0x7f0000000080)) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:30:39 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x0, 0x0) sendmsg$unix(r0, &(0x7f0000000180)={&(0x7f0000000100)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000001600)=[{&(0x7f0000000200)="30d2f6325084152a8790a87e2436284ffbf0e2e31cefa5f10af39d8a7cbca88ba14d45083af52115336c732fbfd497605ad796e97afc8bc0aa8fae771b24956a13e7653c467eb6486d6d799e8587420dd038a8faf2e68a0ff4cd0922fcd5773909397863fe6119f9c539766512f0f5b22a97558dff3dd1f2a1cac07659108a5d8073773dd6c9", 0x86}, {&(0x7f00000002c0)="07aeb10c82e1256002f87617a9425345f576d939288bbfef0a532767df6f5b014be711d7278d46335c438ccbcd0362dea889a770d4670c3c7d737c37bd1f2024ff5a871778795a46ad09a22c5b8550e74654798fce8451ed2659274992a2752bab78a8f57274f688ae874935e13dba148b55403dbc3ced7af4deb575c3c86a441ac38fdb674963c86f65ac93cc1249e0d78d1dc3768d52b00a66992207795b1f762cb1e4b5076abd8f041f5786eb6c5ee3acc1f097dd568cec16dede557da844dde91672071c9a964116c4", 0xcb}, {&(0x7f00000003c0)="c56eb7d54a1303e2bcf2ebb678fbf8995721c92990417afb5b025c099a306a41a961ae7767fa59bc38533fecab7d74ef0859a846b5a4b6c453eec2ee902f95685c4655f129c6c3b29e36a6881fa88df780e2fdb0832e689487c39d0ae925c8028dd13e2d7116e8294d6fc6a8ee4abc4c2dbb96d1c90e358dc20c9133186947f9ae8759e947130f08ad6c6ca8aba8154cd0324eb20ad28e4d50bfc34d0bd2af1c687387234df4", 0xa6}, {&(0x7f0000000480)="20369c3c3c52094d111001ecbe0ed90e29ed11e7ab55bbf4c77eae39ad631713e258ac79c5aabcc9d40448e1998eb1459653d54604196032479ff415d1dc3f912b4dfa0114f35acf2a58223e7f24533b9166e9553369a334", 0x58}, {&(0x7f0000000500)="8217ce8d4d6d8c736748b3232e561735fa813b53deadd4ced367a1eaa44bbe54a54ce9069da948644390517f7416d4de373c92b9170fea2966a808349a98072061da3a21d73b54fe350ee6ded5c9bff477b008d083d6dea07b06329cec4eec20ac59a5a19ec03b01084b3ec2c7c748a43f620c9b54e5c453a72c1cafedf77c0d2ada98920e3584cf0ae2a4fdc4b5350af5c9f43568b064e2bf55eb6992c6a827ec335e4e3d5a12ebb4ea420a1eb35b98fa7481101bb563c2680a3fb5e7f59bb871c0251b168b9d6948a5cb76dff32205c6b126be5ec1ecfbd8d44bfba410287dd7af1ddf9f6bef7b1fd9a68e8bddbf47e98746d3c83fb3962fe351ad6f5a809960fbbb12cd30701c5e19fbd4e74f150c68ea603256bcd23807335afc0406e334f8700e8e04e8146ef0dae1fc091a7870395b5354c42dae67bcc97bbedd58c396cfce19e8460325c907bc26b07978821e9268f6d4b71851199d2eb5ac4d8d9f0a077a93c5c26e8d569c73a08abdb5777c61275501a4fac9d631738ce823763eaf9e981f44ef93d170d01c1c2509963d32b2e19eec81d12414fe9f4a004419a75fd1b97c926b0e39848b4c4c6b4c90762b5554c7e511da64fc107dedcfdb5de1cdafe39dcf7fe15d520d24566c717ec765c6a74ee728a7beb6d28f9e79fd39dd6919d5b9d42acb6997a4ee211b2df2c2335065fd6e9f63b9fa4dcff50f0212010c3cb36f9ef3fedbefd282ec9fbf805b6c576fd4c93cbb4158c7b4d5f09c65fd4fbacb027415af684bfeb2f024d1084ec5ce8722542557be5a72093a1343a80e8d42169ae57f1127af7bb0244be9367b0115f421557aacec7bfc715f5b03f604053661f64341438cb9615052e30264c3998b43ce7273973d60be3d5d44d57c0a1dc84b2df2aaec5f0d6783f201fff85575ec30523653dabd3819d950b7be10b79f0cec037527d6d05922e57d20ca040d1e10da89ff694aafb48bbde939b938b02385faf666a54cdb6d474f3fb4962301202fbb7ff1b54435057f2ad44464ee8cf13f5f395d1dac76c898778d622e3343d3330d0a22848fad29ed8f58b3e2d519ae66aeb33ac8b24e6de58fda14c35eabfb80bec38a5357c144fa1237d4945b38cd2d7d8bea54d9248afd932bb4e3be6bc301e08a603501aa411f49ad9434f9862675ec66c1c015d2de331998c5f102f0f81588e9622532a85792cd5d94a669cfdbfcd006ef85ebc84b94f84547aa19036cef96934c00147c93ecbc4d56e9e699bc099ad1d25b87052e3aa03a675f4eec43781c9ff21f58531bd6e241d059c28e24430519983979a3c4f5408aca2f402f490702c1ba8e79ef6d88d891caae690e1599a4a04c6ef6a14b282b48a6ef31b4124adafb9a606f230ce0d438622ad5d3a0b94f006e8587b506219b4fdddba2203ed3dd4cbb2e41c07568e377d17cd593148cb0a07631be14397639fba44458016f032e93c5142daf5eead35fb672a42b5adf1e8d436cb0a9ce68517fa8525bc0ff757c65b392138ff71a9b0c28eec1278499bbb4b42b9e994f304065da86f72dd68b725a0624790f1fad29299bd8f20f2dac8426dc6001227ad97f6c1d1402d6274bd19a43aac643900069e8e1aca768bd38f10aa9fc685f7a45dde01e5f38ab67432beff6291ae1773874b37d106ddb2e5913021e044708ceccfb2e2a07d4c4a318655a934526f49f36559b8dc0344565abfe4602fd1a3250bedabb932f71029a58671613e3ac575f8986701e22f94e7d5d78cda686c07c8a8fd3d6385b7f4ac0d00b85534842bfcfdf72520eee92412d2ad6537391ff9ae35ae60442d58af4a3ef16af0ac0e0739ff65f73b4dcf57b8669f9943911f09af6ae2a87f5da74c55a165e0f4287a2b628f93c95e396df4dff5faed9826009dc286ea7fe3b5c31945b91a4dd3944d9c886df88f448b0a0a593843fad22b872e6f5af883eecf983ee8feb700f793422451c8d105301784dd003a4d6bcee1ccf5040232b1ecc9f176b6a9ec2523faba6aa7fc4f3711518e55e2053aaedaf0cfcf81591d13aa5800165f1b642762751ac9e9b9c2a8fd494d6b0c0741f55e07e0e7288977b9c45a7c4a034fc3f4b461679ae1f0d0c31a579c82e0c352a39719be8da9100c3eecf6c0f3cc79afd6bedffdadc536dd1a42ffae9a48ec5eaa4bfcdec07b50f6a3c814e1ddc492feb91e1ed816c22bbecb1b2abe49f8d488f621e01622c9cca3f0662e69107c6616594f5a834fc7bcbe78db2cbad147ea916cd94c93ca8d7c449197186b71d21ddab6a08c3207f440ce6787a11ef46210b321a0ff858123ec0da2c39a0b10fa8c21804c24f67d1d1c80e3eb09024decdad78b37c2adef0ad6d0cb9a65c384d458009894e02acc76adc30540c8dc79b042553777ede44f6dabf2acef80c45bbea93adb012281b1ca63eba6d12988f2e1176dc1fd7287326771a0847a4d66afefb920e6200a7c29e72f2805d48ed1081d92607e847af76f4f4fcee2a90dd243071382421638c7d601306b341fe3c483d95db9c1c6f3408a8a84e9bfbab04be8dbcf4207de9e6c18b3d0aabf8fdb59383874876ee8efc1fd22afd777fe024ae7ff8f45ea245ca58c1b5233b5d295b340e653e2e0c1bb525be8c4fa11fe831166ee5892f6a15d7890c884a16570703c8e448f8301ffc075d04d92b10284e0405933537bb3cdbef6bf7099d338f092e1c3879a2565116b2ea5e80fb50041824567ff52cbdbb3b1ee107eaea03f05085aa38acf4598cea58ded53512da6bb03e21232da8028cbb58a6cbd562b4727e99b2d9402940d068840f11cb2e7da66696861f1981855653f96d90b4886e09c0f1a76ea2d14efd7ecff802c29d114cfd60587a1f9b784793ee59f5b9e76e0343763b45841c25d32d5f8492f2e44059c1ffa239f4d851c36d1bd2a345d2de709082b57f02db4900fcf8584a23b9a6f09fc156c87fc693bd0508aa3fdf362e1cf9a953bbb5222ed03e2ea4eac179110aca3898fca863a91c0bf591782b5df4d11ad2d6a433cf2def3702de3f1bf28698a525df11143489120c7d7480c0c6dcc3d433a393dbc59ad93d3d1c07c249a496759b36e29ade374cf94baf6629678802cfc638d4290cf9528578c7b8cb3304747607a3cc15575e624f0bd723e11c8b547ca085432e60c31285136be58bb08fed1330a85b9b582e0220d056e0dad96d2d378b7554cd9235028131ea1bfec0411566f93eeceeac5b9dff2b9663def2f21ed9c5fc5d9f7212f625d8e434b5e4b56610893225d832cc37fc497b2bd1ac5153f1512eb4afd1f829ece1414abe4d1a8247fa81b011103d49a8be97cb3da416efdeaf432fee87afda6c7bfd9f3bcd61bffa1edac4f3da43915cbb8eb8f075ba104612762ed7457f1850139e39c7c759a0d5d8609299544d17d5f98e1c49c6ea844e39a967598b22180f2c4f9f7e3745bde882b29c873a68dfa396ffd22afda6cdf1aaaa9b21c9ea52011e0a3bb6cb877134e5341e5d58770f290f844f03e28b0c783eecebc446765b69ad0fb14ef244d9598233bb7bea9c9f01f00a7483bf3f991c2f6921fef2a945b50a2ed7db2ade85518e0b6b808a4e70216238d40602b1919a1031ebe0473845f5de00cc75b95da25cfbe82a06a2ffce4ecca3ba966a5734ffc262724f190335bc0b5b475a4e53b8e97870473535274c225a71f6d22c56da74ee682382600ebc19a0c159694ef01450372a63cb67ce42c9c671b686aad1a53535635ee119ad71f0e14d819c30cf7b0fe94c6a072908ec3323b7e30ca537e9238b58626ee255490f2e43b1d5f0b78946a502292ded482821ba6b2fd5ac543f663b3d67beb50aa60e4880c14b3c0771068aa652ffcbe5f64793973699aa9ca1430a8a68ed8b48ae11084e9f418a7a30325750001f4e5983d8de2dd0772bb6180cfd150f8015c3dadd1ef8cdbe2755b43452120300353fa3906471583e642dad4c8a6234777addd3e8e81b04080b7628993edc47433eaa8751cd02e2e8000eda43e13f178acab485e1b9b12f6a26576a65a81efecb7e1c230513eb3520c77b8b445fcc3ed96b37a87d0c7670b61341bdd3b2da57d0defd0ee8b0039f4b5b6cc9d94c94c9d6de5ef31baefa269b3c10e12e675b3c91ae51aaba6c0c1e2dee83c0cd3e9dfc3bff52f5ce756d753026287ee4a43b6a73ac2cfd08a7fa8056ecdf953989d5f1b0dcc7b5a41e59a7fd376c4e5d41003141024667619d007037054c4e837cb87e977ee4350ae6cd5efdf34a727aa39d23bc3aa31da79f2498662b0ec96adbbeaa8b426768af287dab07bde89e9bbf999d49e8f56770ddf023ca65f5475fdeee33cceb8740c29a9f2723c5d5619380a8c08dee8907e36c371ee69318ee678529a18eb9991335607e51d52dd9675d769dba012669b675ec2e35eeaabf749aceca1cf175c3d12e34eac760ff4dcd194fca4dc928db580bb6e17c7268a5dccd059eba9f0924f3ede97c7858a9fec9c5c2769b6cd6acacc0be689190f27110a491daaa5694e30eb515b3676d81a76d393d85d331634b754f406b40a287009c6d4dc8beca8168469dc90063ce46002fcc63eda0587e1f917b15d5e051cedca184c19fe14aef733749af1e9da107815c37d0e7bfa8a06b1859c1c9d90435dc6dfdd2060b061284b34ceb51fa881db5546e6c04ec97d46b88221a5852585cfc4fdad8265852548e03b0f09f3b5fd2d6fbd10631edfeb1e2cfd459d039d2bf67196b1ee8954bd59d9b0f320c78a861c44a46b78649f0e83c72f16230f67d8c45e66573851dd0c50147d46eb9ed5c445ef4c6acd2ca51301853359f8c292c8dad99587b8441c8a6fcc34026bbe988e8903f1aaa4de1f9499175c0efcc6578668441ab04d90065215b8d6672edd3b7e85dd6b8c290a52872b7e921a14bd42ee90cebcd067b5f3e690bc982c5b02253e344d44f47a4989cc88f51f7a0694cbe3b10da7c612dc37fb6723b3f763c701d62af0b09dffd318f9c9a2ea456cd4b8c25c74e9ad4cc22bffb95398dc737faff2cb3c112393d79b7330f8c5a466ba7e668b3eede435eb4c95f890fa77cc1558ac5ab5a90da0a685a99bbf0a1b161d741ac205a788a84c96ce3e7ecb5a1b8ce2c1c32e1bc0841a5d0eef3453a34ca72a4b72a2e250562128c5750ec9b6f0e38b3652be0a5fe10cf05c52d7124c4928452528bbed2b4e09eb6d971dbeed5c7afef01ee4019003c113051addf307844a17ca0d7f7c5444cdc9b925dc6d63f41a19252cee1b848bedb27cfd7d17995a7dc7d775cf7a482de821bec44e61d0b68abd37bb6263b975345871ac217806342228af9c012daed0143a1c0bc7c3a7418c2f5bd04d69cf2fc9a992b6332f9a707cc638e72549ce38a54c573aa4f4457bd3bcd3393018c1fa8fe850a71e579f907d98100c9200edaf707fa207aac565aa93aeee6988052cbe4b632e9f004247d5c132367672f1b30bc5558ced1049fbf4f02dec208582a604a2d6ad7fb41ae7e7abc03098a2fb3c31448b754a140308c2e5390590c989b2af2f9e6f7e07306f3c26795afb405b9cc56632394c9de62c4fff156284d5dc404a2df5098a94534bf0e996f561a5a5f029687e7ceedbd123cf0ed0240ea1eaf4b8e3cc4d8054f290735be2ed83933543e658fa02816ac3f33820420dc6b23a4764d30b234407986a935943981140ea2bfd91beb83dd033d3b4dca0b1b38dabd28cefa8d32357c6c06d9912979feafda75f361bbf4b9c9a5e77bbfb5c0642b162d89b2c67d5dcbf08f2cec24da1e6007087fe667", 0x1000}, {&(0x7f0000001500)="aa291c5bbdc6d51868b37293d08a71714dbfa66875fec114e1808f636da5242f7b60ee7975d372700f19614bf1f2fd755b6d0bdb28a611a22df6820929ff118908e6797ae9b7ca9c68f03ccb7cc7e1fc869c3415bc4347eadcf9dfbc596f0688f0c8484c2c400a44e0c335b1fdde846a8fc39b419e7782c6e749cd0ec238845ee6ec8e3ab6a137d763a1a86776db1327f2ddaf94a42d6f1024115e1a9415c4a0be373fe82459b9de32650d6b54ce9a3b70d1b7d456ac9a3dd88515030a240f2e4f4d59249628c22e0fded00a6d99630e7b82ddca6be312fe1f09046a8deaf80bbcada86ce4f75bb7f799501b3193c6335e4dc3", 0xf3}, {&(0x7f0000000040)="b809aef5afa49e0a637ad7593b0067da0059", 0x12}], 0x7, 0x0, 0x0, 0x40010}, 0x8000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ftruncate(r1, 0x0) 04:30:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000340), 0x0, 0x0, 0x0}) 04:30:39 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigsuspend(&(0x7f0000000000)={0x101}, 0x8) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) [ 571.166920] binder: 24065 RLIMIT_NICE not set 04:30:39 executing program 5: r0 = socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) r1 = accept(r0, &(0x7f0000000000)=@ll, &(0x7f0000000080)=0x80) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000240)=ANY=[@ANYBLOB="ddff6052b13612b23245f5097dd2fe03de304609e642c20d3a568c2ca462f9ac65f06d425ce3bd71861d604c5ebb0c6cb533e0962b2b9a7f27833e72ba4c1601cefe11d74c27b784438b5de5bd0ae4a2709f65a588d669066eeba5f9d0de6d2c19f25b8289d738ca2107cf02359595ec9ffe3544c219da8f45146761905a14593dc47d0a00000013f64dafbff97a4b73e79d0924d3113c0b8d6b68bd70f0739b6440fb0ccbc6084edcaed57e2f29b05a151aec995c894e0779d65035f278cb99f0c6b518046242ab63171d15a87096b8792bc6fbeed10dcbf2c14f2ac7f5c2230bf9949c1244244c6992d8e8281a49206eff855b8747e8556159d8572dde77b640400eb87fd6f7363eeeba2eda0c3b451d3a", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000000100)=0x24) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f00000000c0)=ANY=[@ANYRES32=r2, @ANYBLOB="01800800ba030300b907070006000100f7ffe700870fad77b7893bc07c39bb45625518e194dd"], 0x18) r3 = syz_open_dev$midi(&(0x7f0000000180)='/dev/midi#\x00', 0xac00000000000000, 0x101000) ioctl$VIDIOC_G_EXT_CTRLS(r3, 0xc0205647, &(0x7f0000000200)={0x2a8414f08daf654, 0x3, 0x9, [], &(0x7f00000001c0)={0xa2093e, 0x2, [], @ptr=0xffffffff}}) 04:30:39 executing program 1: sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:39 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x3, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) write$P9_RSTAT(r1, &(0x7f0000000100)={0x4b, 0x7d, 0x2, {0x0, 0x44, 0x3, 0x200, {0x2, 0x3, 0x8}, 0x800000, 0x0, 0x8001, 0xedd5, 0x0, '', 0x10, '*^\x12$![GPLkeyring', 0x1, 'y'}}, 0x4b) 04:30:39 executing program 4 (fault-call:8 fault-nth:0): r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:39 executing program 5: socket$kcm(0x2, 0x2, 0x73) r0 = add_key(&(0x7f0000000000)='cifs.idmap\x00', &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffff8) keyctl$get_keyring_id(0x0, r0, 0x101) socket$kcm(0x2, 0x2, 0x73) [ 571.494017] binder: 24086 RLIMIT_NICE not set 04:30:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f00000000c0)={0xffffffffffffffff}) setsockopt$inet6_MRT6_ADD_MFC(r1, 0x29, 0xcc, &(0x7f0000000100)={{0xa, 0x4e22, 0x200}, {0xa, 0x4e24, 0x8001, @remote, 0x4}, 0x43ff, [0x80, 0x800000000000000, 0x4, 0x6, 0x9, 0x0, 0x6, 0x7]}, 0x5c) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r3 = dup(r2) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:39 executing program 2: r0 = dup3(0xffffffffffffff9c, 0xffffffffffffffff, 0x80000) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r0, 0x40a85323, &(0x7f0000000100)={{0x1, 0x7}, 'port1\x00', 0x20, 0x90440, 0x4, 0x3, 0xcc1, 0x81, 0x2898c619, 0x0, 0x6, 0x5}) perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x7, 0x30, 0xff, 0x6}, &(0x7f0000000040)=0x18) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000200)={0x0, 0x8000, 0x6, 0x6, r2}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ftruncate(r1, 0x0) 04:30:39 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 571.724388] binder: 24095:24097 tried to acquire reference to desc 0, got 1 instead [ 571.754244] binder: 24095:24098 unknown command 536872576 [ 571.759994] binder: 24095:24098 ioctl c0306201 20008fd0 returned -22 [ 571.775060] binder: 24095:24101 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:40 executing program 4: r0 = add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) add_key$keyring(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x3}, 0x0, 0x0, r0) r1 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000040)={0x8000, 0x1000, 0x202, 0x3c4f, 0x1, 0xfe7, 0x7, 0x9, 0x0}, &(0x7f00000000c0)=0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000100)={r3, 0x100000000}, &(0x7f0000000140)=0x8) r4 = dup(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:40 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000100)='cgroup.procs\x00\x8e\x97`\x14x.P\x80\xdf\xb6|\xb7\xb5\xa6:\t2\x1emM\xdd\x98\xe6\xe7\x81a\v\xa7\xd4Tj\xc9\xa6_\x06\xa5\xf8\xda,\x19)\xb7p\x82\x9e', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) connect$bt_rfcomm(r0, &(0x7f0000000080)={0x1f, {0x7, 0x0, 0x81, 0xfffffffffffffc01, 0x0, 0x2}}, 0xa) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r0, &(0x7f0000000000)=""/126, 0x7e) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:30:40 executing program 5: socket$kcm(0x2, 0x20002, 0x73) socket$kcm(0x2, 0xfffffffffffffffe, 0x73) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x218000, 0x0) ioctl$SNDRV_SEQ_IOCTL_PVERSION(r0, 0x80045300, &(0x7f0000000040)) 04:30:40 executing program 2: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x400101, 0x0) ioctl$VHOST_SET_LOG_BASE(r0, 0x4008af04, &(0x7f0000000140)=&(0x7f0000000100)) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000000180), &(0x7f0000000200)=0x4) ioctl$DRM_IOCTL_GET_MAP(r0, 0xc0286404, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, 0x5, 0x4, 0xc, &(0x7f0000ffd000/0x3000)=nil, 0x8}) perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000000240), &(0x7f0000000280)=0x4) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ftruncate(r1, 0x0) 04:30:40 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x1000000000400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:40 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(&(0x7f0000003200)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:40 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:40 executing program 5: socket$kcm(0x2, 0x2, 0x73) [ 572.233841] binder: 24121:24122 unknown command 536872576 [ 572.239536] binder: 24121:24122 ioctl c0306201 20008fd0 returned -22 [ 572.261413] binder: 24121:24138 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:40 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$sock_SIOCGIFINDEX(0xffffffffffffff9c, 0x8933, &(0x7f0000000100)={'bcsh0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)=@getqdisc={0x3c, 0x26, 0x0, 0x70bd28, 0x25dfdbfd, {0x0, r2, {0xffe0, 0xfff1}, {0xfff2, 0xc}, {0xf, 0xffe0}}, [{0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}]}, 0x3c}}, 0x800) ioctl$DRM_IOCTL_RM_MAP(r0, 0x4028641b, &(0x7f0000000000)={0x0, 0x2, 0x7, 0x18, &(0x7f0000ffe000/0x2000)=nil, 0x75}) ftruncate(r1, 0x0) 04:30:40 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:40 executing program 5: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x228801, 0x0) recvmsg$kcm(r0, &(0x7f0000000780)={&(0x7f0000000100)=@can, 0x80, &(0x7f0000000640)=[{&(0x7f0000000180)=""/74, 0x4a}, {&(0x7f0000000200)}, {&(0x7f0000000240)=""/238, 0xee}, {&(0x7f0000000340)=""/37, 0x25}, {&(0x7f0000000380)=""/63, 0x3f}, {&(0x7f00000003c0)=""/99, 0x63}, {&(0x7f0000000440)=""/212, 0xd4}, {&(0x7f0000000540)=""/159, 0x9f}, {&(0x7f0000000600)=""/43, 0x2b}], 0x9, &(0x7f0000000700)=""/69, 0x45}, 0x0) r1 = socket$kcm(0x2, 0x2, 0x73) r2 = socket$kcm(0x2, 0x7, 0x73) getsockname(r2, &(0x7f00000007c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000840)=0x80) ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000880)={0x8, "038bf15a2cd8fedd367d21e99953e780879a400bdfd14daa7f3f8ee657f7cce0", 0x1, 0x8, 0x2, 0x0, 0xd, 0x0, 0x80000001, 0x700000000}) setsockopt$sock_int(r1, 0x1, 0x2f, &(0x7f0000000200)=0x134a, 0x4) accept(r1, &(0x7f0000000000)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @empty}}, &(0x7f0000000080)=0x80) 04:30:40 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x20000, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e24, 0x81, @dev={0xfe, 0x80, [], 0x20}, 0x1}, 0x1c) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:40 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0xffffffffffffffff, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 572.592751] binder: 24158:24164 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 572.702124] cgroup: fork rejected by pids controller in /syz1 [ 572.742384] net_ratelimit: 22 callbacks suppressed [ 572.742401] protocol 88fb is buggy, dev hsr_slave_0 [ 572.753433] protocol 88fb is buggy, dev hsr_slave_1 [ 572.759569] protocol 88fb is buggy, dev hsr_slave_0 [ 572.767072] protocol 88fb is buggy, dev hsr_slave_1 04:30:41 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r1, 0x84, 0x1c, &(0x7f0000000100), &(0x7f0000000180)=0x4) r2 = socket$inet(0x2, 0x0, 0x2) getsockopt$ARPT_SO_GET_ENTRIES(r2, 0x0, 0x61, &(0x7f0000000000)={'filter\x00', 0x46, "db99cf8cabef39a0ccbe7441f1df17286fd1c96922eb13834302993d2cadbacb8f6e6f95e317f06826cfa1e45236407273444c7529453b3b7493dd267c4618c25b72bf3b550b"}, &(0x7f0000000080)=0x6a) socket$kcm(0x2, 0x2, 0x73) 04:30:41 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r0, 0xc0f85403, &(0x7f0000000240)={{0x0, 0x1, 0x7, 0x0, 0x3}, 0x0, 0x26f2, 'id1\x00', 'timer0\x00', 0x0, 0x100000001, 0x6, 0x0, 0x100000001}) r1 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r4, &(0x7f0000011fd2), 0xffffffee) read(r3, &(0x7f0000000000)=""/126, 0xfffffd6d) ioctl$TCFLSH(r0, 0x540b, 0xffffffff7fffffff) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:30:41 executing program 2: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) dup(r0) ftruncate(r1, 0x0) tee(r0, r1, 0x5, 0x6) 04:30:41 executing program 5: r0 = socket$kcm(0x2, 0x2, 0x73) sendmsg$kcm(r0, &(0x7f00000019c0)={&(0x7f0000000000)=@isdn={0x22, 0x9, 0x800, 0x3, 0x5}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000080)="59dd70f3d7fb13ed81846d4dcc04ea3b79b699d7a704a2ef7016557d25d3a1b623c55fe691bf9f632dadd23ae60b649fe2fb5cef2e97a3ed3013925d6b2e43228cb1d7b4bc23ca1c6240fd28f9583caa2f8c436c2cef46472ee9578499cd19c4c833055515570b34129d83df7b2346738531fcd138bfe07121db2a0a317248d753804a24915788f37d813ec6b850042696654dfe0fa714ea6fe904184c1b49664a2e4ad756bddf3ee14c9a5c60e3ad244aca20275b079748b8c3690c", 0xbc}, {&(0x7f0000000140)="fad348ad0fad7437ec973b7d3562ce0eae5d68ee9bb579847b604f3716c3c0d6b17cf326f9188036350e027ece8d4952aa2f941976ff16e5e5871f9067fe7751b1259ca8a5e51859b6a988d878b7942bcb73aeba8f648bf6f8d7133ff99f55c0349811d3e6a7cf7d5ccd548a6229485d582beb87bfaa004d852774197fbe7e6367d2559863434645ccd4fb2ead9e2952dcd065ae4382953dedf855f8a7d57054ad8541233317ceb09da332c3b73fb2e7b9519d87b9680d1dfa", 0xb9}, {&(0x7f0000000200)="f4e0da0a3404ae574598771a75d55596", 0x10}, {&(0x7f0000000240)="1160527eef6776d76993fe2caffc129cca78659f8afbf3142a9a29d66d29c17a2b0240d948b3117d048a00729df6ad1145d4278766cec4a8dc", 0x39}, {&(0x7f0000000280)="0cb23b9b59cb45727e7c50b89c58d1859ca05c12ae32ba4ebf15d9a7b12e91bd6e7854edc5e6c123503cfda3719162e7005b040b6a3b43837c9afe9956f1c4596d3ae73e0638091d6888ff07794143924e9241c4ad304d552e302cfcc32e4f7cf11085bfdc8e5641d0a7b9ba8253fa6942e211440b4cb32989b425dc5a8265bc98f2575a0916ed8f9f6e35b866c3f7f05bddb47fe5abba4159853f9683bf7266a3c4abbfaccd641e19ca38b9bd21b4f8b0e98be1690a7eb183187808714aa76997f6ff457aed30619e85dc3c654b8967b3012c7c5c9d112932ab8a40f3ccd4fb55a9554f46f905a80b", 0xe9}, {&(0x7f0000000380)="5b5884815b07f7db3ff435462e5d0b1cb1172784521819f384ca0524599e8ea41afde409f33d258372ad4c909710d4d9ac19da0f4c54f06138", 0x39}, {&(0x7f00000003c0)="4ccebded912017", 0x7}, {&(0x7f0000000400)="949d530f140cfba6f9dce253ddfd44613eb230b50564abd7a195e10eb42d667c61a039d981b62c15fd37f3117dc1c7b0614f720b993cf0e3a9b178237e8793b4d05b7159827d3be928eff091557937cf2b64ef3be0cda088ca0ac1e2a2f523976aa90c2fb2953484878f6e0f4bd0691372df4a585a74d0bd10358e5bd2b25f421a6cf445de3705c099b5158a753e5bd931e83995f606702d19c68d99bec0e9567562ad4c42c9c5e1cc22083946b715512a7e592c03bf6db540c82e", 0xbb}], 0x8, &(0x7f0000000540)=[{0xf0, 0x0, 0x1, "22859bd7ff8a48399bbade949192bdff976b28164873377832f3242889795c69f116a81aef537a082c7737e3c42b3bf70de83d6caa468a0c5ff1bad99de3220340e2e788bbf785bf9735bfa094e85cc00c23fe66e3c57bf3f2728486583d6c326f807e9ec1f8c1e0a118bb6c7f4cff337ccd9990c4971a6224c20f822d595852ca8b5be00ae0ecffe7a29642337cd2ba388d9a81527856d43bda959f33be5d689e2220fc863b10300bd670e1154c1a1d348c00d0b2a19a63abd7201098ae88a5fdb9d464ded7c3c3e401f6fa4b86afdfbe7a1b0910f3b7206c1e3d34"}, {0x88, 0x105, 0xd03, "9adbe137fa9a32e5002aa295c9d0102a146e5c45ad4bc487a152c5914eeac67760ea54f214dc42bc8bf83b31c47c23e9134215d6789fdc73beb20b2e78776d1159eb18e2462e7bf4a357067c34a9d3d5f5ee5ee7824edb0940a69b3361ae37b4df45efd9ed793e3f0d3d538cb67375b4d6da17bacb28d515"}, {0xa8, 0x117, 0x3ff, "0ac0139b7c83cbecfe06248b68b910e41007567ab26bd4e36f5285fb531a35a5270fb81c7cf79fb6a79384f6a5563f7778b4156fed5f4fbdb713ee0a4ba49769350934042fb1b4a18c91ac0f4a62cc792f1a6c80124e74694ac4fb4a2ba9d49e6c4faf32f7e3656a78944073507cc8c29807ae6bac5e892b874cd00d7815bb5e0884a0cb56ebe878ef1deabdaf2a2f1066be89084231"}, {0xf8, 0x13f, 0x8, "d91f5953b108acbade0b5698f0158ccaf2cd32ca531463acb6b8df1ab343f03e2d75317f9b61a4da24b95422b0f9ae6837b43a5a6c57a6b30200d8b55b13274a7cc72b0d49c64d0aaa03f00721115e89513dca5576ee469408074694daae26f43f1e89c5e04a86310e80c8e9e58820692d8bcffdd319753d084f94f407f1f845c225f8f5e143600d5f99373d38e50af640d8747d5f4edd53258b8db3ff849cb27c52b3da43af299775628811c9d9b688d2c628729542a44c188f976200f6fdb4fc45a968d68e0dd37d7784022669f7aa8f3cd8cf65521a2a83a6cc4e82fa25a12fbd25"}, {0x88, 0xff, 0x9, "23fc2ba59d5292fc1883c58eccd2fc454d44f2bf5abbe4cb343e8d28bab3160d2e3dd32a47b7f71d16960aa2b529920577ae90a7d302c1e9ebc032a0e1a3775ed4494d648820ca8832dc122453bf953559ab93e14e37deddef3628b7de166e35fa085eecd21d1af19f98b013810bee44fa36ee"}, {0x1010, 0x105, 0x9, "7d1b4a5c6b534d0267fed095f458c1f442676ce1cb2bb69c5dd1e2d57907c24812fd3ef2dc8a3fd44e03cb932942f198c23edf2616265f48364d15c70915c15308fb65a56dcbad71c70abacb6e509520e601df1e1b8aed5104559114719b672fb4d19f7b73074c776668198cd72813092798ad2a293521142787dc8f77f9d711cfd9e544c73610958f8e0de36b71556c2d15d8a1a82d3030d54f063388aa2fd5d92e9f757468b072d1a92f4e16f939d7536387b57a7dec06212a1d6295aad77df232f1549e7f5dfb54318cec7137914018f65fd56759ea18ba7308437850c6d0d37eefa69b18359c247f087293f7e0441f639fae4f50eb380b2b71cbf94b538e1ed7a3de598600e06f78a7891aeae621225d36fd9f5b927a78997d6cf79933e6ae96891cda7a94ed51972b4f2d20bbc548ebb3990503d5bc9c7a11155a764d9c9cb245003875afb08601a38bb650aac95a4f8f405393c0ec8f51d09a15f582a3a1afebc4a73cf31bdcd453642de7d86f7f48c6a76d6b4d0f9c5e5dfbd0373672a25ed5e610332c62ed9b043cdd554dfc9c5d8ce5c863e88ce8426951929508cacfb526a17a5eb503f6fdc19b762df7486570919f6b721cadb77a1105dc24cdb74fd866ae1f71287b43f9fa83b4b0d55a24bf80734ec4208cb979e6ea53d21901804f6982d293ff876b4c7021c73dde92a3d0c33ceb8ed78f58084a3db0201f9af73670cdeb237a33f00349876203ee09b7b1dd1b8dea2dd4e3306292494d8ac8c59abc0b47ecbf1a9a4322b0480abd86a544cce3c86e5ce2252f751a8656d899dcb720aea264f0a7dab66bb0ae0a8acfa88af740372616f68dbc072ac622ba28e5a4abfa93a19628eb60e6c4f3d7e9c40b0d90b7f05ed850ecbfaacd6cf030ea6dbe3ba231ad409b1268f2873ec1cff8b18185ec0c707c63b002620d519fa855f70203fab075d5b096a30dd7a227b6eeccaed4422c67afba5987123336dd5dac1a04ec04a7b8ea8315d107e92ef02df44ffd038fe340864f022088727c8bc1a433090448aa5f59b01bc75d515ca93f461658f012af03c3d4d67180f8ccf713b7c1424538a59c01a83887566137eaf872fe7feceb4ad8299c5e0d65de323981e03ba8057b9aeae582056f1dd3c9da8da2be246f236431057a8ea3879a000fda910594ea68fcfd0b80612ea20811679af7fd7b6570fe8e9cfcd34c8265fb0298a9a74c6951c63706866e34452114ad43dd851ba24a56261c0fc168cddd5e26be975b942a6b31844b2ae8170ed7ee27b578d6215741a6066adc16237e4cfe8b5e6caaf782bd61bc210264538e195efb6903a48742568d71626501663d23cc24cb579eb7737b7e1f828c8eadec401a0e4dddf5e1ab5970f4c787e173cdd7206463d05325e314c310a373ea075c66c7c9875e02c0efccac93eb42f28418efe764740ffc3cfa6b706507bad1980df626c340782853e2b1abc24ab9234a8d338504a1474b642d0b5c73536d9658911a8f0794a5a0bc1c5440bb779efceb5a71a6e3db0df228a742b764b970c7fec54ed8dea27d61c8d1d5f6d48d6388ac6b52283101922e6e49519379c18cff1cd4e468e90b505a8567f73bf40beab6d1c78e6e9f7509774126e9361540b752e31816e71bad64db2878f2da8e6671595d32952ec6c19130f7cffaa597ae459381d42c57885b06f6a237b9e378b2aebe6b7e553b18234ea85082d6f824994dc6e82b30fbb5e9d6652e6e63d9576f6e4b397a58304af9bb9b3084dd07b190d9efd4fa0b99f05d1452d811ef853f7353764d15ad06701f7f6005baa042814481e5005cbb179d5340bdd17f26d2201f6042e3cc43d4846f5a7c1458896995455f8b2a33bc23b3f9f1454ff4114ce3c2568d1fcb0da551acc8afa404c7b3996b9365593db61ae62af266e33a57457a3890e248f79146eb9664c0a7017772f87dc6ebdf0ea23d20a400111b599429bd161f9a65fa061ee9ca46f95f0102e22076115ad4a59168fb42342ee7648b1b3c90ce5bd97e1825c2acb2f8c69075f0e50ec89ffb6544fcc8bebe0d9667ce884293819116e6cf2fef31035260f3fdf1eafe21e3038d93027ff5a86a4b9ad8fd15335ab693c58957ba4d456b909aa0e8258158865a106980e6c3d0dcf3712be4718da6fd6e21f896f75d070bd49573aca641d8a7056773a96f74c407a35c4811a5e646e8232428dfe3f5f1f8314cfe4555acae0e2e23e6522261643c286ec87d301c27d35802542086834c172864b722ef57ad5ee98592d72dafaf889e71b05a9edc5e187e48241b8ff5262f614eabbc4d350a29ef3f1d558663beb8a259ac39bcb1a010791293a7de68ef643f26b6077d2aac782b7f8a0eb28f6a0315b341bd5abf72fdb5454b744309345cd6291bf0d4ac57cc202856f7c83f0e7bca9b87497d4997750b4e8e75fe5bed2d56e7fb484acf929d65fb4fb83a408c88ba572ff1fdd4b5f2aa91fb3277896ce99134d1ee3dcc853ecfa9ada5041e286de482742e4f97dbb5b8ef3f2f4277f4c7abed17c292b72128d19b7881f2fe53aa428e79ec5e550043265aa28bcdbe1c148a7a556caaf2ad2e14541fdec9b95a2067952656b5c4f8e7898754314cddfd95c00675790e0a0cfcce639b457d9ad6252818e9f69543cdfb73978c03f7ad10b4433eb3329e20c15e743960c26fd0b3f7ae8721cbdbae77eef53313a1c4e1e0d2102bc3417f1b3ccb44353547a0d0ad3f58507399cad4b7cb433924dcbb7a3e0f07dc67da29ed25cb3b6b60329e367018972d6f9629658e9fc3b26f418e2d00b57c410d7fc643357683ae8baf19fe6c0886ea11b85e6969f8986b1939838139ec89bc3950680f2e89983bfaf774acb7544e1d500d7e0c275fbce7cf6f52b716eefd59735a3c1836d71bfceb08ee01858a2e7a765a551448370fa1ca68b3f551b49e407f64ea7f3803d0b95d2280762967af63776a9f05a940f49dabda2b0e25eaba077d4cd80d4a52f8f2073af51cb9f007ebeae707b4087a1dc7fa93a285a6aabb9cc48f386dead362e640fc78bcb4b3118b505818e408e4829d1843b761c8e444accd76788abca612dc863503291d0941d9a9f45ea6ef94cd9855bbcbede7d6a30f7362f07732a151d610528b6a03dc81b83705b78706a3146087ef27c565d16642e9bccb338e7edee107f6a54ce5a20e297bc9306654ae8817556a180862ac2e3cf18fe30ae29477237accc8ee844e9fca7a930fda0ce4cfe4b03e01a9088e7d6a0d25b9d6d8488813df97af6132e18a84a2f0a4d48d4226aa71e963db2edb7229c2c029e8b2ad325f5a04a83f7e0b0bcd327d38a072e395ccebd5abed5fbb9c8051b536254378e9a143b0f8537b096d2e36cce3b3c3034237224ab2e9e465de1ead7d9e29ddda159648ec91f630e939358822e438b1102d05710ebb94d13e2e66f7fa4bc6121c39a27be2fd11812f796b02833b7171452d670ed31300bede0fb752b7fe6ba2bdf769ded355a11310ee8c0608a6be73a538ddda08ff9c1f461b35ead62578e67bdc7522f6c0dabc1359870ec56b432284b2f283ccd7861ff5ced16afae56d3298e3be5ef63bc548bbfda1d6bb649bd526ce9cff354707fd8c2b07a5a38135a648502f164e7471c1a0bbed01368a48769cfbf7546dc4af16af2298046834d94a10f0b2598be8d0e3b4c584e2202a92e04a194c98dd86e12b08c7451e9a8c672a0a1f8fc460816341aed8ed8dd0c15e840060b91196670f427862e08973e41a8bdf002e40104b377412df54780392e760ec7be0fefbe2e3aace29b89972a21d3c82ca8a27f284e4fc80a2a5d197fff40607bae47ca7f022fc3c37f6b8da9185c36a3735a103efccf0c5c9fa9f5a6c07e5c084f1fd8059fc4bcfacb21b3e769091d68c79da52c4b45030d16b8d03ba2e5d6918f5b8da5788be01bf27fe874f27e93560382886f6f58f60ce77c5c9a1d5010031397929e4239cebcb7004c733963c26fcdeee8b9f4be37f44630c5c2a87d8bba8d71f3d14d94327e3a5aacd6a18c7547e02edfabaaa5125d89e6235cf8987d327461d71944b7c12f0b713c52a0c27576d931961cb0b30cbd241d92e75984bf9eecfcdc5098af1bf19e61247a79aa70c133f50c1f799f0ccfd04d12d47725cb2897217a3eb7912e63ca215a2eb4494934cd6e5a63b60eeb69c5c36d2131400d14eb55fd3e0e4a09900f35a08bc436df0a9fe9475fb6b2b696a6dc39b8e558905a25a7f54edd332cee477783e8349e1fb56cdde8f7789e5840434d5007628a1bfdbfe8795e795f37e97c966d9c9cd4a970c94d7b6ebd9b8376cc2ab39f8c16d169c6e0b3b86b4d39f17212fc4344492f9690f0dcfcaf7338a77d179aa85a73c7504d7e7ee27bf91ffb42e3932d51003b531cbcedf17d1ec9daff16a15108d9c794701cfc580d99f20f7439848a201216b91853c5837dc0679b3c77377610033f5f36cc96168c9975cd278e55a631ce19b29041e4137ca2aadac1b1d9c8f1d37a20468ad15700e491265016d060691824d64e3fd0074cf2ed86b1fc23f34cc8eaee0e4b36b886768b5fbbaf6c23a3d1f1f611216e036219278878ec41b664043cda9ba94fc843de38d4af3e0a8b61a348934e26aca8b61e612235d7a0b25e4365ddc54c8c07221580e3d9da7771db2aa6c4a03f00b7ae4159524696065cecfd5057b893bc7d8e815ef2e259d3dbfbc2ca54c3d72fb08777a9d9ab67c9ccc1a0417eb678f66cb16c6e03d9310ef3b177dc8efde29aba277f0636b4232f460337a1babeaa52668d6d2acc5ad79ba3dfac2fdb16f87c5bb0f396e97bd0c3a1da40152a40baf207cd3c7d2eab88ea70e9e2630d4e2f869ac4c48dcbfdfd50fe23cd889734942321a7af20d5257e887b55672b5a4f26267bfc23321b0c7363c8f8e64aa938255914bf0e11e907fe5ed4c5c23fc41fa467f76b8333bf7d5e86c5b85360dee2fd81f6a28e0ac5f99d56bb60e4d570cfa7c8b96740ae1921b20271a12ccbefc4c8556449e4823b438ff664fb9788234c1fb042160d8f46a736fba8c1e84f922a9d6d0ef1a7e16897e711ca93bc07e0310fe36330351805df2c02b9248c2ceffcb915fcf3a455f1412f400e6ae165be4caf607f0b09bca1412948718ddd658c67773114195f5872dd11bfbc1abca86af83a09100210d3f6e70e6717caa115e6cbdaa0e7a8eae518fc782417eaf9e6b61b2da7918af5e3fa36362134e4b132a07bbd01f283e4cfc0af811ab20e5f10955422859030717a1ffbc6df91452cfb9b674b7e2405fe22b65490fd93eb0f9f630d0da8d6d516a94e603f646ed7f5117690b5baf490e1406b4dc2f4b883c215f120d700fe995d58dc77c366588edb052bfba0fec99df876fe3ff2127b89d6031a2f94cf9257277b44277773432de675867e72c846c8916d4ae6136a9f7ab3ee50c388a0df2829305a44d9ad85dec086939970c827417909c743d9a7746c7d2f6b069961dc1b64d69bd8e1d19e41c0bf2b0ad8a682848bfd968bc89b239c249205cb782edf5572a1af18d37eacb96b0460feb4b787915113c640bada62da84f5d9bdeb8b385f52b48080b634e5b83c789d2f118a690de8f9bd2b4539e2acb1303093167729718a2b73e3dec72de9a019df3fa689130d5b4dc4e7877aaf4d74f81283e3a73f17acd7ae971832c7d3f039e01dff156613524544d74aa05e414af26fa617408fb92ead3e589ec128760c695a8543f8b89dca327e5b004ebbbfaa255442121cfaecd013837193bb0b51d48f4b3f88b97ea0691"}, {0xc0, 0x10b, 0x2, "67a33c9fc40ea997cd912f2eb82c15e457f536d32ff29e7ab950e6ab431563b523a2f67ff822b79564b58a1286cf4236c0dbbc0ad902a1bdf56dd35d9f3fb3abb1abc9013c2a4dd87615d0bebc6bca33877207746db49862aae0258b15b3560d227e7bcb966e2e253740eeef764f292d3e88eecb55405bfc0b49fc71deab53c9f809572ba9a4ad673b6b7b0124da7a7c42a8088ca0cf895a38ae1da921b121938c68b23e15224d35eaf4540535bb"}], 0x1470}, 0x20000041) r1 = syz_open_dev$sndpcmp(&(0x7f0000001a00)='/dev/snd/pcmC#D#p\x00', 0x10001, 0x0) write$P9_RREADLINK(r1, &(0x7f0000001a40)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10) socket$kcm(0x2, 0x2, 0x73) 04:30:41 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0xffffffffffffffff, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:41 executing program 5: modify_ldt$write(0x1, &(0x7f00000000c0)={0x9, 0x20001800, 0x0, 0x6, 0x400, 0x39c, 0x7fff, 0xfffffffffffffffa, 0x7, 0x5}, 0x10) r0 = socket$kcm(0x2, 0xb, 0x73) socket$kcm(0x2, 0x2, 0x73) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x7, 0xf7623d1976dc2a78) setsockopt$inet_udp_int(r1, 0x11, 0xfffffffffffffffd, &(0x7f0000000040), 0x4) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x6}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000180)={r2, 0x101, 0x10}, 0xc) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000080)=0x3) inotify_add_watch(r1, &(0x7f00000001c0)='./file0\x00', 0x900) 04:30:41 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0x0) [ 573.337110] binder: BINDER_SET_CONTEXT_MGR already set [ 573.342698] binder: 24158:24164 ioctl 40046207 0 returned -16 [ 573.376227] binder: 24158:24220 BC_REQUEST_DEATH_NOTIFICATION death notification already set 04:30:41 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0xffffffffffffffff, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 573.382138] protocol 88fb is buggy, dev hsr_slave_0 [ 573.385501] protocol 88fb is buggy, dev hsr_slave_0 [ 573.390590] protocol 88fb is buggy, dev hsr_slave_1 [ 573.395619] protocol 88fb is buggy, dev hsr_slave_1 [ 573.405945] protocol 88fb is buggy, dev hsr_slave_0 [ 573.411514] protocol 88fb is buggy, dev hsr_slave_1 04:30:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) r2 = syz_open_dev$amidi(&(0x7f0000000100)='/dev/amidi#\x00', 0xf8a8, 0x801) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) renameat2(r2, &(0x7f0000000140)='./file0\x00', r3, &(0x7f00000001c0)='./file0\x00', 0x2) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0e630c403a1961f030b5cf001016a4b8f7"], 0x0, 0x0, 0x0}) r4 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x6, 0x220000) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r4, 0x84, 0x8, &(0x7f00000000c0)=0xf59, 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0c9c580500000000000000ef630000"], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r5 = dup(r1) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:41 executing program 5: socket$kcm(0x2, 0x2, 0x73) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r0, 0x4040aea0, &(0x7f0000000080)={0x0, 0xcdb0, 0x83, 0x0, 0x5, 0x0, 0xce, 0x7, 0x3, 0x400, 0x6, 0x3, 0x0, 0x6, 0x8, 0x5, 0x1, 0x5, 0x8}) 04:30:41 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) r1 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x7f, 0x40040) recvmsg$kcm(r1, &(0x7f0000000240)={&(0x7f0000000080)=@isdn, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)=""/16, 0x10}], 0x1, &(0x7f00000001c0)=""/91, 0x5b}, 0x40000000) ioctl$DRM_IOCTL_AUTH_MAGIC(r1, 0x40046411, &(0x7f0000000040)=0x7e3) r2 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f00000002c0)={'syz', 0x2}, &(0x7f0000000300)="4321ce09df7cf1f4b4a44be4a9efdea3ac463ee82a644d48961991349ec55ea85e19c0eaa2c90f6ba4f2d9d8139e1c97ede4dcdc145475557fe25b7d49240ce8b055b1b134d87954e7cbf398fa09f459da735dea29ea783fe664ba33959b22a58078e2b51d33b2580d5dac7e8ed43fc5c40924c30a721fba768e0ba83802eb19bda5ed4166b543ddc0eefc1ea31cc81fbff4", 0x92, 0xfffffffffffffff8) keyctl$instantiate(0xc, r2, &(0x7f00000003c0)=@encrypted_new={'new ', 'ecryptfs', 0x20, 'trusted:', '/dev/media#\x00', 0x20, 0xffffffff}, 0x37, 0xfffffffffffffff8) ioctl$NBD_DO_IT(r1, 0xab03) 04:30:41 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x406, r0) ioctl$KVM_GET_VCPU_EVENTS(r2, 0x8040ae9f, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ftruncate(r1, 0x0) 04:30:41 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(0xffffffffffffffff, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r1 = gettid() tkill(r1, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r2, 0x40000000af01, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r2, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r3) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000180)={0x0, r3}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 573.867962] binder: 24246:24247 BC_REQUEST_DEATH_NOTIFICATION invalid ref -262072006 [ 573.917840] binder: 24246:24247 unknown command 89693196 [ 573.923725] binder: 24246:24247 ioctl c0306201 2000dfd0 returned -22 [ 573.959363] binder: 24246:24247 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 573.999273] binder: 24246:24247 tried to acquire reference to desc 0, got 1 instead [ 574.020923] binder: 24246:24262 BC_REQUEST_DEATH_NOTIFICATION invalid ref -262072006 04:30:42 executing program 0: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000240)={0x0, 0x9}, 0x2) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$KVM_GET_MSR_INDEX_LIST(r3, 0xc004ae02, &(0x7f0000000280)={0x3, [0x0, 0x0, 0x0]}) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, 0x0, 0x0) ioctl$VIDIOC_G_JPEGCOMP(r3, 0x808c563d, &(0x7f0000000080)) 04:30:42 executing program 5: socketpair(0x9, 0x0, 0x40, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) fsetxattr$security_smack_entry(r1, &(0x7f0000000080)='security.SMACK64EXEC\x00', &(0x7f00000000c0)='\x00', 0x1, 0x2) socket$kcm(0x2, 0x1000004000006, 0x73) creat(&(0x7f0000000000)='./file0\x00', 0x1a) socket$kcm(0x2, 0x2, 0x73) ioctl$FICLONE(r0, 0x40049409, r0) 04:30:42 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x9) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:42 executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x2, 0x0) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r0, 0x5386, &(0x7f0000000040)) perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) prctl$PR_SET_THP_DISABLE(0x29, 0x0) ftruncate(r1, 0x0) [ 574.075357] binder: 24246:24247 unknown command 89693196 [ 574.080872] binder: 24246:24247 ioctl c0306201 2000dfd0 returned -22 04:30:42 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(0xffffffffffffffff, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r1 = gettid() tkill(r1, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r2, 0x40000000af01, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r2, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r3) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000180)={0x0, r3}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='%9*\nd'], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:42 executing program 5: r0 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x400) fcntl$setsig(r0, 0xa, 0x13) socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:42 executing program 2: r0 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video1\x00', 0x2, 0x0) ioctl$VIDIOC_ENUMINPUT(r0, 0xc050561a, &(0x7f0000000100)={0x2, "390ec8aac6b40cd298b24f391c82ca93d951564621e75499d40e2f5d9ad56ad3", 0x2, 0x8, 0x1, 0x80b000, 0x2010800, 0xc}) r1 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0xbab) ftruncate(r3, 0x0) ioctl$FIDEDUPERANGE(r2, 0xc0189436, &(0x7f0000000200)={0x852, 0x6, 0x6, 0x0, 0x0, [{r2, 0x0, 0x100}, {r0, 0x0, 0xff}, {r2, 0x0, 0x100000000}, {r1, 0x0, 0x8000}, {r3, 0x0, 0x3a}, {r1, 0x0, 0xfe0a}]}) 04:30:42 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x800, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x400000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x1000) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) ioctl(r0, 0x7, &(0x7f0000000180)="9037e0a3c5be30d6a014dfa3acebe2f89372296d69c87fbaee071d1af3dbeb3576567bab44bd8e30419d859cdbcb26c4943fd6a2eca64d04c85bcda9375b3af08069f0da1e7968516bf125e87a38eace1e7fbaa322cea42187a5ee6ddb5e2a5447af63ac42811081ccdfa902dfed928cc6b92d43fae61195cd9b84992e2b21d2e0972a3683c872e7330133f377749bebd47dc88018e1efd425ecbccdba118d316098fd1c7e49401ddbb30a75f4699394acfbe5ee7c9d27d26362b36e973aee03d4470ed89220b7ab8782e6d367541c230cd34d2d3e66899ef3a0d3b54427dec5e31b89a7f76e5d378c886e0310df12a319f418f4215799169d2e2cc8") [ 574.445455] binder: 24293:24295 unknown command 170539301 [ 574.451187] binder: 24293:24295 ioctl c0306201 20012000 returned -22 04:30:42 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(0xffffffffffffffff, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r1 = gettid() tkill(r1, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r2, 0x40000000af01, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r2, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r3) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000180)={0x0, r3}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 574.550968] binder: 24293:24295 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 574.585108] binder_set_nice: 5 callbacks suppressed [ 574.585121] binder: 24295 RLIMIT_NICE not set 04:30:42 executing program 5: socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x4, 0x73) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x0, 0x0) write$P9_RCLUNK(r0, &(0x7f0000000040)={0x7, 0x79, 0x2}, 0x7) [ 574.634436] binder: 24293:24303 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:42 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ftruncate(r0, 0x0) accept$unix(r0, 0x0, &(0x7f0000000000)) 04:30:43 executing program 0: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x14) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:30:43 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$DRM_IOCTL_AGP_INFO(r2, 0x80386433, &(0x7f0000000040)=""/252) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, &(0x7f0000000000)={0x0, 0x1, 0x7, 0x206}) r3 = socket$kcm(0x2, 0x6, 0x73) ioctl$VT_WAITACTIVE(r3, 0x5607) socket$kcm(0x2, 0x0, 0x73) socket$tipc(0x1e, 0x0, 0x0) 04:30:43 executing program 5: socket$kcm(0x2, 0x800003, 0x73) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x20000, 0x0) ioctl$KIOCSOUND(r0, 0x4b2f, 0x1) 04:30:43 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, 0x0, 0x0) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:43 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0x0) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x4000, 0x0) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r1, 0x800442d3, &(0x7f0000000040)={0xd523, 0x7, 0x3f, @empty, 'vxcan1\x00'}) [ 575.223000] binder: 24293:24303 unknown command 170539301 [ 575.228687] binder: 24293:24303 ioctl c0306201 20012000 returned -22 [ 575.254080] binder: 24293:24351 unknown command 536872576 [ 575.259797] binder: 24293:24351 ioctl c0306201 20008fd0 returned -22 [ 575.316833] binder: 24352 RLIMIT_NICE not set [ 575.337063] binder: 24293:24359 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="4a924c0d554b6196661bae850b58a095572816742feab9c4de649a21ac2229c3fccfc3484bbbd1a40d1f9aa7935a97d1dceb18e9ae18a0b81d6767563048efe43bdb64c4fcdd430e2c7f8aa9c8d1ff08e10b7e3671869fbabb12779ba2ab716baae613994998ba6b8cf61e81a4aec9732d0ca1b93d7738791e"], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_GEM_FLINK(r2, 0xc008640a, &(0x7f0000000040)={0x0}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r2, 0xc00c642e, &(0x7f00000000c0)={r3, 0x80000, r2}) 04:30:43 executing program 5: r0 = accept$inet(0xffffffffffffff9c, &(0x7f0000000300), &(0x7f0000000340)=0x10) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffff9c, 0x84, 0x71, &(0x7f0000000480)={0x0, 0x2}, &(0x7f00000004c0)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, &(0x7f00000005c0)={0x0, 0x5}, &(0x7f0000000600)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, &(0x7f0000000500)={r1, 0xffff, 0x107}, &(0x7f00000003c0)=0x3) getsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000400)={r2, 0x45, 0x2, 0x2cdd}, &(0x7f0000000440)=0x10) socket$kcm(0x2, 0x2, 0x73) r3 = dup3(r0, r0, 0x80000) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_SET(r3, &(0x7f0000000780)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000640)={0x130, r4, 0xa, 0x70bd2b, 0x25dfdbfe, {}, [@TIPC_NLA_SOCK={0x14, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}]}, @TIPC_NLA_MEDIA={0xe8, 0x5, [@TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x40}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7ff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xbb26}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fff}]}, @TIPC_NLA_MEDIA_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x400}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xb8c}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x20}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xb88}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_NET={0x4}, @TIPC_NLA_NET={0x1c, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x40}]}]}, 0x130}, 0x1, 0x0, 0x0, 0x80}, 0x4048001) socket$kcm(0x2, 0x2, 0x73) r5 = syz_open_dev$swradio(&(0x7f00000002c0)='/dev/swradio#\x00', 0x0, 0x2) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r5, 0x3) r6 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x200000, 0x0) ioctl$VIDIOC_G_FMT(r6, 0xc0d05604, &(0x7f00000001c0)={0xe, @win={{0x7, 0x0, 0x7ff, 0x3f}, 0x0, 0xe26, &(0x7f0000000080)={{0xfc1, 0x9, 0x2, 0x2bb3}}, 0xfff, &(0x7f00000000c0)="123cbee86456c0e4f2a7d77970c4f21aa39b40c82ca58ed56ad0732f64f2794ce715496d6fae54adf947a5fda726da96a798c7dd1eedf606f7e44338b7639e7f7dc1f208998cf430e32007769ca88200eb516de62774e346ee94336f407de6a1a1c4abec4b8cdcfb7ec5fe6bacd5ec9d67ed7494f07d8d34ced1b9ad1c306eed67c23ee15992506e666e596a8d7c1c1a7043fc4a0598156d5212c46e6c83d2e2ee75b043cf6575ea6065ef511d5904b6f3c370ae063aa3a4f2390510f6b70cbb2b60b082cf696eefcbd8aedca74bc875bb7a", 0xffffffffffffffff}}) r7 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x30000, 0x0) ioctl$RTC_UIE_ON(r7, 0x7003) 04:30:43 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x3, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0x0) 04:30:43 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, 0x0, 0x0) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:43 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) [ 575.714495] binder: 24385:24386 unknown command 223121994 [ 575.720260] binder: 24385:24386 ioctl c0306201 20012000 returned -22 [ 575.774221] binder: 24385:24386 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 575.793101] binder: 24386 RLIMIT_NICE not set 04:30:43 executing program 5: socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x101000, 0x0) 04:30:43 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x77c, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0xfffffffffffffffd, 0x400801) perf_event_open$cgroup(&(0x7f0000000100)={0x6, 0x70, 0x800, 0x6863, 0x100000000, 0x6, 0x0, 0x8, 0x44008, 0x2, 0x401, 0x3, 0x7f, 0x10001, 0x3, 0x7, 0x3, 0x1, 0x8, 0x0, 0xeace, 0x3, 0x1, 0x5, 0x5, 0x7, 0xff, 0x1ff, 0x80000000, 0x1, 0xffff, 0x100, 0xffffffff, 0x3ff, 0x4652b926, 0x59f2, 0xe94, 0x1000, 0x0, 0x1, 0x5, @perf_bp={&(0x7f0000000000), 0x8}, 0x0, 0x4, 0x4, 0x4, 0xb8, 0x9}, r0, 0x0, 0xffffffffffffff9c, 0xc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$NBD_SET_SIZE(r0, 0xab02, 0x4) ftruncate(r1, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000180)=0xffffffffffff2653, 0x4) [ 575.845356] binder: 24385:24395 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 575.882730] binder: 24385:24395 ioctl c008640a 20000040 returned -22 [ 575.935108] binder: 24385:24397 ioctl c00c642e 200000c0 returned -22 04:30:44 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, 0x0, 0x0) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:44 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$IP_VS_SO_GET_TIMEOUT(r0, 0x0, 0x486, &(0x7f0000000000), &(0x7f0000000040)=0xc) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:44 executing program 5: socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000040)=0x6) syz_genetlink_get_family_id$net_dm(&(0x7f0000000080)='NET_DM\x00') 04:30:44 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_SET_UNIQUE(r0, 0x40106410, &(0x7f00000000c0)={0xc, &(0x7f0000000540)="698eab050ac25531a3359b7c"}) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r1 = getpid() getresuid(&(0x7f0000000580)=0x0, &(0x7f00000005c0), &(0x7f0000000600)) r3 = getegid() sendmmsg$unix(r0, &(0x7f0000000680)=[{&(0x7f0000000240)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000740)=[{&(0x7f00000002c0)="1d025e1d03fc78ee7d6e4c4efa6467871ac82a468ad84a6225bca82c25d6e72d16dc7151ad0863943ca3403ad98891d1900e74718b32a6db7e7d818da9d45932f18aaaaf4e0d177ef38d4096c5c451113fae5a14772e90bea65b53398a241b2a9ec0a90593e3fd266418074795cd3e9459472d4dd300e8270fca4c2285c0c167a2b2d6f23983073dcb5dacb889112801ee85cb4867ff", 0x96}, {&(0x7f0000000100)="1a6af90e309262b63edd1b4f5cc572993478bafee7521d33b9b6b09493f8a66071fb31", 0x23}, {&(0x7f00000003c0)="a9b84782f0efb943c0103618f0c00dc5583eb2c761ac4e4702687e81dd142807c7728c234925ac76d62cc2dfa5e4ae894172a94e27ea61ef8ea261397350a4499c8b02e313ca1387", 0x48}, {&(0x7f0000000440)="be0328d85fe9e3fa9a4505845d839551c2b718a0c4912d12a35660b390bbe5c393d8cc9358b433064d00fdbc68d64524e7e2d73dacb1b66f841538fbb18c97de511aa72a8fcabd9738fe3c40f6d04eefd0337320abb7c6750cd81dfea9b8ff633bd8d1701e26cf330c61f6fb53a5f3228e3d11a88aa5efc3d759b7c6ad8c8832b45283eebaf9ae628918fdd196a523cb671cccc32c4a83720b04b40da3b975a3b66c224edb4dfb077a69ff77c9645429ae3b9efe6ee28bc5be9e1df2a48cf0a8ac5fa278ae77642ef9d431c8cc65c5b20623cbc4e9fe16302dfef8", 0xdb}], 0x4, &(0x7f0000000640)=[@cred={0x20, 0x1, 0x2, r1, r2, r3}], 0x20, 0x48010}], 0x1, 0x48040) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) ioctl$VIDIOC_SUBDEV_G_FMT(r0, 0xc0585604, &(0x7f00000006c0)={0x1, 0x0, {0x400, 0x6, 0x301f, 0x5, 0x0, 0x0, 0x1, 0x3}}) r4 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r5 = openat$cgroup_procs(r4, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r5, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) dup2(r0, r4) write$sndseq(r7, &(0x7f0000011fd2), 0xffffffee) read(r6, &(0x7f0000000000)=""/126, 0xfffffd6d) ioctl$KVM_GET_XSAVE(r0, 0x9000aea4, &(0x7f0000000940)) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:30:44 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0x0) [ 576.494855] binder: 24385:24395 unknown command 223121994 [ 576.500462] binder: 24385:24395 ioctl c0306201 20012000 returned -22 [ 576.512641] binder: 24385:24397 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 576.521161] binder: 24438 RLIMIT_NICE not set [ 576.528847] binder: 24385:24397 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 576.537075] binder: 24385:24395 ioctl c008640a 20000040 returned -22 04:30:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:44 executing program 5: socket$kcm(0x2, 0x2, 0x73) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1d, &(0x7f00000000c0)={@mcast2, 0x0}, &(0x7f0000000100)=0x14) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x9, 0x3, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffffffffff7, 0x0, 0x0, 0x0, 0x100000001}}, &(0x7f0000000040)='syzkaller\x00', 0xe, 0x0, 0x0, 0x40f00, 0x1, [], r0, 0xd}, 0x48) socket$kcm(0x2, 0x2, 0x73) 04:30:44 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) stat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000000180), &(0x7f00000001c0)=0x0, &(0x7f0000000200)) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0, 0x0}, &(0x7f0000000280)=0xc) getgroups(0x2, &(0x7f00000002c0)=[0xee01, 0x0]) r7 = getegid() stat(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setgroups(0x8, &(0x7f0000000480)=[r2, r3, r4, r5, r6, r7, r8, r9]) socket$kcm(0x2, 0x0, 0x73) r10 = socket(0x8, 0x806, 0xffffffff) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000500)='/dev/vga_arbiter\x00', 0x400, 0x0) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r10, 0x84, 0x16, &(0x7f00000004c0)={0x3, [0x6, 0x2, 0x5]}, 0xa) socket$kcm(0x2, 0x2, 0x73) 04:30:44 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x40440, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$VIDIOC_QUERYBUF(r1, 0xc0585609, &(0x7f0000000100)={0x8, 0xf, 0x4, 0xe000, {r2, r3/1000+30000}, {0x1, 0xe, 0x1, 0x7, 0xfffffffffffff22d, 0x401, "5b7d18b4"}, 0x9, 0x5, @userptr=0x6, 0x4}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0x0) 04:30:44 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240), 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 576.546655] binder: 24385:24397 ioctl c00c642e 200000c0 returned -22 [ 576.671465] binder: 24449:24450 Acquire 1 refcount change on invalid ref 0 ret -22 [ 576.703346] binder: 24449:24450 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 576.733418] binder: 24450 RLIMIT_NICE not set 04:30:44 executing program 5: socket$kcm(0x2, 0x2, 0x73) r0 = socket$kcm(0x2, 0x2, 0x73) r1 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x2, 0x2) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000080)='team\x00') getpeername$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000100)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000140)={{{@in=@local, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast2}}, &(0x7f0000000240)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000280)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r1, &(0x7f0000000480)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1004040}, 0xc, &(0x7f0000000440)={&(0x7f00000002c0)={0x148, r2, 0x820, 0x70bd25, 0x25dfdbfb, {}, [{{0x8, 0x1, r3}, {0x12c, 0x2, [{0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x4}}, {0x8, 0x6, r4}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x101}}, {0x8, 0x6, r5}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x79e}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x9}}}]}}]}, 0x148}, 0x1, 0x0, 0x0, 0x1}, 0x20000000) [ 576.782325] binder: 24449:24458 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:44 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg$unix(r1, &(0x7f0000000300)={&(0x7f0000000000)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000280)=[{&(0x7f0000000100)="c073678571d0cf77b0f0b65d67861fe511dde747aaf4984490906126ddee1c5b5a5ef6661046ba4b", 0x28}, {&(0x7f0000000140)="ae151be19d1696fc1e81b03fcb1dc0fd7f6ce62fb740355e90bb0fa5dd81881cfe80a754d25221a26db20fbccaf7883529", 0x31}, {&(0x7f0000000200)="80191f41249497479053f28493072e0ba686f9e578b892e86fdbadb35d3ae7bf4920602e9cab8cc5dc45509becda5e355609dc91ce59c15cf3e1496116cdc81ae6064532966f6d87c9e5816c51", 0xf200232f07dfa7a3}, {&(0x7f0000000180)="682cc2969c685458592f860e50f9e8804f7c2d83a4df92", 0x17}], 0x4, &(0x7f00000002c0)=[@rights={0x18, 0x1, 0x1, [r1, 0xffffffffffffffff]}], 0x18}, 0x20000000) getsockopt$IP_VS_SO_GET_SERVICE(r0, 0x0, 0x483, &(0x7f0000000400), &(0x7f00000003c0)=0x5c8) ftruncate(r1, 0x0) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000340)=0x0) ioctl$sock_proto_private(r0, 0x89e7, &(0x7f0000000480)="ea71ad386d1d7504107a2d685a9d37d4ceceba080a6b9d05afd059d10f6fb4b8495668b3acd5b2b289562823ffad262c0ec2ed2c45fed9ca5c6b735811efee5834a7e93c8c71e071f548d950debd9a7dca786500509dda40f395738f828e915b4c43e798e6d750940804f29fba33be63d4b77e9874bd4895d2767fc3c5695859646b6cc1e6d7554718355cac444c5d3023c07b49273281d9f1ad") sched_getaffinity(r2, 0x8, &(0x7f0000000380)) 04:30:45 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240), 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:45 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = open(&(0x7f0000000000)='./file0\x00', 0x480, 0x2) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xcc, 0x20, 0x1, 0xffffffffffffff9c}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) preadv(r0, &(0x7f0000000280)=[{&(0x7f0000000080)=""/111, 0x6f}, {&(0x7f0000000100)=""/6, 0x6}, {&(0x7f0000000180)=""/140, 0x8c}, {&(0x7f0000000240)=""/28, 0x1c}], 0x4, 0x0) setsockopt$EBT_SO_SET_COUNTERS(r1, 0x0, 0x81, &(0x7f0000000300)={'nat\x00', 0x0, 0x0, 0x0, [], 0x1, &(0x7f00000002c0)=[{}, {}], 0x0, [{}]}, 0x88) socket$kcm(0x2, 0x2, 0x73) 04:30:45 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0x0) 04:30:45 executing program 5: socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:45 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x100000000004101, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) poll(&(0x7f0000000300)=[{r0}, {r0, 0x41}, {r0, 0x100}], 0x3, 0xffff) lsetxattr$trusted_overlay_redirect(&(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='trusted.overlay.redirect\x00', &(0x7f0000000540)='./file0\x00', 0x8, 0x3) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r0, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x4e20, 0x1, @mcast1, 0x1}, @in={0x2, 0x4e24, @multicast1}], 0x2c) r1 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r4, &(0x7f0000011fd2), 0xffffffee) read(r3, &(0x7f0000000000)=""/126, 0xfffffd6d) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000280)={0x0, 0x1}, &(0x7f00000002c0)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f00000000c0)={0x7, 0x0, 0xff, 0x10000, r5}, &(0x7f0000000100)=0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0)='TIPC\x00') sendmsg$TIPC_CMD_RESET_LINK_STATS(r1, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x41}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x30, r7, 0x205, 0x70bd26, 0x25dfdbfc, {{}, 0x0, 0x410c, 0x0, {0x14, 0x14, 'broadcast-link\x00'}}, ["", "", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x24008011) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r4, 0x84, 0x78, &(0x7f0000000240)=r6, 0x4) sendmsg(0xffffffffffffffff, 0x0, 0x0) [ 577.473194] binder: 24449:24458 Acquire 1 refcount change on invalid ref 0 ret -22 [ 577.497999] binder: 24449:24458 unknown command 536872576 [ 577.503872] binder: 24449:24458 ioctl c0306201 20008fd0 returned -22 [ 577.522650] binder: 24500 RLIMIT_NICE not set [ 577.534421] binder: 24449:24501 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0c63000066f318900066a807a9a5e26529bdc84d99771090218e64499aed1efc9ca04159d307ffe83f4fc8f5e9cac0ecfa3695e0b1a635d25c1732a16483c06f25602e5d77e589b7422621cc5b7d4910d23c52b351ddd60734c20f1bc106e21cfc40da7c4be571ceb4b73909524aaed6e2788780f7e336510204f35dff46a53c402599129ff77d8d64d6a6d21421b3a6d780a2f880894f0cfdc34e147e7100a10162ed535c82dc2f91de2781512f661c000000"], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:45 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240), 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:45 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:30:45 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x100, 0x0) ioctl$NBD_SET_FLAGS(r1, 0xab0a, 0x8000) socket$kcm(0x2, 0x2, 0x73) 04:30:45 executing program 5: socket$kcm(0x2, 0x5, 0x73) r0 = socket$kcm(0x2, 0x2, 0x73) r1 = open(&(0x7f0000000000)='./file0\x00', 0x13009ea5bd0c05ae, 0x40) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f00000000c0)) getsockopt$inet_int(r1, 0x0, 0x23, &(0x7f0000000040), &(0x7f0000000080)=0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'yam0\x00', 0x0}) sendto$packet(r1, &(0x7f00000001c0)="750e7f0589ac0a3a089730503d225d3e0933264e40db3fb7f664e22396e5a3babe3fb4075190a9f5a88906b922020606bed22afcf838a8f4889c", 0x3a, 0x800, &(0x7f0000000400)={0x11, 0x5, r2, 0x1, 0x2, 0x6, @random="74bfcf5c8f75"}, 0x14) [ 577.697278] binder: 24522 RLIMIT_NICE not set [ 577.753148] binder: 24521:24522 tried to acquire reference to desc 0, got 1 instead [ 577.806372] binder: 24532 RLIMIT_NICE not set 04:30:45 executing program 2: r0 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x1, 0x2200) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000100)='nbd\x00') sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x2c, r1, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x20}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0xf9a}]}, 0x2c}, 0x1, 0x0, 0x0, 0x41}, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ftruncate(r2, 0x0) [ 577.843717] binder: 24521:24531 unknown command 536872576 [ 577.849447] binder: 24521:24531 ioctl c0306201 20008fd0 returned -22 04:30:45 executing program 5: socket$kcm(0x2, 0x2, 0x73) r0 = semget(0x3, 0x3, 0x2) semctl$IPC_INFO(r0, 0x3, 0x3, &(0x7f0000000000)=""/167) socket$kcm(0x2, 0x4, 0x73) 04:30:45 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:46 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/zero\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000240)='TIPCv2\x00') sendmsg$TIPC_NL_NAME_TABLE_GET(r1, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)=ANY=[@ANYBLOB="b8000000", @ANYRES16=r2, @ANYBLOB="000127bd7000ffdbdf25100000002c000600080001000700000008000100060000000400020004000200040002000400f7ff070001000500000078000100100001007564703a73797a3000000000100001007564703a73797a32000000004c00020008000200010400000800030080000000080001000e000000080003005b000000080003000500000008000400f9ffffff08000300ff0f00000800020008000000080001000c0000000800030008000000"], 0xb8}, 0x1, 0x0, 0x0, 0x40004}, 0x8000) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) r3 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0xc4f5, 0x10000) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_NAME_TABLE_GET(r3, &(0x7f0000000180)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="feff0000", @ANYRES16=r4, @ANYBLOB="10032bbd7000fedbdf2510000000"], 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x1) [ 577.918385] binder: 24521:24535 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:46 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x8912, &(0x7f00000001c0)="153f6234488dd25d766070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l\x00'}, 0x58) setsockopt$ALG_SET_AEAD_AUTHSIZE(r1, 0x117, 0x5, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r2) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0e00adc5d5d7d62fd5b1fba00000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="8f53d1e6390c630000"], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r4 = dup(r3) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:46 executing program 2: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x800000000001, 0x0, &(0x7f0000000140)) ftruncate(r0, 0xfffffffffffffffc) [ 578.301083] binder: 24558:24560 unknown command -978518002 [ 578.306985] binder: 24558:24560 ioctl c0306201 20008fd0 returned -22 [ 578.334482] binder: 24558:24560 unknown command -422489201 [ 578.340327] binder: 24558:24560 ioctl c0306201 2000dfd0 returned -22 [ 578.373625] binder: 24558:24560 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 578.408761] binder: 24558:24570 tried to acquire reference to desc 0, got 1 instead 04:30:46 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:46 executing program 0: openat$dsp(0xffffffffffffff9c, 0x0, 0x2040, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:30:46 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_REORDERTO(r1, 0x111, 0x5, 0x42d, 0x4) 04:30:46 executing program 5: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) r0 = socket$kcm(0x2, 0x2, 0x73) ioctl$sock_inet_SIOCGIFBRDADDR(r0, 0x8919, &(0x7f0000000140)={'netdevsim0\x00', {0x2, 0x4e20, @rand_addr=0xffffffffffffffff}}) r1 = socket$kcm(0x2, 0x2, 0x73) r2 = accept4(r1, &(0x7f0000000040)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, &(0x7f00000000c0)=0x80, 0x800) setsockopt$XDP_TX_RING(r2, 0x11b, 0x3, &(0x7f0000000100)=0x1000, 0x4) 04:30:46 executing program 2: r0 = dup3(0xffffffffffffffff, 0xffffffffffffff9c, 0x80000) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20ncci\x00', 0x200000, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000200)={0x1, r1}) arch_prctl$ARCH_SET_CPUID(0x1012, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8a9e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) fsetxattr(r2, &(0x7f0000000100)=@random={'system.', 'cgroup-lo\x00'}, &(0x7f0000000140)='\x00', 0x1, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ftruncate(r3, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={&(0x7f0000000080)='./file0\x00', 0x0, 0x18}, 0x10) [ 578.454472] binder: 24558:24570 unknown command -978518002 [ 578.460260] binder: 24558:24570 ioctl c0306201 20008fd0 returned -22 [ 578.490246] binder: 24558:24560 unknown command -422489201 [ 578.496208] binder: 24558:24560 ioctl c0306201 2000dfd0 returned -22 04:30:46 executing program 5: socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000080)='NET_DM\x00') sendmsg$NET_DM_CMD_STOP(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r1, 0x400, 0x70bd27, 0x25dfdbfb, {}, ["", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x40000) sysfs$2(0x2, 0x3, &(0x7f0000000280)=""/201) 04:30:46 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x6402, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffff9c, 0x84, 0xf, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e24, @loopback}}, 0x3ff, 0xfa, 0xfffffffffffffff7, 0x7, 0x4}, &(0x7f0000000180)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f00000001c0)={r3, 0x61}, &(0x7f0000000200)=0x8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r4 = dup(r1) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:46 executing program 2: socket$inet_sctp(0x2, 0x1, 0x84) r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000180)='/dev/snapshot\x00', 0x5363e2e930b1c266, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000140)=0x3) socketpair$unix(0x1, 0x40000001, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x22) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000100)={&(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, 0x1000, 0x1}) r3 = dup3(r0, r1, 0x0) setsockopt$inet6_tcp_TLS_TX(r3, 0x6, 0x1, &(0x7f0000000200), 0x4) ftruncate(r1, 0x0) 04:30:46 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f00000000c0)='/dev/cec#\x00', 0x2, 0x2) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000180)={0x0, 0xb0, "5793532e2071bdcd97d5fd886bb13f0c81190e96274476af7d4126f3440f14ab4982b92a730b15a8442847ab97d17eb00589e1e3b8f55c2159331125325402aecca4a0f2c79ee2684b51ca002f3917b4c423d45598c5ae7820f2eb46bda8827483a709a9bac8e13842161904f7af8226a5e4ba4b212dbd6ce0e5da39fc03074a922daacaf1f876253d8373bf42ac040d123e2b9ebf6ceb4b0c058da2d9b1735c1e3a84be67ac97568d8f11e129db0946"}, &(0x7f0000000100)=0xb8) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000240)={r2, 0x5, 0x20}, &(0x7f0000000280)=0xc) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:46 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 578.895966] binder: 24605 RLIMIT_NICE not set [ 578.927629] binder: 24603:24605 tried to acquire reference to desc 0, got 1 instead [ 578.975935] binder: 24603:24617 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 578.992351] net_ratelimit: 26 callbacks suppressed [ 578.992369] protocol 88fb is buggy, dev hsr_slave_0 [ 579.004235] binder: 24605 RLIMIT_NICE not set [ 579.005093] protocol 88fb is buggy, dev hsr_slave_1 [ 579.009553] binder: 24603:24613 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 579.016610] protocol 88fb is buggy, dev hsr_slave_0 04:30:47 executing program 5: r0 = socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) ioctl$SIOCGSTAMPNS(r0, 0x8907, &(0x7f0000000000)) [ 579.027603] protocol 88fb is buggy, dev hsr_slave_1 04:30:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x1, 0x0) sendmsg$nl_netfilter(r2, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40200000}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0xf4, 0x7, 0xf, 0x0, 0x70bd28, 0x25dfdbfe, {0xd}, [@generic="3627023cf30713bfc8618e25d7cdede919bd8557f331f78c99893edaefd889ee295e1dc0c435a1fa40b4e89945c9effb3cc2819a2d0c476cd745e7d36276dc984378f368647c07fc6098a726f5b67f4df0cc607d6b30c7a78ee6b9d8355d535e0e449beabf9cc9ca752eb723e3f921d69386e24654380156cc3a", @nested={0x50, 0x42, [@typed={0x14, 0x86, @ipv6}, @typed={0x14, 0x95, @ipv6=@dev={0xfe, 0x80, [], 0x1e}}, @typed={0x4, 0x5}, @typed={0x14, 0x28, @str='/dev/binder#\x00'}, @typed={0xc, 0x67, @u64=0x4}]}, @nested={0x8, 0x56, [@generic="5d579d"]}, @typed={0xc, 0x1c, @u64=0x800}]}, 0xf4}, 0x1, 0x0, 0x0, 0x80}, 0x40800) r3 = dup(r1) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:47 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x101000, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0xffffffff, @dev={0xfe, 0x80, [], 0x22}, 0x7}, 0x1c) [ 579.306093] binder: 24628:24631 tried to acquire reference to desc 0, got 1 instead [ 579.373114] binder: 24628:24639 unknown command 536872576 [ 579.376236] binder: 24628:24641 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 579.378847] binder: 24628:24639 ioctl c0306201 20008fd0 returned -22 04:30:47 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r1 = gettid() tkill(r1, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r2, 0x40000000af01, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r2, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r3) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000180)={0x0, r3}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000040)) r2 = mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x4, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0xfffffffffffffe4f, 0x0, &(0x7f0000000200)=[@enter_looper, @transaction={0x40406300, {0x0, 0x0, 0x2, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180), &(0x7f00000001c0)=[0x0, 0x38, 0x40]}}, @exit_looper, @decrefs, @free_buffer={0x40086303, r2}, @register_looper], 0x35f, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="9400003e384cd4d5680f2dc737c522ab5e1e"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r3 = dup(r1) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:47 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x8000, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc058534f, &(0x7f0000000040)={{0x28e, 0x3}, 0x0, 0x40, 0x5, {0x85aa, 0x5}, 0xff, 0xfffffffffffff000}) socket$kcm(0x2, 0x2, 0x73) 04:30:47 executing program 5: r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x200000, 0x0) ioctl$EVIOCSABS3F(r0, 0x401845ff, &(0x7f0000000040)={0x6f, 0xffffffffffffffff, 0x66, 0x40, 0x3f, 0x6}) socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:47 executing program 0: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000080)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) write$UHID_INPUT2(r0, &(0x7f00000000c0)={0xc, 0x1e, "04edde29632a8e3753613d494a90e62da1a020efbbd2f1cd58cd2df273fc"}, 0x24) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:30:47 executing program 2: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xc, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r1, &(0x7f0000000140), 0x0) ftruncate(r1, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x3, 0x400) fanotify_init(0x1, 0x80800) setsockopt$inet_udp_encap(r2, 0x11, 0x64, &(0x7f0000000040)=0x5, 0x4) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000100)) [ 579.597377] binder: 24648:24655 ioctl c0306201 20000140 returned -14 [ 579.617168] binder: 24648:24655 unknown command 1040187540 [ 579.623595] protocol 88fb is buggy, dev hsr_slave_0 [ 579.624339] protocol 88fb is buggy, dev hsr_slave_1 [ 579.632068] protocol 88fb is buggy, dev hsr_slave_0 [ 579.635443] binder: 24648:24655 ioctl c0306201 20008fd0 returned -22 [ 579.640796] protocol 88fb is buggy, dev hsr_slave_1 [ 579.652606] protocol 88fb is buggy, dev hsr_slave_0 [ 579.658050] protocol 88fb is buggy, dev hsr_slave_1 04:30:47 executing program 5: socket$kcm(0x29, 0x7, 0x0) socket$kcm(0x2, 0xf2d806b38e180115, 0x73) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x180, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0x5, &(0x7f0000000040)=0x2, 0x4) 04:30:47 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1f, 0x200}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0x0) [ 579.726191] binder_set_nice: 2 callbacks suppressed [ 579.726205] binder: 24665 RLIMIT_NICE not set 04:30:47 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r1 = gettid() tkill(r1, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r2, 0x40000000af01, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r2, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r3) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000180)={0x0, r3}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 579.770643] binder: 24648:24665 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 579.814839] binder: BINDER_SET_CONTEXT_MGR already set [ 579.820228] binder: 24648:24655 ioctl 40046207 0 returned -16 04:30:48 executing program 5: r0 = socket$kcm(0x2, 0x2, 0x73) ioctl$int_out(r0, 0x5460, &(0x7f0000000000)) socket$kcm(0x2, 0x2, 0x73) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cachefiles\x00', 0x100, 0x0) ioctl$DRM_IOCTL_ADD_CTX(r1, 0xc0086420, &(0x7f0000000080)) [ 579.919222] binder: 24648:24665 ioctl c0306201 20000140 returned -14 [ 579.943543] binder: 24665 RLIMIT_NICE not set [ 579.954415] binder: 24648:24655 unknown command 1040187540 [ 579.960212] binder: 24648:24655 ioctl c0306201 20008fd0 returned -22 04:30:48 executing program 3: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x10000, 0x0) getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000040)={0x0, @multicast1, @multicast2}, &(0x7f00000000c0)=0xc) openat$audio(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/audio\x00', 0x101000, 0x0) getresuid(&(0x7f0000000100), &(0x7f0000000140)=0x0, &(0x7f0000000180)) clock_gettime(0x3, &(0x7f0000000300)) setsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000001c0)={{{@in=@dev={0xac, 0x14, 0x14, 0x26}, @in=@multicast1, 0x4e22, 0x0, 0x4e20, 0x7fff, 0x2, 0xa0, 0x20, 0xb7, r1, r2}, {0x17e5, 0x4, 0x7, 0x81, 0x1ff, 0x0, 0x7, 0x80000001}, {0x89e, 0xd5b, 0x2, 0x6}, 0xcfad, 0x6e6bb4, 0x1, 0x421c4fde372406d5, 0x1, 0x3}, {{@in=@local, 0x4d2, 0xff}, 0x0, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x3500, 0x0, 0x2, 0x7, 0x1, 0x5, 0xc1}}, 0xe8) socketpair$unix(0x1, 0x2005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) socket$caif_seqpacket(0x25, 0x5, 0x1) 04:30:48 executing program 2: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x40000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = gettid() r2 = getpid() r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x800, 0x0) r4 = accept4$inet6(0xffffffffffffff9c, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000100)=0x1c, 0x80000) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, r0, &(0x7f0000000140)={r3, r4, 0x21c0000000000000}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ftruncate(r5, 0x0) [ 580.014947] binder: 24648:24691 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:48 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x6, 0x73) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x204400, 0x0) write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x2d, 'io'}, {0x0, 'pids'}, {0x2b, 'io'}, {0x2d, 'memory'}, {0x2d, 'pids'}, {0x2d, 'rdma'}]}, 0x22) ioctl$TUNGETVNETHDRSZ(r1, 0x800454d7, &(0x7f0000000080)) setsockopt$MISDN_TIME_STAMP(r1, 0x0, 0x1, &(0x7f0000000040)=0x1, 0x0) 04:30:48 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_RESET(r0, 0x2403, 0x4) ioctl$sock_proto_private(r0, 0x89e7, &(0x7f0000000080)="a39bc1e6bbba08463f3ec4e45beb1efbbb408e77f95e4639ac6511adf755f241ce52a062e36c9fba93f0ce9308c18d0588afec301ee52b87137731a2bbc29b32bc93d6c5e6ccd8f5e6178777193c05727503") r1 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000380), 0x12) clock_gettime(0x0, &(0x7f00000002c0)={0x0, 0x0}) write$sndseq(r0, &(0x7f0000000580)=[{0x0, 0x3, 0x1f, 0x33, @time={r3, r4+10000000}, {0x2, 0xfffffffffffff001}, {0x89e4, 0x23e}, @control={0x7, 0x369b, 0x3ff}}, {0x4, 0xffff, 0x8, 0x81, @tick=0x400, {0x1, 0x4}, {0x1, 0x401}, @raw32={[0x5, 0x6, 0x100000001]}}, {0x100000001, 0x0, 0x7fffffff, 0x40, @tick=0x28bb0b67, {0x2, 0x2}, {0x9, 0x100000001}, @time=@tick=0x5}], 0x90) read(0xffffffffffffffff, &(0x7f0000000000)=""/126, 0xfffffd6d) ioctl$TUNSETVNETBE(r0, 0x400454de, &(0x7f0000000240)=0x1) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={0x0, r1, 0x0, 0x9, &(0x7f00000003c0)='trusted!\x00', 0xffffffffffffffff}, 0x30) ptrace$cont(0x29, r5, 0x1, 0x8e) sendmsg$nl_crypto(r1, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB="f80000001200000009000000fddbdf2561656769733235362d67656e65726963000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000013820bd0463c96800a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000810000000000000000000300000000000000000000000000000000000000000000200000002400000000000000000000080001003a09000008000100200000000800010000020000"], 0xf8}, 0x1, 0x0, 0x0, 0x40001}, 0x40000) ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f0000000280)=[0x100000001, 0x100]) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:30:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000100)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:48 executing program 3: r0 = socket$vsock_stream(0x28, 0x1, 0x0) fsetxattr(r0, &(0x7f0000000040)=@random={'user.', ',#+securitycpusetppp1&^%!-keyringcpuset,}-ppp1&\x00'}, &(0x7f0000000080)=']!^%,trusted\x00', 0xd, 0x1) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x3, 0x145000) r4 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) ioctl$LOOP_CTL_ADD(r3, 0x4c80, r4) fcntl$setpipe(r0, 0x407, 0x33f) 04:30:48 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r1 = gettid() tkill(r1, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r2, 0x40000000af01, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r2, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r3) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000180)={0x0, r3}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:48 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0x0) signalfd(r0, &(0x7f0000000000)={0x5}, 0x8) 04:30:48 executing program 5: r0 = socket$kcm(0x2, 0x2, 0x73) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000000)) ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000100)) socket$kcm(0x2, 0x2, 0x73) r1 = syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x3, 0x2) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000000080), &(0x7f00000000c0)=0x4) [ 580.665967] binder: 24722:24724 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 580.695496] binder: 24722:24724 tried to acquire reference to desc 0, got 1 instead [ 580.732022] binder: 24722:24731 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 580.732800] binder: 24722:24740 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:48 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x2080, 0x0) getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffff9c, 0x84, 0x77, &(0x7f0000000040)={0x0, 0xfffffffffffffffe, 0x2, [0x1, 0x6]}, &(0x7f0000000100)=0xc) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000000140)=@sack_info={r2, 0x3ebf, 0x80}, &(0x7f0000000180)=0xc) ftruncate(r0, 0x0) 04:30:48 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r1 = gettid() tkill(r1, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r2, 0x40000000af01, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r2, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r3) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000180)={0x0, r3}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:48 executing program 5: socket$packet(0x11, 0x3, 0x300) socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:49 executing program 0: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:30:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x200, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x20000, 0x0) ioctl$RTC_AIE_ON(r2, 0x7001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) ioctl$sock_inet_SIOCGIFBRDADDR(r3, 0x8919, &(0x7f0000000100)={'vxcan1\x00', {0x2, 0x4e20, @multicast2}}) r4 = dup(r1) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:49 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x18d5, 0x4000) ioctl$KVM_S390_UCAS_MAP(r1, 0x4018ae50, &(0x7f0000000040)={0x5, 0x7, 0xa0000000}) socket$kcm(0x2, 0x2, 0x73) [ 581.054217] binder: 24758:24764 Acquire 1 refcount change on invalid ref 0 ret -22 04:30:49 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ftruncate(0xffffffffffffffff, 0x0) [ 581.098998] binder: 24758:24764 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 581.130812] binder: 24764 RLIMIT_NICE not set [ 581.177861] binder: 24758:24775 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:49 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r1 = gettid() tkill(r1, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r2, 0x40000000af01, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r2, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r3) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000180)={0x0, r3}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:49 executing program 5: socket$kcm(0x2, 0x2, 0x73) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) socket$kcm(0x2, 0x2, 0x73) 04:30:49 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/stat\x00') ioctl$sock_inet6_tcp_SIOCINQ(r1, 0x541b, &(0x7f0000000040)) ioctl$RTC_AIE_ON(r1, 0x7001) 04:30:49 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_tcp_TLS_RX(r0, 0x6, 0x2, &(0x7f0000000040), 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getresgid(&(0x7f0000000380), &(0x7f0000000400), &(0x7f0000000300)) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000240)='/dev/hwrng\x00', 0x0, 0x0) ftruncate(r1, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x200000, 0x0) ioctl$RTC_VL_READ(r2, 0x80047013, &(0x7f0000000200)) ioctl$VIDIOC_ENUMAUDIO(r2, 0xc0345641, &(0x7f0000000100)={0x9, "42c1fb6fb6d02feae8df10bf1e72a7257ef3744926714fa723f935a9968778cc", 0x2, 0x1}) accept$packet(r3, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000002c0)=0x4) 04:30:49 executing program 5: socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-monitor\x00', 0x40, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000006c0)=@broute={'broute\x00', 0x20, 0x4, 0x578, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000140], 0x0, &(0x7f0000000100), &(0x7f0000000140)=[{0x0, '\x00', 0x0, 0x0, 0x2, [{{{0x5, 0x8, 0x0, 'syzkaller1\x00', 'bond0\x00', 'bond_slave_0\x00', 'syz_tun\x00', @remote, [0x0, 0xff, 0x0, 0xff, 0xff], @dev={[], 0x2a}, [0xff, 0xff, 0xff, 0x0, 0xff, 0xff], 0x70, 0x70, 0xa0}}, @common=@redirect={'redirect\x00', 0x8, {{0xfffffffffffffffd}}}}, {{{0x0, 0x2, 0x0, 'syzkaller0\x00', 'ifb0\x00', 'veth1_to_bridge\x00', 'nlmon0\x00', @random="ace770cf9f7f", [0xff, 0x0, 0xff, 0xff, 0xff], @remote, [0xff, 0xff, 0x0, 0xff, 0x0, 0xff], 0xa8, 0xa8, 0xd8, [@mac={'mac\x00', 0x10, {{@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, 0x1}}}]}}, @common=@STANDARD={'\x00', 0x8, {0xfffffffffffffffe}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x0, 0x4, 0xe8ef, 'rose0\x00', 'irlan0\x00', 'bpq0\x00', 'ip6_vti0\x00', @broadcast, [0x0, 0xff, 0xff, 0xff, 0x0, 0xff], @dev={[], 0x1e}, [0xff, 0xff, 0x0, 0xff], 0xc0, 0x188, 0x1d8, [@helper={'helper\x00', 0x28, {{0x1, 'irc-20000\x00'}}}]}, [@common=@nflog={'nflog\x00', 0x50, {{0x3, 0x8, 0x8, 0x0, 0x0, "4bbc8aa99556275809e00a6ece5da53490d0799f582967c445e96350f88060b66754df377a8011f0c8898c21500294019aca750dbf5f4007e3080fa6900084d8"}}}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x1000, 'syz0\x00', 0xffffffff80000000}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0xffffffffffff0001, 'syz1\x00', 0x101}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffc}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x1, [{{{0xb, 0x0, 0x985e, 'ip_vti0\x00', 'syzkaller0\x00', 'lo\x00', 'veth1_to_bridge\x00', @broadcast, [0x0, 0xff, 0x0, 0xff, 0x0, 0xff], @local, [0xff, 0x0, 0xff, 0xff, 0xff, 0xff], 0xb0, 0x130, 0x168, [@quota={'quota\x00', 0x18, {{0x1, 0x0, 0x8, 0x7f}}}]}, [@common=@LED={'LED\x00', 0x28, {{'syz1\x00', 0x0, 0x80, 0x8}}}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x8, {{0x1}}}]}, @common=@mark={'mark\x00', 0x10, {{0xffffffc0, 0xfffffffffffffffc}}}}]}]}, 0x5f0) 04:30:49 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r1 = gettid() tkill(r1, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r2, 0x40000000af01, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r2, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r3) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000180)={0x0, r3}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:49 executing program 5: r0 = socket$kcm(0x2, 0x2, 0x73) fcntl$setsig(r0, 0xa, 0x36) socket$kcm(0x2, 0x2, 0x73) setsockopt(r0, 0x9, 0x4, &(0x7f0000000000)="1b0f937d7883fd0cab7cedeec82b0ad350c5a14e78a43f89d943892696c84fc7f26fa6e7bd81ff60684b27b3a7d06f3a9a410f98f6bf3eaf54290117483088abc950e83a7492667f83bd37a036c9bf", 0xfffffffffffffdf0) 04:30:49 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) r0 = open(&(0x7f0000000000)='./file0\x00', 0x400, 0x80) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) [ 581.846735] binder: 24758:24775 Acquire 1 refcount change on invalid ref 0 ret -22 [ 581.888308] binder: 24823 RLIMIT_NICE not set [ 581.888471] binder: 24758:24822 unknown command 536872576 [ 581.898767] binder: 24758:24822 ioctl c0306201 20008fd0 returned -22 [ 581.968497] binder: 24758:24775 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:50 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) flock(r0, 0x4) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0xfffffffffffffdec) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x200000) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f00000003c0)=""/126, 0xf910cec115ec74ac) getsockopt$inet_mreq(r2, 0x0, 0x20, &(0x7f0000000100)={@initdev}, &(0x7f0000000240)=0x8) getsockopt$IP_VS_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x481, &(0x7f0000000080), &(0x7f00000000c0)=0xc) ioctl$CAPI_CLR_FLAGS(r1, 0x80044325, &(0x7f0000000280)=0x20000000000) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:30:50 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0xfffffffffffffffe) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) setsockopt$inet6_MRT6_ADD_MIF(r2, 0x29, 0xca, &(0x7f0000000040)={0x200, 0x1, 0x9, 0x101, 0x7}, 0xc) 04:30:50 executing program 2: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r0, &(0x7f0000000200)={{0x7f, 0x45, 0x4c, 0x46, 0xd68e, 0x3f, 0x1f, 0x7ff, 0x6a7, 0x3, 0x3f, 0x0, 0x1a, 0x40, 0xb8, 0x0, 0x7, 0x38, 0x2, 0x6, 0x100000000, 0x7f}, [{0x3, 0x7ff, 0x7, 0x401, 0x8, 0x100000000, 0x1ff, 0x1}, {0x4, 0x3, 0x86ae, 0x8, 0x9, 0x1, 0x7, 0x8000}], "510503a07097c825e2eb67c0297304ae702138b16074e567ade6d90eb134ffdd3b641c991aff0f5f0989dbc42a4484dc5cb41a97b38d893c4446c168d80748ab032aca3cf1d3d3901c5bd1c3e8914d545a1e4f2e6392c7cfa1c4ce31dfdaf56a64dcf3327bf34d8c79f10641c951be42960a4f29500211146006786d82cbb7ed641015855e32897974667e77f28de57c2e2917038723b5f60d6cd0b65e921b12b011312216dd3b373621", [[], [], [], [], [], [], [], []]}, 0x95a) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ftruncate(r1, 0x0) 04:30:50 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x20, 0x103001) ioctl$sock_bt_bnep_BNEPCONNDEL(r0, 0x400442c9, &(0x7f0000000040)={0x20}) socket$kcm(0x2, 0xc, 0x73) r1 = socket$kcm(0x2, 0x2, 0x73) ioctl$TIOCEXCL(r0, 0x540c) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000080)=0x0) stat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$sock_inet_sctp_SIOCINQ(r0, 0x541b, &(0x7f0000000240)) fstat(r1, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000200)={r2, r3, r4}, 0xc) 04:30:50 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:50 executing program 3: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) prctl$PR_MCE_KILL(0x21, 0x1, 0x2) socket$kcm(0x2, 0x4000000004, 0x73) munlock(&(0x7f0000ffb000/0x2000)=nil, 0x2000) socket$kcm(0x2, 0x5, 0x73) r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xffff, 0x10000) ioctl$DRM_IOCTL_GEM_FLINK(r0, 0xc008640a, &(0x7f0000000300)={0x0, 0x0}) ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f00000000c0)={r1, 0x0}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000100)={r2, 0x80000, r0}) ioctl$DRM_IOCTL_IRQ_BUSID(r3, 0xc0106403, &(0x7f0000000140)={0x400, 0x4, 0x100000000, 0x3}) getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(r0, 0x84, 0x74, &(0x7f00000001c0)=""/198, &(0x7f00000002c0)=0xc6) ioctl$UI_DEV_CREATE(r0, 0x5501) getdents64(r0, &(0x7f0000000180)=""/53, 0x35) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r0, 0x4008240b, &(0x7f0000000040)={0x100000000000001, 0x70, 0x3, 0x0, 0x3, 0x57a6ae1f, 0x0, 0xa4b, 0x10000, 0xc, 0x1, 0x5, 0x80000000, 0x7f, 0xa43, 0xf594, 0x3, 0x40, 0x8000, 0x100, 0xd0, 0x98, 0x1f, 0xffffffff, 0x9, 0x7fffffff, 0x8, 0x7, 0x5, 0x6, 0xd45, 0x4091, 0x10001, 0x0, 0x7, 0x84, 0xf4c0, 0x8, 0x0, 0x74, 0x2, @perf_config_ext={0x3f, 0x79}, 0x0, 0x9, 0x6, 0xb, 0x2, 0xfffffffffffffffa, 0x8}) 04:30:50 executing program 5: socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x300, 0x0) r1 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r1) 04:30:50 executing program 2: r0 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x2, 0x121000) ioctl$ASHMEM_SET_PROT_MASK(r0, 0x40087705, &(0x7f0000000040)={0x7fff}) perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BLKREPORTZONE(r0, 0xc0101282, &(0x7f00000002c0)={0x52f, 0x8, 0x0, [{0x2, 0x100000001, 0x9, 0x0, 0x6, 0x10000, 0xc0000000000}, {0x8000, 0xfffffffffffffff9, 0x3ff, 0x3f, 0xffffffff, 0xfff, 0x7fff}, {0x7, 0xff, 0xffffffff00000000, 0x1000, 0x0, 0x400, 0xff}, {0x1, 0x7, 0x3, 0xfa7, 0xffffffffffff8a88, 0xffffffffffff0001, 0x3}, {0xfffffffffffffeff, 0x8, 0xffffffffffffffa5, 0x1f, 0x5, 0x8, 0x401}, {0x3, 0x10001, 0xd74, 0xfffffffffffffff7, 0x8, 0xf954, 0xfffffffffffffff8}, {0x1, 0xebb, 0x1000, 0x100, 0x4, 0x4, 0x4}, {0x23, 0x20, 0x101, 0xfffffffffffffff7, 0x8, 0x0, 0x10000}]}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ftruncate(r1, 0x100000000000) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r0, 0xc08c5335, &(0x7f0000000200)={0x7fffffff, 0x5, 0x1000, 'queue1\x00', 0xd5}) 04:30:50 executing program 4: remap_file_pages(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000004, 0x4ce3f827, 0x100) r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = open(&(0x7f0000000080)='./file0\x00', 0x28000, 0x100) unshare(0x2000500) r2 = syz_open_dev$usbmon(&(0x7f0000000400)='/dev/usbmon#\x00', 0x0, 0x0) fcntl$F_SET_FILE_RW_HINT(r2, 0x40e, &(0x7f0000000100)=0x7) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000280)={r1, &(0x7f0000000180)="87931061dee1bb9cd02be33e22968991183d3538820851a4486c0ffbc93c69b5a8be2588ad4064bd6b1bba2fa151742e484f61f24a65200f7bf612feded5a0dffac973d08f552ae4aa2a15499e5ad45896dd77ecb058c7", &(0x7f0000000200)=""/100}, 0x18) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000680)}) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) getsockopt$inet_pktinfo(r4, 0x0, 0x8, &(0x7f0000000140)={0x0, @loopback, @multicast1}, &(0x7f0000000100)=0x7) socket$xdp(0x2c, 0x3, 0x0) r5 = dup(r3) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:50 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:50 executing program 5: r0 = socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) r1 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x3, 0x400) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) fsetxattr$trusted_overlay_nlink(r0, &(0x7f00000000c0)='trusted.overlay.nlink\x00', &(0x7f0000000040)={'L+', 0xffffffffffff0000}, 0x28, 0x3) 04:30:50 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x7, 0x73) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) nanosleep(&(0x7f0000000040)={r1, r2+30000000}, &(0x7f0000000080)) socket$kcm(0x2, 0x2, 0x73) [ 582.580092] mmap: syz-executor4 (24881) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. 04:30:51 executing program 2: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x220000, 0x0) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffffff, 0xc0106426, &(0x7f0000000100)={0x8, &(0x7f0000000040)=[{}, {}, {}, {}, {0x0}, {}, {}, {}]}) ioctl$DRM_IOCTL_UNLOCK(r2, 0x4008642b, &(0x7f0000000140)={r3, 0x1}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ftruncate(r1, 0x0) fcntl$dupfd(r2, 0x0, r0) 04:30:51 executing program 0: openat$dsp(0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x2) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) pipe2$9p(&(0x7f0000000300), 0x80000) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) utimes(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)={{r4, r5/1000+10000}}) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) setsockopt$inet6_MCAST_JOIN_GROUP(r2, 0x29, 0x2a, &(0x7f0000000240)={0x0, {{0xa, 0x4e21, 0xfffffffffffffff7, @loopback, 0xb}}}, 0x88) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:30:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x80000) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0c85250d81a682259a89f649ffdb0965553c2506c7d5e3858dd075154f73a761297f213f134708d2b1df1386e1be276a5afe3f59372a9737e456f620aa8a790db8de28d9b997a51923dad7b66822d4cfe993b078ca9bfff35cd516ee92ccfc7566a02b9639f509e08b40376eb5a509a2cf1f2fd8c747834d61ec"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\fb\x00\x00'], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="106308400000000000080000"], 0x0, 0x0, 0x0}) 04:30:51 executing program 5: r0 = socket$kcm(0x2, 0x2, 0x73) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000000)=0x0) r2 = pkey_alloc(0x0, 0x1) pkey_mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000000, r2) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/autofs\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000100)={0xffffffffffffffff}, 0x13f, 0x8}}, 0x20) socketpair(0xa, 0x8080a, 0x2, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$inet6_tcp_buf(r5, 0x6, 0x1c, &(0x7f0000000200)=""/39, &(0x7f0000000240)=0x27) write$RDMA_USER_CM_CMD_DISCONNECT(r3, &(0x7f0000000180)={0xa, 0x4, 0xfa00, {r4}}, 0xc) migrate_pages(r1, 0x7, &(0x7f0000000040)=0x800, &(0x7f0000000080)=0x6) socket$kcm(0x2, 0x2, 0x73) 04:30:51 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 582.976714] binder: 24904:24906 unknown command 220562700 [ 582.982459] binder: 24904:24906 ioctl c0306201 20008fd0 returned -22 [ 582.999351] binder: 24904:24906 unknown command 25100 [ 583.004828] binder: 24904:24906 ioctl c0306201 2000dfd0 returned -22 [ 583.017192] binder: 24904:24906 BC_DEAD_BINDER_DONE 0000080000000000 not found [ 583.028111] binder: BINDER_SET_CONTEXT_MGR already set [ 583.033719] binder: 24904:24906 ioctl 40046207 0 returned -16 [ 583.048680] binder: 24904:24914 unknown command 220562700 [ 583.054511] binder: 24904:24914 ioctl c0306201 20008fd0 returned -22 [ 583.072358] binder: 24904:24918 unknown command 25100 [ 583.077707] binder: 24904:24918 ioctl c0306201 2000dfd0 returned -22 [ 583.101224] binder: 24904:24925 BC_DEAD_BINDER_DONE 0000080000000000 not found 04:30:51 executing program 5: socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x5, 0x73) r0 = socket$inet(0x2, 0x800, 0x3) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffff9c, 0x84, 0x22, &(0x7f0000000000)={0x80, 0x8, 0x9, 0x40, 0x0}, &(0x7f0000000040)=0x10) r2 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x100000000, 0x400000) ioctl$BLKREPORTZONE(r2, 0xc0101282, &(0x7f0000000140)={0x97d, 0x7, 0x0, [{0x0, 0xfb05, 0xffffffffffffffe1, 0x2, 0x7fffffff, 0x100000000, 0x4}, {0x0, 0x0, 0xffffffff, 0x10001, 0x2e6, 0x9, 0x7f}, {0xda, 0x6, 0x7fff, 0x3, 0x80000000, 0xfffffffffffff000, 0x7c0000}, {0x4, 0x8559, 0xfff, 0x3, 0x1, 0xe342, 0x714}, {0x5, 0x4, 0x400, 0x3, 0x101, 0x10b, 0x3c}, {0x10040, 0x8, 0x6, 0x80000000, 0x6, 0x1, 0xffff}, {0x3, 0x1000, 0x8cf, 0x1, 0x800, 0x400, 0x200}]}) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000080)={r1, 0x3f}, &(0x7f00000000c0)=0x8) 04:30:51 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000380), 0x12) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000080)={0x0, 0x10000}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000100)={0x10000, 0x1, 0x0, 0x3, 0x3, 0x7fff, 0x9, 0x8000, r3}, &(0x7f0000000240)=0x20) sendto$inet(r0, &(0x7f0000000940)="8f616c33975f9ad57e40bbe68b9f7bf238f46a1c835614ac927b89a73668e3e2f26b39879811c07693b4902f9fa314cd9d812e9bf34b1413ee09fa20e8d7c1b2416b1d9ddebe2f9ce781582da6e97ccf2c8b30974e8345650b47b06c6416738e9bc4fe4e152a6bf902b34220b58ac64476d7abfd88d32d48ebd73110a31452fa5003bd580c3420e650e88307dd1b15220a5f3b77451b91bcecb998cdb76f8c2f27d6257676503d52f77d61b8b31ee06b677df52602c1e8ada2dd60a16ddc02843535906edc77516d1dd85dd0c28b2838c1bb8c839cd9563ea27a80e0ea81d4d16f5388d81cd085e768cb399fa07ae51a3057ddbeccd083833111844b07698cd8b7995aafd36cad7d03409084750376e6273c1246350adf8537b4646eb998a283a17b96ddb7a5ba2797cef801437a464e9e7992af2524a18aaeba43698b6d01dc4a6dcefc103378ac46ba705eb61b4672573dea4ae0f5ec57344820cffe7891821accf01076393c6f044e8e9d23d3cb4938b2731f65435262a2a3dc549bf7cbf87753857ff56799641601b3f3a6bf7ec47ffd6ee822f676bed0f3fb034146032791bd7f452182dcf0c5db5b5f7d4aebf700a08c798b2996342257849b1b57c0cad072afb309acb4c848a37781b3853b5db1f71516c79e0bf14adf33a75becfca46e0239ea46d5e748e27204cb3182bda21989161f6a33bbad2494711df4ee16369982a1b6004b492368dee5bbf6b67da2b05ac086bcb31a9fbef52004d9322df8054aa928bf6077d60c4690f4d7b8e82c6d3984c3cc851c964c11d2cdea34e6f0ef80d2cd3e371d1c89a07ae7c4f30ba6df5dbd25e8370b863bd59aaf01b207d5d3c37082aa7bcb6b97f02fab6f796bc97685e873678be6cfeb8ef6c50607b5bdb572390b3126bae61732d37bf8b0c56979a6ee79cb0a7a886e10229ccb6771c0309c9a4ca751925d3f2821a2ecbe162fb3c255cec967e7e7387547c076f1d887bcfeeea1a3f62298e865773926e29b37a27c6f378636f59fa079b31a95057f8b616e50214be8855cdacde610c2710e0703aa7a7e06d791d4017a3fbc3bbeb2e5793e008d70a886b22b854c253cd4597eb38fa8a377e9f8eb01c9805397f83bb3d740c99dfe0d2037781bc6e28f016befb392cd4601159e1a508c267b76ac895780f511a193516d856185b07248d04e1747cc3f9e9ec1bb4e2e0deb815050cbc33f3a0d909195b50fc6cc590fb278992e11e60aa58c8900021ffc5fe94412fd0c450c639f1922b37e9ee3903a3f4c55543748215f30d3b169a05b9b5ee8f98c0fd647a2feac43b6c042df6fd8b811dac9fd1be67b4294a9c7a65ff8201b7d4031fba3d3cb0706d6ec36c7136b94413a113a2f1e54e5f559c53cc4b91231f1da138a27fc659e1f9b0ba1536c5ada14cafe88d0577217c1a6554fd6d12856c598a0c582ef9c00e2c856af5ddabd0626b5b28506b78cb706dda809af21687cfd9f2af06342b2502bb1408f794a33d8d256ecabed56913c0aff6b17abc322cf8ba5d9f1ed7c141be95e818d555858fd334fa2e197147cd54ffe9119d3a2a4605f06e899e98240e9e7e5242d13c9e238cef27b1e00c0c943ac357304e6d03242e0709e78bb0eca0504600d49b0f037a12c3e6a45cacf2f2435b8ff8f70b17a6e253c44d4091560964def3a091a426051f49f6b6d936d8b36b8caf296dc8f708bbfe7ad8d6d9d91f60dff40b7d60b67998647b7b6e3163a57edd5c27a2d8c19734afef083743b4f7b9fdc71f70f40b1c2f65b54ba78a1c86f19a70a1cc4f038c14bd4fa9b231dfec4a91fe67e7178bde66df54b621a50b803e8ca01ccf71e50aedfae72b174a75b83da9ec50d81e9474a183441a7609ac8e945cb51ba4394e038585db75bfc0ea17ac166d938febb8593de92a9836b6b83ebacbd5ffccd119316af18c9e0e22484245b022a1766f8de79baddba77428dfa29e2d3e6edad6660da7382cabbe89dbfd764e3ad8fcbc95f34aed02431460110e0a41fb1996f2b66e32a83bf60576c638092ba1a8440e2f94bbd3c841114a8b422529c1d48f59c92b01db8dfa57a23fe20ebc790bfefec41e824eef89397132a1af6101e3c17bf4f7996938cc41983305c0a6c73a50a67cb66c89e3538a5d36b222c087ccc936d29ab4f06319b5c774e0c26daeae98b9da84a9b14d216829e5f936d70c6467691943b279ef1ef35e658bfdad501c8df62b292e9f0e8a1cfc98d50dd9fdb89c7941a39252cbe69a4c539e884516da5269d6ef50357e588b26e26632016b6af0926124b2c7e572b73076c66b4036cbdd68a17bacc629ecf986edb8a01040cd938cf75db18e5ce1eb9f4dd26db23625f38e03f3231602db8127ad9cad6cffb5952ed98ebda88c111ae5b1dfa3e25ac06f2c8299932cd655674d341b37f23d4ed27e4425851a5d66d9455929b0776c93111d7d461a398d7df664467aa555fcc778f222f2259c367b4a261182e7b0359cf2c4e617cb801d9579448a8651509fbe35685d6f1a30d733f4e066ab9126712970ff3bf1e4bba74c508e7ae06d61970c678fc28683149a13fb313946d92ae289c51dd2a1a83df54d505703d46949c502f54f8d6fc90da745cdd1f442c2d4e97eaca7957109479e6370a6c34538f8f6d31955f5eb9c9fef309a5b133cf8207952728c70d7f4178e1727c2c0b5530b6d063db2739f7683e131376f3f1b629c7128ec280198d105a8c2eb982dd23f22ddda5f319199890e9bb29c6b4f49b30b008f915d781767d830b2d7d3147cab79e22791885ded8b2fbae477bf9f79db6a93b3be6065dfd360c1d18fa8e7f746eee64769772b248e36e54c07c261bcb8e03ee9740ef56ddf27ef5aeb5b342bd4d2c9dc9fa93318c00776130c3f8c93a202f8e3bc550d0932d271e88e70228bd5530af0733a2a4dcd72a60efe907089ace67d85fb3bae44d562adc3952dd2e8b7db1ea405ca157c1ae0fa46d5836cc48b207425b96205f9f9ac6121a3048427035a91b2a58f325a617c61542af59785b2d7978f9cf3ea9face9b1475a70544a140494d0bb8bc03351d33671658d5ebe52a327eafc68dba23e851dfe2dc0344ce550451d922ddba3eb9cec330f4f36a62745fd20442610e1cef76716e98ec1815b1e65f111f2723aef4d5af7f35e997fbce245bf9033040aa3b51ca46b55784f9a2c283740a5be276e2042bd60dd8b45b97d14e9c57d7a4e3a81127673b56f0f29b895c4085d8da3165b490a309d3ad80e3fa339091232c645965ced50304ab485ef51db52008a822390495b2dd799e30331e61c1df08034875af09c73350b15ef99adf6782e2dd3e11bede7f9b6b0ca98fd780178ebe1e0fc2876639b6009be251aeea99e06d1102ad0d0561219a0254d847402a1e171270618b8b1d295e5f4f749d40f1f5f7a6da4370dbc7883c72d74f69e69fe8e3d7861472086d86951b80827a61d3a89d8a4afd5dadbd022130711decee1b5379ee4eb79f06ce9c2946f9f1e2916863a11bd81ae27f171fccbc9a1c460d87d92da76526d5472cac413fc8b19e8836213d27a9e84e64413aa70daec0b45046f424e9f2d06e33e458ebfba688757641b6706f35cd643bed1b30f120a2a3827118074e58b471e20dd4509d651e05734b166ffcdf6007ac49cffba262f2993004bb7d05df2f561d90415ded0d1e9895f9339150e7b7c96f86ee4f1c4061e8321f56d9c0d0bd066c9432dd295ad52da07baac04a1e8723b729317f3bbc11dfe9b0e9b0013f29cb95ed6349575784884f74ccc2f4e99ac27b742532f82db64cfdf3acda45fc0520a92ea5b6c8f0883aaa42413fa58596b9df61a353decd87c4d5f8f3073c24111077de054492651b3817470f78200514cce2b527158473736adb60a60d9bea732e57271c646dfde46a52c644dd62c5988deca001982769fa304e4fc4db600ffac83041457e7662b2118e7323ae63a3c1939f27d7c24e70065b79b9a3c48d5fab3ed2d4da3345a30701b4a2993cb5432d63f118f76c4c6b8a79fe777b561a37302b4e62a053f44424760d3b5f9df4e7e35a2d2b68f5b885de6c35edd0d875f9f8de31abddde41b7c9be28b8f8300a26854da97667e05d0c5408bd329fd725a48455f9bb2eddc799b12f9509b892d33a43bf7e7366017a8b76e6492e7ccf0b6998a489aec5d790f2c895b37fd68a1956bae49f4599b25f57c7095238005f4f670cfdf295623e352f7b725db6650509e9321771997908996aad5c62355e21e88191a0ea0c138764f811b35cd1584ce8de5a4ff6e0648e3bbc67ca093aaa1b637737a1fa73361c18a9e45b03f6ec4e265e6ca785336376f0934fa12de1ed11fd1b42c7623c501ebc3f5297c3dd5abf9ca7422b55f1a097ce62ea15898ecf40a1dc1975909d593634fe0912b020b5a3ff0285956d8809ae01b5f875bc015f498fc456173e8516649c41fb55aeeb5d400e425d33cc4ddbceffe35a4c2f41bf4789be98675b7ec605457c12c854d3a29cb786ab309ec8b6d03fba32e2335087be710291614fc0d1540e99240cdf7dbfccb6c233082b77fee117f1dafbb50a58975ad65c2778d222c20c35846885fdf94b7dd78bc42724159dfb470f65234767664533b5c804d5e3d05f1ef2fcd02ef7520b83430c14103e0cb51a440ea709ab9d48edff047d9c972c7ec4f7110c4a7a4fa1f93117029dc714ea9f6eba53f7fe2873376fe4868b78f5db0bcb66e83c5a0d1712e7247d8951d5922faa2ef869eaf6a910d69a5272550d94b3cd3cdcce6b320639690516913580a02e2f576274fb16b3f9cbb6d7b2077f10b4c786e8e0b0c2ec5158f53f164865d4a29c740e52b0eb9fb9812f07a681217207e50fefc97d758ab722898052ea1370cff51140cf29bcd3e7b1fa933f1cab1464303f1d93ed7ca6555cbe8cb8b58adaed0659f9b05634c6afa164b308563f98e1af03b3ae3b62bddf23059de0b280cf613e429b24d51fef012c857f5502dd36ad76a46fdcd93aa189f2343c6bd75d5cd5053c2a4dfe03bca427cdbbd9e7cefe7db0f88e7d93c5f303d19e4a174ef68446ce494a0daacab7adf723ad64dcfd446612cb70b9fc0711a64fe17dff93126088682d9b475e428fa9b2d2319011b6cda3e206ff51b6d2d5045fcd7ab60091cafb7dd77786e9cfa93dda64784cad4e2a858a324e4ec321741fa150e93a28f8136056f468d5f2addd2f18ba32903404a4263a605169114c92e2e4d721a83d4f845c1c6f9dbf0a1e51a32db227d9891e1279e2a631f57329bf597d1e829ded1d600dd9ed417ddc7d40fc6c9b44a31c52cbd542b44556f0647723e36db18fd75622f22ddf4473f5c42156477e8364e5f7fce12a92153dc08ca59b32cb4e35264297688fa9f5f79a4b3d33ea42f40dbfe6f681e1e4b9e91ab5c5efad5345b9bafec0d9796603e615ed9b502a4a716cda5a2c09af5346435928a142721e48c201d84453cc3513d71f423bc76e53b660d0f2305384395c939a69c6d2b6c6e26f9dc6d012b28a10abeeffbfd409dc6911e27f55c20c8a21f2d58ac9da54dd02406198ed983fde2a4c773659e40427db62300404dec63e31c2e30abfc55495448365c6344f5533c93c60bb5c697c374976b5d2025199f83d09f11057bba943435d5a2a4d41d1451b2c0b26228a1055d18a1cfed22894c2cef140c8ce99f2abb28d08f0f468495107f541901df852eb1432b0495d08011da9c1e9807b43dfc7d16e7755c7f2f36a613ff994745795c60b6ae13ba7c8a8ad3ce37340a09af176fa", 0x1000, 0x11, 0x0, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r5, &(0x7f0000011fd2), 0xffffffee) read(r4, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, 0x0, 0xffffeffffffffffc) 04:30:51 executing program 2: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$isdn_base(0x22, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ftruncate(r1, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x6, 0x40000) setsockopt$inet_dccp_buf(r2, 0x21, 0x80, &(0x7f0000000200)="829045466b4a523b377cd815601868589699ac3ea0bf1606311c2e820969e4ca87bd9e54febc701c021619c681b5408e120e013e622d4b2c162305039b35f8fba5907802ec2b0cd1afeeb1939595a7438d20e2e0f94246fa299611e49a77cff41890a99dc09311a6a71c6d9db3711b897bf80b9bbcf89b4bd2a5308f18e5b0e39d622007559fda89cee78cdeb6e3c351badd0b7d89fb0ee2fa17245ba9d4178b879f38e83720b430a98e4bfac20774a81b4b2b86b3d075dac6d90189b677b2a54cf4e209d357578934e74e1f22ffeb72be3ef2dc738d3c2cf282d26c31891c611bda60128cfb93df0c4f4e0f1dcd58af9dddbe", 0xf3) perf_event_open(&(0x7f0000000100)={0x4, 0x70, 0x8, 0x237e, 0x5, 0x80000001, 0x0, 0x1fffc0000000000, 0x2e08, 0x2, 0x6, 0xeeb3, 0x8, 0x5, 0x58e, 0xffffffffffff256d, 0x3f, 0x3, 0x7, 0x42d9, 0xad2, 0x7, 0x4, 0x59, 0x3, 0x1, 0x3, 0x3e3, 0xffffffff, 0x6, 0x9, 0x10000, 0x6, 0x101, 0x5, 0x0, 0x2, 0x4, 0x0, 0x100, 0x4, @perf_bp={&(0x7f0000000040), 0x8}, 0x200, 0x4, 0x4, 0x0, 0x8, 0x5, 0x822}, 0x0, 0xf, r0, 0xb) r3 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20ncci\x00', 0x40140, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000300)={0x0, 0x400}, &(0x7f0000000340)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, &(0x7f0000000380)={r4, 0x1, 0x20}, 0xc) 04:30:51 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = socket(0x1, 0x80002, 0x2) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_RESET_STATS(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000180)={&(0x7f0000000480)={0x318, r3, 0x800, 0x70bd27, 0x25dfdbff, {}, [@TIPC_NLA_MEDIA={0x28, 0x5, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100000001}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_NODE={0x18, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x8001}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0x128, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x15}}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x7, @dev={0xfe, 0x80, [], 0x1f}, 0x4}}}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8001}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x80ff8d1, @loopback, 0x7}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0xffffffffffffff00, @remote, 0x84}}}}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x800}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3f}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'caif0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x8}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x401, @remote}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x3fcf, @mcast2}}}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}]}]}, @TIPC_NLA_LINK={0x3c, 0x4, [@TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x65}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}]}, @TIPC_NLA_LINK={0xf8, 0x4, [@TIPC_NLA_LINK_PROP={0x34, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6efc}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x13a3b6fc}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xcc6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5020}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x820}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fffffff}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7162}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x400}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}]}, @TIPC_NLA_NODE={0x3c, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1f}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xfffffffffffffff7}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}]}]}, 0x318}, 0x1, 0x0, 0x0, 0x8000}, 0x20040895) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) fsetxattr$trusted_overlay_origin(r1, &(0x7f0000000040)='trusted.overlay.origin\x00', &(0x7f00000000c0)='y\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r4 = dup(r1) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r4, 0x84, 0x7b, &(0x7f0000000300)={0x0, 0x10000}, &(0x7f0000000380)=0x8) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x6, &(0x7f00000007c0)={r5, @in6={{0xa, 0x4e24, 0x4, @empty, 0x2}}}, 0x84) r6 = syz_open_dev$amidi(&(0x7f0000000200)='/dev/amidi#\x00', 0x9, 0x20000) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r6, 0x29, 0xd2, &(0x7f0000000240)={{0xa, 0x4e23, 0x3, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0xffffffffffffffc1}, {0xa, 0x4e21, 0x80000001, @mcast1, 0x48e}, 0xfff, [0x5, 0xfff, 0x80000000, 0xa9af, 0x0, 0x676665f2, 0x94, 0x5]}, 0x5c) [ 583.510093] binder: 24954 RLIMIT_NICE not set 04:30:51 executing program 2: mknod$loop(&(0x7f0000000000)='./file0\x00', 0x0, 0x1) perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x101000, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000002c0)={r1, &(0x7f0000000100)="530a57c80b332dc3afc1a6935722d30f81cbd94d97f7ba3fd65578cb19226502ecdce505e54da5bad3fcdaf206c8e38bd14d137e87d6512f386752ffdd06dfec1418a61a129630c758d8ba5fab46cfc7f7b9918b22887ea9258853040796545ea2503bf2abf8336baaa8f92be4c37c8def61af59df8b7b2e3d86eb484365782d431b4941d4a706b039415a2d69360e971db3a9da735c16735b51a1e891ebd001c91f8c26b3b2b628c118593c106fd6955336e09c5a7eb45406", &(0x7f0000000200)=""/177}, 0x18) ftruncate(r0, 0x4000000000021) [ 583.546144] binder: 24953:24956 tried to acquire reference to desc 0, got 1 instead [ 583.609353] binder: 24953:24963 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 583.679312] binder: 24956 RLIMIT_NICE not set 04:30:51 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x7) getresuid(&(0x7f0000000080)=0x0, &(0x7f00000000c0), &(0x7f0000000100)) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000180)={0x0, 0x0, 0x0}, &(0x7f00000001c0)=0xc) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000240)='/dev/sequencer\x00', 0x200800, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_WRITE(r3, 0xc008551b, &(0x7f0000000280)=ANY=[@ANYBLOB="019a1a70b23a30cd98801853cdf30000000000000000d36e42ca00ea"]) fchown(r0, r1, r2) r4 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x0, 0x3d70d776a31d7b4b) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r4, 0xc0305302, &(0x7f0000000200)={0x3, 0x88ba, 0x7, 0x9, 0x2, 0x40}) accept4$packet(r4, 0x0, &(0x7f0000000040), 0x800) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:51 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:51 executing program 5: socket$kcm(0x2, 0x5, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) readv(r0, &(0x7f00000001c0)=[{&(0x7f0000000040)=""/6, 0x6}, {&(0x7f00000000c0)=""/41, 0x29}, {&(0x7f0000000100)=""/152, 0x98}], 0x3) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:52 executing program 2: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ftruncate(r1, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40106614, &(0x7f0000000000)) [ 583.999915] binder: 24986 RLIMIT_NICE not set [ 584.076163] binder: 24985:24986 tried to acquire reference to desc 0, got 1 instead 04:30:52 executing program 5: socket$kcm(0x2, 0x2, 0x73) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffff9c, 0x0, 0x1, &(0x7f0000000000)='\x00'}, 0x30) ptrace$getregset(0x4204, r0, 0x200, &(0x7f0000000100)={&(0x7f0000000080)=""/108, 0x6c}) 04:30:52 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 584.133316] binder: 24985:24991 unknown command 536872576 [ 584.139035] binder: 24985:24991 ioctl c0306201 20008fd0 returned -22 [ 584.236986] binder: 24996 RLIMIT_NICE not set 04:30:52 executing program 0: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x40) syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x0, 0x200) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:30:52 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000000)={r0}) r3 = geteuid() getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000180)={{{@in=@broadcast, @in6=@ipv4={[], [], @multicast1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@ipv4={[], [], @loopback}}}, &(0x7f0000000080)=0xe8) sendmsg$nl_route(r2, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f00000000c0)=@ipv6_delrule={0x5c, 0x21, 0x2, 0x70bd28, 0x25dfdbfd, {0xa, 0x20, 0x14, 0x80000000, 0x4, 0x0, 0x0, 0x9, 0x4}, [@FIB_RULE_POLICY=@FRA_TABLE={0x8, 0xf, 0x7fff}, @FRA_DST={0x14}, @FRA_DST={0x14, 0x1, @loopback}, @FIB_RULE_POLICY=@FRA_UID_RANGE={0xc, 0x14, {r3, r4}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4040010}, 0x800) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:52 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000000)='./file0\x00', &(0x7f0000000100)=""/131) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0x0) 04:30:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000040)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:52 executing program 5: socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) fanotify_init(0x32, 0x48402) [ 584.547501] binder: 25026 RLIMIT_NICE not set [ 584.605272] binder: 25025:25026 tried to acquire reference to desc 0, got 1 instead [ 584.607355] binder: 25025:25031 unknown command 536872576 [ 584.618996] binder: 25025:25031 ioctl c0306201 20008fd0 returned -22 04:30:52 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000), 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:52 executing program 5: socket$kcm(0x2, 0x2, 0x73) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x80601, 0x0) rt_sigsuspend(&(0x7f0000000240)={0x8}, 0x8) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000000080)='@#\\mim\x05\x00\x00\x00\xad JG\xf9\xbb\xb9\x9cd\tjpemIme_t\xefl\xca\xfbype$') socket$kcm(0x2, 0x2, 0x73) getsockopt$inet_opts(r0, 0x0, 0xd, &(0x7f0000000280)=""/110, &(0x7f0000000300)=0x6e) socket$kcm(0x29, 0x7, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000200)={0x1, 0x7}) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000000c0)={0xffffffffffffffff}, 0x2, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000140)={0x16, 0x98, 0xfa00, {&(0x7f0000000040), 0x4, r1, 0x30, 0x1, @ib={0x1b, 0x80, 0xea14, {"f67b95e46538287c86e0a4eac9379f61"}, 0x991b, 0x7, 0x2dcdddcd}}}, 0xffffffffffffff06) 04:30:52 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_procfs(0x0, &(0x7f0000000500)='/exe\x00\x00\x00\x00\x00\x04\t\x00K\xdd\xd9\xde\x91\xbe\x10\xee\xbf\x00\x0e\xe9\xa9\x0fy\x80XC\x9e\xd5T\xfa\aBJ\xb9\xb3\xf8h>\xcf\x89\xde\xe9\x01\xd2\xdau\xc0\x1f\x02\x00\xf5\x8d&\xd7\xa0q\xfb53\x1c\xe3\x9cZ\xee\xffP\x83\xcf\a\xddFE\\\x91MJ\xff\x1e|\xf7\xedW\xc0\xc2\x05o\\\xa9\xfc\xf0<\xbf\x82\xbd\x13SG73\x92E\xd3\xc7\x06A\xbeb\x81\xd7\xe1\xb4\xb7\t\x91\x14\xc5q\x87\"\x98\xdd\x7f! \xe2\xb6\xfa*.*,\x9cn\x004u\vya\xfa,\x15\x84\xc0\xb5\xa5\x00\xae\n\xc3\x9b\xc7jx\xd9\x15\x82fu\x9fvj>\x8c\x84\xc0\x9c\xf3\xad\x88\x82\x94\x7f\xfa\x1f\xb4\xc0Pr{\xeb\x12\xc5~\x06\xffY\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x89$W\x8a\xd4\x9e\xa1\x14LtH\xd6@\xaa\x88\xa6jq\xb7}s\xa9$\xff\x02\x7f\xdc\xb5P\x16\x16S\xd4\xcbW\b\x83\x85$\x82\x86\xf5\xbe\x9d\x87f\xc7\f)\xe6\xf5\x06=\xfet\xa1\xb0\xb5 y\x15\x90H!\vM\'\x1a\xc9L\x88\x9b\x06<\xa3J\tW\x9a\xf061\xf1(\xe6\xdd,\x96m\xae\xcd|o~\x0fN\xbc\xaf\x80%\f\xfa\xb0q\x84\x83\x80x\xc7\x1d\x80\x9d\x06\xdc\v\xacu\xdb\x81E%\xd1\xd1\xac\xafL\xb6\xf4\x89\x0f9s\x82\xaecf\x97\xf6\x88\tN8\xdb\\\"w\x0fS\alc\r\xf9\xbbL\x14\x91\x89\xff\xa9u\xf5 \x871\x1c[\xaa\xfc\x11\xc9\v\xdc%\xfc\x80;q\x15=\xdc9\x95\xb2\xdfI\xcd\xd7\x84\xbc[\xea@\x86\x10p\xda\xdb9^\x85\xc9<\xdf\xa0\x8e') mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r1, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$IPT_SO_GET_ENTRIES(r2, 0x0, 0x41, &(0x7f0000000100)={'security\x00', 0x33, "47ea2ed3ac833b9196809db645c91771ac14ac87c77e4412733fd1ab17354d7b698d5d23158f8f8bdd81eb4c99e3b29be07991"}, &(0x7f0000000180)=0x57) ioctl$KVM_GET_PIT(r1, 0xc048ae65, &(0x7f0000000000)) fcntl$setstatus(r1, 0x4, 0x400) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f00000003c0)={0x0, @local, 0x0, 0x0, 'mh\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 '}, 0x2c) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0x0) 04:30:52 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = accept(r0, &(0x7f0000000000)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @loopback}}, &(0x7f0000000080)=0x80) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x14, &(0x7f00000000c0)={@loopback}, &(0x7f0000000100)=0x14) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) connect$unix(r0, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000740)={0x0}, &(0x7f0000000780)=0xc) sched_setaffinity(r2, 0x8, &(0x7f00000007c0)=0x9) [ 584.806068] binder: 25035 RLIMIT_NICE not set [ 584.838263] binder_thread_write: 1 callbacks suppressed [ 584.838285] binder: 25025:25041 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:53 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000), 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x3, 0x0, &(0x7f00000000c0), 0xfffffffffffffd6b, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:53 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$kcm(0x2, 0x0, 0x73) r2 = fcntl$dupfd(r0, 0x406, r1) r3 = fcntl$dupfd(r2, 0x0, r0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r2, 0xc10c5541, &(0x7f0000000180)={0x8, 0x5, 0x1000000007c, 0x0, 0x0, [], [], [], 0x7, 0xd7c}) socket$kcm(0x2, 0x2, 0x73) fdatasync(r3) [ 585.222233] net_ratelimit: 25 callbacks suppressed [ 585.222250] protocol 88fb is buggy, dev hsr_slave_0 [ 585.233293] protocol 88fb is buggy, dev hsr_slave_1 [ 585.239447] protocol 88fb is buggy, dev hsr_slave_0 [ 585.246955] protocol 88fb is buggy, dev hsr_slave_1 [ 585.263941] binder: 25067:25068 unknown command 0 [ 585.268932] binder: 25067:25068 ioctl c0306201 20000100 returned -22 [ 585.305091] binder: 25067:25068 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 585.340285] binder: 25068 RLIMIT_NICE not set [ 585.403109] binder: 25067:25079 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:53 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r4, &(0x7f0000011fd2), 0xffffffee) read(r3, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000080)) 04:30:53 executing program 2: r0 = syz_open_dev$midi(&(0x7f0000001200)='/dev/midi#\x00', 0x2, 0x200000) ioctl$KVM_GET_REG_LIST(r0, 0xc008aeb0, &(0x7f0000001240)={0x1, [0xd6]}) perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x7, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0xc00200) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/ignore_tunneled\x00', 0x2, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r2, &(0x7f0000000100)="eceeda61da3466329847000fb509eb3d4827216cd97986a0db755713cc7068f371ebd8bf3842e197c0c9c6f2e60ea11a216566712482c929e443de081efe9119dc2a89ad809c17d72a841b71ec55cefe4b6a5dfa8b8dd418cab259f6df33130a5f7f2e315e40f8ecf7c709044c46bc69dc9c318d64c4c0f33e946c20fea04a264f6f0c968ae6", &(0x7f0000000200)=""/4096}, 0x18) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ftruncate(r1, 0x1) 04:30:53 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000), 0x0, 0x8) r2 = gettid() tkill(r2, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:53 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$kcm(0x2, 0x0, 0x73) r3 = dup3(r0, r2, 0x80000) setsockopt$IP_VS_SO_SET_FLUSH(r3, 0x0, 0x485, 0x0, 0x0) getsockopt$inet6_udp_int(r3, 0x11, 0x1, &(0x7f0000000100), &(0x7f0000000180)=0x4) r4 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x2c, 0x80000) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r4, 0xc0bc5310, &(0x7f0000000040)) socket$kcm(0x2, 0x2, 0x73) ioctl$KVM_TRANSLATE(r4, 0xc018ae85, &(0x7f00000001c0)={0xf000, 0x7000, 0x5, 0x17f0, 0x100}) setsockopt$inet_mtu(r3, 0x0, 0xa, &(0x7f0000000200)=0x3, 0x4) 04:30:53 executing program 2: ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffff9c, 0xc058565d, &(0x7f0000000080)={0x1ff, 0x3, 0x4, 0x60, {0x0, 0x7530}, {0x4, 0x9, 0x4, 0x54, 0x7fffffff, 0x500, "f0f83504"}, 0x0, 0x0, @fd=0xffffffffffffff9c, 0x4}) fchdir(r0) socketpair(0xa, 0x0, 0x23a, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) getpeername$netlink(r2, &(0x7f0000000180), &(0x7f0000000200)=0xc) r3 = perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = dup2(r2, r3) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r4, 0xc08c5336, &(0x7f0000000240)={0x800, 0xffff, 0x400, 'queue0\x00', 0x5}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) setsockopt$inet_sctp_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000100)={0xffffffffffff363a, 0x9, 0x10000, 0x0, 0xffffffffffffffff, 0x3ff, 0x8, 0x10001, 0x3ff, 0xffffffff, 0x80000000}, 0xb) ftruncate(r3, 0x800) 04:30:53 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) gettid() tkill(0x0, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r2, 0x40000000af01, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r2, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r3) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000180)={0x0, r3}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:53 executing program 5: socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x8, 0x73) 04:30:53 executing program 3: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x0, 0x0) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f00000000c0)) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000040)=@assoc_value, &(0x7f0000000080)=0x8) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) [ 585.862152] protocol 88fb is buggy, dev hsr_slave_0 [ 585.862270] protocol 88fb is buggy, dev hsr_slave_0 [ 585.867604] protocol 88fb is buggy, dev hsr_slave_1 [ 585.872976] protocol 88fb is buggy, dev hsr_slave_1 [ 585.877882] protocol 88fb is buggy, dev hsr_slave_0 [ 585.887901] protocol 88fb is buggy, dev hsr_slave_1 04:30:54 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r0, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1800000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x30, r1, 0x0, 0x70bd2d, 0x25dfdbfd, {{}, 0x0, 0x5, 0x0, {0x14, 0x19, {0x1f4, 0xd7, 0x3ff, 0x8}}}, ["", "", "", "", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000040)=0xc) ftruncate(r2, 0x0) [ 586.060824] binder: 25067:25079 unknown command 0 [ 586.065893] binder: 25067:25079 ioctl c0306201 20000100 returned -22 [ 586.132456] binder: 25067:25079 unknown command 536872576 [ 586.138142] binder: 25067:25079 ioctl c0306201 20008fd0 returned -22 [ 586.162839] binder: 25126 RLIMIT_NICE not set [ 586.218375] binder: 25067:25126 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:54 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) rt_sigreturn() r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x531000, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000040)={0x0, 0x101, 0x20, 0x7fffffff, 0x2}, &(0x7f0000000100)=0x18) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000140)={r1, 0x8, 0x1, [0x9]}, 0xa) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ftruncate(r2, 0xfffffffffffffffe) 04:30:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00') sendmsg$TIPC_CMD_GET_LINKS(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20020000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x24, r2, 0x600, 0x70bd29, 0x25dfdbfd, {{}, 0x0, 0x4, 0x0, {0x8, 0x11, 0x8}}, ["", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x4000) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0563044000000000f5d895de880e8daf2b64dd589761bc19e467b1f9722450adc9722078fe8a252c1b1d38e62c9ba95a68474558100fc0a32cd68704ed1fb7ae4ea98d6ed5a6d64487e454bda6d5d167428bc0fcfd34cac939cea2dfb521e3"], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r4 = dup(r3) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:54 executing program 5: socket$kcm(0x29, 0x2, 0x0) socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x800) ioctl$KVM_GET_XSAVE(r0, 0x9000aea4, &(0x7f00000004c0)) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x3, 0x2) ioctl$KVM_X86_SET_MCE(r1, 0x4040ae9e, &(0x7f0000000040)={0x676b9bf176af98c1, 0x0, 0x1, 0xe, 0x1b}) 04:30:54 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r1, 0x800442d2, &(0x7f00000000c0)={0x6, &(0x7f0000000240)=[{}, {0x0, 0x0, 0x0, @local}, {0x0, 0x0, 0x0, @broadcast}, {0x0, 0x0, 0x0, @random}, {0x0, 0x0, 0x0, @remote}, {0x0, 0x0, 0x0, @local}]}) write(r2, &(0x7f0000000080)="5489dca8c582266e74918d6c0c62868f0572b3729885265539336a17565484800e35c0bb36f7ed", 0x27) write$cgroup_pid(r2, &(0x7f0000000380), 0x12) getsockopt$inet6_opts(r0, 0x29, 0x0, &(0x7f0000000940)=""/4096, &(0x7f0000000100)=0x1000) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r4, &(0x7f0000011fd2), 0xffffffee) read(r3, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:30:54 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) [ 586.623799] binder: 25144 RLIMIT_NICE not set 04:30:54 executing program 5: socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x6000002, 0x73) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x20000, 0x0) ioctl$KVM_SET_REGS(r0, 0x4090ae82, &(0x7f0000000040)={[0xfff, 0x100000001, 0xcccb, 0x5, 0x12000, 0x8, 0x4, 0x9697, 0x2, 0xffff, 0x1, 0x6, 0x1c54, 0x6, 0x5, 0x2], 0x6000, 0x80000}) 04:30:54 executing program 2: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) sendto$isdn(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="ff03000000000000b133968e64cefc1381ebde911510f553166dd34096f29c7de5bec05c741068399de502afd12c1a83141f757b5c853ce8ae62786ebc39dc822da44e6d77b83f97630615b809c1ce591ec56f497f5c03febefe59d50b79db2e0087b471c6593497cadb8bd788fcf3c701655536163f087d5480604e772c4addc28526338c0c14692e003af6820c8af97a54d5522dbb018fdebd5fd29e317b8ac34865112131b6be80f4140c55df9497d64d8263a6faa6feda1aa86f60a4"], 0xbe, 0x20040090, &(0x7f0000000040)={0x22, 0xfffffffffffffffb, 0x20, 0x3, 0x3f}, 0x6) ioctl$NBD_CLEAR_SOCK(r1, 0xab04) ioctl$FITRIM(r0, 0xc0185879, &(0x7f0000000200)={0x0, 0x10000000000000, 0x7}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000300)={0x0, 0x94, &(0x7f0000000240)=[@in6={0xa, 0x4e21, 0x0, @mcast2, 0x7}, @in6={0xa, 0x4e23, 0x5491, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x8000}, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e21, @empty}, @in6={0xa, 0x4e23, 0x3, @empty, 0x7}, @in={0x2, 0x4e21, @local}, @in={0x2, 0x4e24, @remote}]}, &(0x7f0000000340)=0x10) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000380)={r3, 0x200}, &(0x7f00000003c0)=0x8) ftruncate(r2, 0x0) [ 586.654950] binder: 25143:25148 tried to acquire reference to desc 0, got 1 instead 04:30:54 executing program 5: r0 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x9, 0xffffffffffffffff) ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000040)) socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x5, 0x73) sendmmsg$inet_sctp(r0, &(0x7f0000000340)=[{&(0x7f0000000000)=@in={0x2, 0x4e22, @rand_addr=0x1}, 0x10, &(0x7f0000000300)=[{&(0x7f0000000100)="8aee0f160cd31ba3e6251097d27c073443a6fe3ad3c5862614d46dd99f1d6d36d2099ff83caf845b5d27ada10f07e343941b2672c7431c0267f3700b4e75eb76e9b77158f799671348cb805c6a22fe", 0x4f}, {&(0x7f0000000080)="5255bb25e8ca627c1fdafe4765c5631abb0a", 0x12}, {&(0x7f0000000180)="a4f0aecb1c94524c14c14742aca38bfc8c01d53e1aa0d46a144d237bd4a8fc1b8ae45858bcff59076fbaddd02d339a4228d16f755e2e2ffdc751176aeaa3bafa084e5683de262523deac9ab00674e542528c09835da4a21f890ced80f37d848a52df1e0ff4375cb4366702f31e931f88b836685bbf3f", 0x76}, {&(0x7f0000000200)="b0051e78d12a6f33058371e37a35e1b646133e8afe883954886642648bb0beeab5a8131899f69574141ce99662993b36cafb71a3c0234f7ef84802d44da1729e64ac93baf1d835e096a64d11f917aa6b83f96a3d829b3956f531302e2b4282ca669f93acc8d9d4e5826cb7e6dfe3639259159eb0f3b01c3db331e00453d82486c2ceb79bf1b343b69e2d3f72545a203b59fd9cb3f2079206f2284ece56948100f21d814dcfc349ee99ff9ae8583e545355c5b600dd1fb3506d614af4dae0a9e236914b181f8367dbe37345403d13ee2db924e86619450b265ad4f14bea1bb5689a434cf098f2", 0xe6}], 0x4, 0x0, 0x0, 0x45}], 0x1, 0x10) 04:30:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="52721b1eb0c12e6153898bf71224be000000000000f000"], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="ea620000"], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cachefiles\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:30:55 executing program 0: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) truncate(&(0x7f0000000100)='./file0\x00', 0xff) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xffffffffffffff03) bind$unix(r2, &(0x7f0000000080)=@abs={0x0, 0x0, 0x4e21}, 0x6e) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000240)={{{@in=@initdev, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4}, 0x0, @in=@empty}}, &(0x7f0000000340)=0xe8) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000003c0)={'ip6_vti0\x00', r4}) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:30:55 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000000), &(0x7f0000000040)=0x4) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cachefiles\x00', 0x280240, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffff9c, 0x84, 0x9, &(0x7f0000000180)={0x0, @in={{0x2, 0x4e20, @multicast1}}, 0x100000000, 0x4, 0x401, 0x2, 0x20}, &(0x7f00000000c0)=0x98) setsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000000100)={r2, 0x7a6a, 0xe3, 0x24}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) ioctl$VIDIOC_S_MODULATOR(r1, 0x40445637, &(0x7f00000002c0)={0x20, "7ac12e88d7c59d6d0bb194727d30cca8e0bd46add00db86e2cf5b7d6f07a1dc8", 0x40, 0x1, 0x8, 0x7, 0x7}) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000240)={r2, 0x1f509d49}, &(0x7f0000000280)=0x8) socket$kcm(0x2, 0x2, 0x73) 04:30:55 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) gettid() tkill(0x0, 0x12) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r2, 0x40000000af01, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r2, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r3) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000180)={0x0, r3}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:55 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000040)={'bond_slave_0\x00', {0x2, 0x4e20, @remote}}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x200, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0f85403, &(0x7f0000000200)={{0xffffffffffffffff, 0x0, 0x1, 0x3, 0x1}, 0x8, 0xffffffffffffff98, 'id0\x00', 'timer0\x00', 0x0, 0x8, 0x3ff, 0x2, 0x800}) ftruncate(r0, 0x0) 04:30:55 executing program 5: r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffff9c, 0x84, 0x75, &(0x7f0000000000)={0x0, 0x8000}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f0000000080)={r1, 0x1}, 0x8) socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) [ 587.910268] binder: 25184:25188 unknown command 505115218 [ 587.916087] binder: 25184:25188 ioctl c0306201 20012000 returned -22 04:30:56 executing program 5: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000200)='/dev/full\x00', 0x10200, 0x0) ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x4e) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f0000000140)={@l2={0x1f, 0x0, {0x1, 0x0, 0x514b5d3c, 0xfffffffffffff800, 0x3, 0xfff}, 0x4, 0x100000000}, {&(0x7f0000000240)=""/140, 0xffffffffffffff9f}, &(0x7f0000000100), 0x6}, 0xfffffef6) [ 587.970513] binder: 25184:25188 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 587.990864] binder: 25184:25188 unknown command 25322 [ 587.996296] binder: 25184:25188 ioctl c0306201 2000dfd0 returned -22 [ 588.128100] binder: 25184:25188 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 588.148083] binder: 25184:25197 unknown command 505115218 [ 588.154011] binder: 25184:25197 ioctl c0306201 20012000 returned -22 04:30:56 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0x0) sysfs$3(0x3) 04:30:56 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) openat$urandom(0xffffffffffffff9c, &(0x7f0000000080)='/dev/urandom\x00', 0x40000, 0x0) socket$kcm(0x2, 0x2, 0x73) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r0, 0x6612) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x10000, 0x0) ioctl$RTC_ALM_SET(r2, 0x40247007, &(0x7f0000000040)={0x12, 0x24, 0x14, 0x15, 0x5, 0x10000, 0x1, 0x24}) [ 588.211143] binder: 25184:25188 unknown command 536872576 [ 588.216942] binder: 25184:25188 ioctl c0306201 20008fd0 returned -22 [ 588.249488] binder: 25184:25197 unknown command 25322 [ 588.254942] binder: 25184:25197 ioctl c0306201 2000dfd0 returned -22 04:30:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000240)={&(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ff5000/0x8000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ff5000/0x4000)=nil, &(0x7f0000ff5000/0x4000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ff5000/0x3000)=nil, &(0x7f0000ff6000/0x4000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ff6000/0x1000)=nil, &(0x7f0000000480)="b394c44a7e4a37a26be6b9237ce6a931a1a0d0f5010885064469b5be4917a7340e26fcf6c85604f8ad3de228aae3a8db8f3a88ccbaea659abae73a884ef3b57019c1744832deeb1f5c06685e67bc3ebe44a20e35eed6aabd1c8c31a588e48f867bf9b7a4c64c5d292acbc2157d180762c1bb66538777fdd8dd155210f74060c8067d294a60a9539dcfca1b66bdb50c6bbce834e411d214f32b6de895503cbc360e80634c6ccbf289b39491ce0ea51ad4b007274f43ae88132555239284ad38d57aeb4636d9", 0xc5, r1}, 0x68) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="4000000000000000d2b00d77e3619c64ed7acb60b08bd64c7672ae3dc92f35d4843c2b"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000380)=[@enter_looper], 0x128, 0x0, &(0x7f0000000100)="ae8d6b6fa2631047044fd92e3269a7a9923281e06160d0790c9a84261baaf69b6c4cc1e402e1f9e8e3abbcda1c5ca2fdce1a8187b8b5850043bd79df0fadae2ff5af23b0f5c0eb6a69e97bd55249ac6c8b39b6ec29bf8f9e78879295bc70bc6529b8f8c085263ff5d72439c26ecc9b19c4ef10749ba14cd39f551306a6e89fff7326a65ddd6d6a84b91d7a227d61eb4990c1345d51e47b469e9e82c001369bafb7f1216bf0e6b174ccdf18801fe99a826fee090f50342873fe6b374e3b3533167f52e938ad21f808bdbf388db4ef44028f00e2d91185b4c00d4e4d75a758c52d95b95c236f77032553e654701cc62d497da48eeb19404c03623ee59c1dc3b8691c2174b2313ffb5ca5bbcaabf16fc335355f0d0c58c96d80879f2ebe94cb0acdd2eba5cf00000000"}) r2 = dup(r1) read$FUSE(r0, &(0x7f0000000580), 0x1000) ioctl$sock_inet_SIOCSIFNETMASK(r2, 0x891c, &(0x7f00000000c0)={'team0\x00', {0x2, 0x4e23, @multicast2}}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) [ 588.450525] binder: 25214:25217 unknown command 64 [ 588.455756] binder: 25214:25217 ioctl c0306201 20008fd0 returned -22 [ 588.485463] binder: 25217 RLIMIT_NICE not set 04:30:56 executing program 5: socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) set_robust_list(&(0x7f0000000140)={&(0x7f0000000100)={&(0x7f00000000c0)}, 0x6}, 0x18) getpgid(0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x8000000, 0x0) write$P9_RXATTRCREATE(r0, &(0x7f0000000080)={0x7, 0x21, 0x1}, 0x7) [ 588.532030] binder: 25214:25222 ioctl 891c 200000c0 returned -22 [ 588.553415] binder: 25214:25222 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:56 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0xf9}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6(0xa, 0x80f, 0x2ea5) r2 = dup2(r1, r0) write$P9_RRENAMEAT(r2, &(0x7f0000000000)={0x7, 0x4b, 0x2}, 0x7) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0x625) ioctl$EVIOCGKEYCODE(r2, 0x80084504, &(0x7f0000000040)=""/2) [ 588.732681] device bridge_slave_1 left promiscuous mode [ 588.738416] bridge0: port 2(bridge_slave_1) entered disabled state [ 588.803432] device bridge_slave_0 left promiscuous mode [ 588.809254] bridge0: port 1(bridge_slave_0) entered disabled state [ 589.245015] binder: 25214:25222 unknown command 64 [ 589.250018] binder: 25214:25222 ioctl c0306201 20008fd0 returned -22 [ 589.266268] binder: 25222 RLIMIT_NICE not set [ 589.339086] device hsr_slave_1 left promiscuous mode [ 589.347021] binder: 25214:25241 ioctl 891c 200000c0 returned -22 [ 589.357657] binder: 25214:25240 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 589.413227] IPVS: ftp: loaded support on port[0] = 21 [ 589.424580] device hsr_slave_0 left promiscuous mode [ 589.475916] team0 (unregistering): Port device team_slave_1 removed [ 589.487162] team0 (unregistering): Port device team_slave_0 removed [ 589.498674] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 589.546100] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 589.582377] device bond_slave_0 left promiscuous mode [ 589.618872] bond0 (unregistering): Released all slaves [ 589.733843] chnl_net:caif_netlink_parms(): no params data found [ 589.788560] bridge0: port 1(bridge_slave_0) entered blocking state [ 589.795186] bridge0: port 1(bridge_slave_0) entered disabled state [ 589.803573] device bridge_slave_0 entered promiscuous mode [ 589.812591] bridge0: port 2(bridge_slave_1) entered blocking state [ 589.819063] bridge0: port 2(bridge_slave_1) entered disabled state [ 589.827227] device bridge_slave_1 entered promiscuous mode [ 589.884415] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 589.895138] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 589.916784] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 589.925059] team0: Port device team_slave_0 added [ 589.931160] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 589.939532] team0: Port device team_slave_1 added [ 589.945500] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 589.953654] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 590.017604] device hsr_slave_0 entered promiscuous mode [ 590.142472] device hsr_slave_1 entered promiscuous mode [ 590.212718] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 590.220124] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 590.243474] bridge0: port 2(bridge_slave_1) entered blocking state [ 590.249951] bridge0: port 2(bridge_slave_1) entered forwarding state [ 590.257017] bridge0: port 1(bridge_slave_0) entered blocking state [ 590.263532] bridge0: port 1(bridge_slave_0) entered forwarding state [ 590.306606] 8021q: adding VLAN 0 to HW filter on device bond0 [ 590.317797] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 590.328844] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 590.336821] bridge0: port 1(bridge_slave_0) entered disabled state [ 590.345155] bridge0: port 2(bridge_slave_1) entered disabled state [ 590.360543] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 590.366792] 8021q: adding VLAN 0 to HW filter on device team0 [ 590.380301] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 590.388399] bridge0: port 1(bridge_slave_0) entered blocking state [ 590.394937] bridge0: port 1(bridge_slave_0) entered forwarding state [ 590.436269] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 590.444204] bridge0: port 2(bridge_slave_1) entered blocking state [ 590.450579] bridge0: port 2(bridge_slave_1) entered forwarding state [ 590.458924] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 590.467193] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 590.475564] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 590.485862] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 590.500217] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 590.511503] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 590.518337] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 590.526329] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 590.547752] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 590.567100] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 590.642167] net_ratelimit: 24 callbacks suppressed [ 590.642189] protocol 88fb is buggy, dev hsr_slave_0 [ 590.653196] protocol 88fb is buggy, dev hsr_slave_1 [ 590.762208] protocol 88fb is buggy, dev hsr_slave_0 [ 590.767738] protocol 88fb is buggy, dev hsr_slave_1 04:30:58 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:58 executing program 5: ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000000)=0x0) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r0, 0xfffffffffffffebf, &(0x7f0000000040)={0x101}) socket$kcm(0x2, 0x2, 0x73) 04:30:58 executing program 3: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') sendmsg$TIPC_CMD_SET_NETID(r0, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400020}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x24, r1, 0x420, 0x70bd2b, 0x25dfdbfb, {{}, 0x0, 0x800b, 0x0, {0x8, 0x2, 0xfffffffffffffffb}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20040000}, 0x4000004) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) fsetxattr$trusted_overlay_origin(r2, &(0x7f0000000100)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x2, 0x3) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:58 executing program 0: openat$dsp(0xffffffffffffff9c, 0x0, 0x240180, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(&(0x7f0000000080)=ANY=[], &(0x7f00000000c0)='./file0\x00', &(0x7f0000000380)='sysfs\x00*\x86OK\xc0\v\xce\x1b\xdb cr\x13\xb1\xe8\x94\xd1 q_\x9d\xc1\x12[\x04,r&\xeb\x016\xd9bN\xa1\xd23t\xa6`\xfeZ\xc1sr/\xd3g\xad\"\xe8U0%\xa2\xe8\xbe\v\xc5QCy\xafr\x13\xd3+\x8d]\x06\xdc\x8f\xbf,\x84\x9e\xd9\xcd\xef\xc7K\x03\xdf\xa9\xcbZ\x90\xb2\x8bK$\xd7\x86,=f\xfc\xa51g\xd5BB5CZ=\xbbv\xbc}0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000080)=""/126, 0x76472e8) sendmsg(0xffffffffffffffff, 0x0, 0x0) write$binfmt_elf64(r0, &(0x7f0000000700)=ANY=[@ANYBLOB="7f454c4605ff02010200000000000000030003003f0000005e0200000000000040000000000000004003000000000000000000000900385dcac53ab9d623c89c00020000000180800007000000010000001e050000000000000800000000000000feffffffffffffffffffff7fffffffff01ffffffffffffff0d000000000000005cc0ff860e25664ebe7bca5fe34c7d98a8a1adc7fc6c6392d81bd49e3eef3a18ea492485863f72b4a8cdc337f6cdec3965fc85d9cba1efb3516bfb8a42ff4647a27ff75a6adc4383db6be22f4d2fb8e8c42206f1cbb968b8157315918d5632e837a17d4e24472bf9e3898a7fad08dc0f47a466e3dc7e505e9f81cd1c5f7923a48009d634ff49c3a2d1a6edd8e9e62c6999511849b28985af58b78074c3981c9d8024aea86e5288f50607ae78ce9e000000000000007b89dac4ae28a3107d6ad42e368e75a3b033083abc0ed592869d094b1fb5b533eebb325a2ae51f1d458095b4876064a9b734cc4c84bb989d0cd17240f4b6be748a0650d9187309622116239703b49b1c472816061f7aceaec5ed209b1d51a2df39f49cea6dea2d3baf388057d1d5f5bc5accd4e9bbc2fbca07350e31d61e746083c69a7d87af3b61de5a6846a805f8a0cc940a1eb29540bc6994b7218f53d0f928062f50e53d4ba6b0098675369f98847d0dd78f32e80bf7c6680aec1a3480b9c25a91b55a5e"], 0x12d) ioctl$VIDIOC_QUERYCTRL(r2, 0xc0445624, &(0x7f0000000480)={0x9a01, 0x5, "ba0aa2232ada73c12bc48c7607b9e5dbd9453260608c515ca9097155825f7d1d", 0x7, 0x200, 0x100000001, 0x2}) 04:30:58 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000180)={0x3, 0x1, &(0x7f0000000480)=""/4096, &(0x7f0000000040), &(0x7f00000000c0)=""/156, 0x2}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 04:30:58 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) timerfd_create(0x5, 0x800) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x200000, 0x0) setsockopt$inet_tcp_buf(r1, 0x6, 0xe, &(0x7f0000000100)="feeb8dcd6f2d20210da5e5cc76a4d52107218b7d6b5b51b8927a400ed0283aa11314bddffd9e42b34f12152d788e019b3c0369e342a08f975b4835042810da5aad08ea5affbfb2fba4a5cda55a663b8e403673ed14c1b9d4adcbd9a53f65219f05b7d61749705e73786255e4671723e4f7bebf375b81e6bf164110e14fdd8403ea7091fba70f0f736c13882031a68cf7c3205e713a7052c75fe44773d871dc8c64e661571b1a7e369b7eb153d6", 0xad) ftruncate(r0, 0x0) [ 590.882346] protocol 88fb is buggy, dev hsr_slave_0 [ 590.887879] protocol 88fb is buggy, dev hsr_slave_1 [ 590.918830] binder: 25263 RLIMIT_NICE not set [ 590.945996] binder: 25262:25263 unknown command 0 [ 590.951052] binder: 25262:25263 ioctl c0306201 20000440 returned -22 04:30:59 executing program 5: socket$kcm(0x2, 0x2, 0x73) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x400001, 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f0000000040)={0x3, 0x3, 0x401, 0x3, 0x6}) socket$kcm(0x2, 0x2, 0x73) [ 591.003057] protocol 88fb is buggy, dev hsr_slave_0 [ 591.008512] protocol 88fb is buggy, dev hsr_slave_1 [ 591.045705] binder: 25263 RLIMIT_NICE not set 04:30:59 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x0, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:30:59 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3fffffffffd, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ftruncate(r1, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) bind$unix(r0, &(0x7f0000000100)=@file={0x1, './file0\x00'}, 0x6e) ioctl$KVM_SET_PIT(r2, 0x8048ae66, &(0x7f0000000000)={[{0x7f, 0x9, 0x80000000000000, 0x6, 0x2, 0x605, 0xfffffffffffff5ab, 0x0, 0x9, 0xa26, 0xf9c, 0x100000000, 0x8001}, {0x1, 0x401, 0x5, 0x3f, 0xfff, 0x2, 0x9, 0x8, 0x7, 0x0, 0x5, 0xa3ec, 0x4}, {0x9, 0x6000000000000000, 0xfc, 0x4, 0x8, 0x0, 0x4, 0x7, 0x3793, 0x4, 0x3, 0x3, 0x3ff}], 0x2}) 04:30:59 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x400000000000027, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="2dc2734000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) openat$autofs(0xffffffffffffff9c, &(0x7f0000000380)='/dev/autofs\x00', 0x200000, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffff9c, 0x84, 0x1f, &(0x7f0000000480)={0x0, @in6={{0xa, 0x4e21, 0x6, @loopback, 0x4}}, 0x3}, &(0x7f00000003c0)=0x90) r2 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x1, 0x80000) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffff9c, 0x84, 0x9, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e21, @multicast1}}, 0x4, 0x8, 0x80000000000, 0xfa7b, 0x20}, &(0x7f0000000180)=0x98) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000001c0)={r3, 0xbf, "c60e623c5df280b29601e10776676b476a69644abfbab1ae670baa94ae4bda81531e793150191a40193458f4e0326659d128a8c8ddf8431701d3b6d573509375ae71401b7aa637a34f31be19d0accf1deb8ca98af57b96a31f62187e32bbb0bbb12c6dde797aa76f84e79cf953c1af0d6974a8bf21eacc1d949b8eac7be4ad47c4922f30d2c2c8d4e5ea0f697326a735b74ad6796f86d302ae3e548d88fbafb8106fd1066f0ab74f59bd83481dcab3a6bd5b099d9ced3fce8bf6fba5cc6985"}, &(0x7f0000000300)=0xc7) r4 = dup(r1) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) dup3(r1, r4, 0x80000) 04:30:59 executing program 5: r0 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x7, 0x4000) write$vhci(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="02f964975703fed81c00f73b2d1557033eb5afc5572365d1481c99efeacdc1d50d53a976155eb682e62cfbf2128d3b5ef2a0ac24d7ba81beecf69875a19fa7df324f1644127eca6cbd025de42821605896db2423f4461a1f1c2194322bbfb3c48318586b51f3e7ee2efd3a526b4d454c2a2bab53d7f4b5a203152730d0e1e439cf6aa1cdff706a2b44191e287f3ed4e8abe54bb2b46f8bc607822b19b2763d467b6b4685b5cbbfe5af4f763c039ce3934dd2d619e777d96197080fac8359000000e9c16f05536e22c21428"], 0x7c) socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:30:59 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x0, &(0x7f00000000c0), 0x0, 0x8) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 591.424936] binder: 25294:25295 unknown command 1081328173 [ 591.430690] binder: 25294:25295 ioctl c0306201 20008fd0 returned -22 [ 591.463162] protocol 88fb is buggy, dev hsr_slave_0 [ 591.469219] protocol 88fb is buggy, dev hsr_slave_1 04:30:59 executing program 2: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x5, 0x70, 0xbea5, 0x3f, 0x3df9, 0x9, 0x0, 0x2, 0x620, 0x8, 0xfffffffffffffff7, 0x6, 0x7, 0x6, 0xe2, 0x1, 0x3ff, 0x100, 0x0, 0x1000, 0x7, 0x7f, 0x17ff, 0x7, 0x2c5, 0x3, 0x81, 0x4, 0x9, 0x4af, 0x3, 0x7, 0x7, 0x3, 0xff, 0x234a, 0x1, 0x5, 0x0, 0x8000, 0x2, @perf_bp, 0x1000, 0x1000, 0x4, 0x6, 0x7f, 0x401, 0x100000001}, r2, 0xb, r0, 0x8) lsetxattr$security_capability(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='security.capability\x00', &(0x7f0000000240)=@v1={0x1000000, [{0x8, 0x6}]}, 0xc, 0x2) ftruncate(r1, 0x0) [ 591.529560] binder: 25302 RLIMIT_NICE not set 04:30:59 executing program 3: socketpair$unix(0x1, 0x4, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) [ 591.565590] binder: 25294:25295 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 591.685078] binder: 25302 RLIMIT_NICE not set [ 591.735243] binder: 25294:25295 unknown command 536872576 [ 591.740991] binder: 25294:25295 ioctl c0306201 20008fd0 returned -22 [ 591.800243] binder: 25294:25295 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:30:59 executing program 0: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f00000003c0)='cE\xec\xbbXp.proc\x01\x00\x92\xd687\xa5\xa7\x13\x95\xed\xee\x17t\xd2\xf27\xa5\xb4\xbb\x8e\x84q\x8a\x00\"\xe8d\x1b\xd7?\xf8+2\xcd\x83~\xf4\xb2\x94\xe9%\xb6,\xc4\x80\x80\f\x10%\xd0\xed\x02\xb2A;+$\b8\x1a\xe3\nQ\x9a\x03\x01\xe2:\f]\xf3p\\\x17j\xb5\xd8)n\x04\x12\xd8\xe2^\xd1\x04E\xf2\xebi\xbel\xd8m^\x9d\x92w\xfe\xcc\xcfni-F\x02a\x94\rlRr\xc7X\xaa\xff\x86Fg\xbb\x90\x1d\xf3?\xa2D\xe1\xcb\x1aK*\x9e\x89\xed\xcc\x13\xef]\xb17\xc3Q9[\xda\xd3G\xd9\xc0\xca\xfa\xcaF\x1b1\xdc\f\xc5\x10\xc1^\xf1\x12\x93\x92\x15\x18)\x01\x1d\xf7\xb7\x1c\xd7\x1b\tW~\x9c\x1fn6]\x80\xe4\x8d\xecuw\xb7\xe0\xbe\xa11\xcb\x85\xc8|\xd7\x0f\xc6\xc9\xc9\xeb\x99C\x10M\xee\x03\xf8\xe4\x1dT\x06\x05u\xb94\x1e4\xde\n\xbc\xfe\xbe1\x99J\xc8\x18\xc6\x90c\xdaX\xfb\x1dm\v\xc3\xa1\x05tf\xd0\x15m)\x8deP\x9f\x0e\x81\xab(SU\x031+9\xc3t-\xed\x8a\x12\xc4\x9f\xf15\x18\xf2\x8b\xc4>#?9\x12\x19\xd2[W\x7fm\x96X`*\x9d\x9c\x00\x00\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:30:59 executing program 5: socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x7, 0x73) 04:30:59 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$sock_TIOCOUTQ(r0, 0x5411, &(0x7f0000000140)) r2 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000280)='/proc/capi/capi20ncci\x00', 0x20800, 0x0) getsockopt$IP6T_SO_GET_REVISION_MATCH(r2, 0x29, 0x44, &(0x7f00000002c0)={'icmp\x00'}, &(0x7f0000000300)=0x1e) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0xe6ede15955184857, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r3, 0x10e, 0x8, &(0x7f0000000040)=0xcdaa, 0x4) lsetxattr$security_smack_entry(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='security.SMACK64MMAP\x00', &(0x7f0000000240)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x24, 0x3) ftruncate(r1, 0x0) 04:30:59 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:00 executing program 3: socketpair$unix(0x1, 0x13, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = shmget(0x3, 0x1000, 0x80, &(0x7f0000ffc000/0x1000)=nil) r3 = geteuid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000000100)=0xc) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000180)={{{@in6=@remote, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000280)=0xe8) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000002c0)={0x0, 0x0, 0x0}, &(0x7f0000000300)=0xc) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000340)={0x0}, &(0x7f0000000380)=0xc) r8 = getpgid(0xffffffffffffffff) shmctl$IPC_SET(r2, 0x1, &(0x7f00000003c0)={{0x7, r3, r4, r5, r6, 0x0, 0x100}, 0x966, 0x0, 0x9, 0x1, r7, r8, 0x1}) socket$kcm(0x2, 0x0, 0x73) syz_genetlink_get_family_id$team(&(0x7f0000000140)='team\x00') socket$kcm(0x2, 0x2, 0x73) r9 = syz_open_dev$video4linux(&(0x7f0000000480)='/dev/v4l-subdev#\x00', 0x5, 0x80000) ioctl$VIDIOC_TRY_EXT_CTRLS(r9, 0xc0205649, &(0x7f0000000500)={0xa30000, 0xfffffffffffffff7, 0x3ff, [], &(0x7f00000004c0)={0xa30001, 0x5, [], @ptr=0x8}}) r10 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x80000, 0x0) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r10, 0x84, 0x16, &(0x7f0000000040)={0x5, [0x4, 0x0, 0x6, 0x3b4000000000, 0x10000]}, &(0x7f0000000080)=0xe) 04:31:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) r2 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video0\x00', 0x2, 0x0) ioctl$VIDIOC_UNSUBSCRIBE_EVENT(r2, 0x4020565b, &(0x7f00000000c0)={0x800100f, 0x9, 0x3}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer2\x00', 0x602a00, 0x0) setsockopt$bt_rfcomm_RFCOMM_LM(r3, 0x12, 0x3, &(0x7f0000000140)=0x4, 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r4 = dup(r1) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:31:00 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:00 executing program 5: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') sendmsg$IPVS_CMD_SET_SERVICE(r0, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4008}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x58, r1, 0x200, 0x70bd27, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_SERVICE={0x30, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'sed\x00'}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@rand_addr=0x3}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x9643}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7fffffff}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x48000000}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000010}, 0x80) socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) [ 592.249427] binder: 25354 RLIMIT_NICE not set 04:31:00 executing program 2: unlink(&(0x7f0000000000)='./file0\x00') r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10000004001ff) ftruncate(r1, 0x0) [ 592.287276] binder: 25353:25354 tried to acquire reference to desc 0, got 1 instead 04:31:00 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) [ 592.363349] binder: 25353:25363 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 592.431147] binder: 25363 RLIMIT_NICE not set 04:31:00 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:00 executing program 5: r0 = socket$kcm(0x2, 0x2, 0x73) r1 = gettid() r2 = syz_open_pts(0xffffffffffffffff, 0x40000) ioctl$TIOCNXCL(r2, 0x540d) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000000)=0x0) r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x40, 0x0) ioctl$VIDIOC_STREAMOFF(r4, 0x40045613, &(0x7f0000000100)=0x3c8e) kcmp$KCMP_EPOLL_TFD(r1, r3, 0x7, r0, &(0x7f0000000080)={r4, r0, 0x2}) socket$kcm(0x2, 0x2, 0x73) ioctl$VT_OPENQRY(r2, 0x5600, &(0x7f0000000140)) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r4, 0x84, 0x20, &(0x7f00000000c0)=0x3, 0x4) [ 592.482123] binder: 25353:25371 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:31:01 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) r1 = shmget(0x2, 0x1000, 0x4, &(0x7f0000ffe000/0x1000)=nil) shmctl$IPC_STAT(r1, 0x2, &(0x7f0000000000)=""/119) socket$kcm(0x2, 0x2, 0x73) 04:31:01 executing program 0: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) mq_timedsend(r3, &(0x7f0000000080), 0x0, 0x7fff, &(0x7f00000000c0)) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:31:01 executing program 2: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ftruncate(r1, 0x0) 04:31:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = signalfd4(r0, &(0x7f0000000140)={0x100}, 0x8, 0x80000) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000180)={0x0, r0, 0x100000001, 0x84c, 0x45, 0x40}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) fsetxattr$trusted_overlay_upper(r2, &(0x7f0000000040)='trusted.overlay.upper\x00', &(0x7f00000000c0)={0x0, 0xfb, 0x5a, 0x2, 0x9, "a540dd9b84f361f3cb108a95b083ab86", "d349755d7b1dbdbdd034f53bccb8e2bcea25588e99e6518a19287d03151306518dcbb6460169cf209ef0fffd4b22920f9efe37af838c9cc75443aa94f6b1354b6b8d54683c"}, 0x5a, 0x2) r3 = dup(r2) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:31:01 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:01 executing program 5: socket$kcm(0x2, 0x2, 0x73) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x88140, 0x0) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000000040)={0x9}, 0x4) socket$kcm(0x2, 0x2, 0x73) [ 593.101432] binder: 25402 RLIMIT_NICE not set [ 593.120862] binder: 25401:25413 tried to acquire reference to desc 0, got 1 instead [ 593.132647] binder: 25401:25402 unknown command 536872576 [ 593.138256] binder: 25401:25402 ioctl c0306201 20008fd0 returned -22 [ 593.167157] binder: 25414 RLIMIT_NICE not set 04:31:01 executing program 5: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='trusted.overlay.nlink\x00', &(0x7f0000000240)={'L-', 0x800}, 0x28, 0x1) socket$kcm(0x2, 0x2, 0x73) syz_open_dev$sndseq(&(0x7f0000000080)='/dev/snd/seq\x00', 0x0, 0x10800) timer_create(0x2, &(0x7f00000000c0)={0x0, 0x25, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000100)=0x0) timer_settime(r1, 0x1, &(0x7f0000000140)={{0x77359400}, {0x77359400}}, &(0x7f0000000180)) socket$kcm(0x2, 0x2, 0x73) connect$vsock_stream(r0, &(0x7f0000000040)={0x28, 0x0, 0x10000000002711, @my=0x0}, 0x10) 04:31:01 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x4000, 0x0) setsockopt$inet_udp_int(r1, 0x11, 0x0, &(0x7f0000000040)=0x3, 0x4) ftruncate(r0, 0x0) 04:31:01 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x1, 0x0) ioctl$BLKSECDISCARD(r1, 0x127d, &(0x7f00000001c0)=0x3) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$VIDIOC_ENUMOUTPUT(r1, 0xc0485630, &(0x7f0000000080)={0x7fff, "0e1b8251c6e3c91111dc93dd963795cfd3e76bedd43f041196b7ef22b8de5136", 0x1, 0x0, 0x1, 0xb700, 0x6}) socket$kcm(0x2, 0x0, 0x73) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x800, 0x0) socket$kcm(0x2, 0x2, 0x73) 04:31:01 executing program 4: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x40000, 0x0) symlinkat(&(0x7f0000000040)='./file0\x00', r0, &(0x7f0000000100)='./file0\x00') r1 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="f66204401d000000"], 0x0, 0x0, 0x0}) close(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r3 = dup(r2) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:31:01 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:01 executing program 5: r0 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x0) r1 = getpgid(0xffffffffffffffff) ioctl$TIOCSPGRP(r0, 0x5410, &(0x7f0000000040)=r1) socket$kcm(0x2, 0x2, 0x73) sendto$unix(r0, &(0x7f0000000080)="c7dbff93a35528d76190f525011a6f3b55a4142ff6ee495c91b444a82d6a5a57a7221f63210037358b1375fa0969ef80eb2fcdb68bbde0e1988dc94dbee345d12823128809e9662efea497bc22f4b3b42134c1befb9b8909733bddfcf7ea7b15ac7968f6da93b6e4d21047fc7a9dab2447b794dfa96d9dbf3a4d6662ea3345087d1008200450a5c23af6f61ba862cc296d2717f2", 0x94, 0x20000004, &(0x7f0000000140)=@file={0x1, './file0\x00'}, 0x6e) socket$kcm(0x2, 0x0, 0x73) [ 593.613145] Unknown ioctl 4733 [ 593.620602] binder: 25441:25444 unknown command 1074029302 [ 593.626513] binder: 25441:25444 ioctl c0306201 20012000 returned -22 [ 593.644601] Unknown ioctl -1069001168 04:31:01 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 593.672694] binder: 25441:25444 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 593.697641] binder: 25444 RLIMIT_NICE not set [ 593.769014] binder: 25441:25451 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 593.809129] Unknown ioctl 4733 [ 593.813551] Unknown ioctl -1069001168 04:31:02 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r0, 0x4010ae68, &(0x7f0000000080)={0x2000}) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r4, &(0x7f0000011fd2), 0xffffffee) read(r3, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:31:02 executing program 2: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r1) r2 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x3ad2c851, 0x440000) ioctl$VIDIOC_SUBDEV_G_FMT(r2, 0xc0585604, &(0x7f0000000100)={0x0, 0x0, {0x80000000, 0x80, 0x200d, 0x3, 0x6, 0x8, 0x0, 0x5}}) ftruncate(r1, 0x0) 04:31:02 executing program 5: socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:31:02 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x3, 0x73) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x1, 0x0) ioctl$VIDIOC_S_SELECTION(r1, 0xc040565f, &(0x7f0000000040)={0xf, 0x0, 0x1, {0x8001, 0x5, 0x0, 0x9}}) 04:31:02 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:02 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:02 executing program 5: r0 = socket$kcm(0x2, 0x2, 0x73) finit_module(r0, &(0x7f0000000000)='\x00', 0x3) 04:31:02 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) [ 594.414225] binder: 25441:25451 unknown command 1074029302 [ 594.419976] binder: 25441:25451 ioctl c0306201 20012000 returned -22 [ 594.479403] binder: 25441:25451 unknown command 536872576 [ 594.485450] binder: 25441:25451 ioctl c0306201 20008fd0 returned -22 [ 594.495679] binder: 25495 RLIMIT_NICE not set [ 594.510409] binder: 25441:25499 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:31:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) finit_module(r0, &(0x7f0000000040)='/dev/binder#\x00', 0x1) r2 = syz_open_dev$vivid(&(0x7f0000000580)='/dev/video#\x00', 0x3, 0x2) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r2, 0xc040564a, &(0x7f00000005c0)={0x2, 0x0, 0x2024, 0xac, 0x3ff, 0x3, 0x5, 0x1}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r3 = dup(r1) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000000, 0x1110, r3, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="00ae6784ecc74ac3bbf4d68ee6d153168d50f0d7099bd5fe4f950cdce42ccc430c32a09b2d75225a0da1029be9f2ac8ddbaed96d788160631a45328a2c6f0df488eda70097829d26c236fed36e226744f27c4d7c6862822f2e1ee55be383e85719f6b244fd0c8e810d6537084e1acca8f5c45cea7a242d9a676c0e43af5ffea280e365bfce26f4c1675226b4ae64b1181e41fe6e6c969dc9ea5ccee54a365ce48c61f1a9920db32e4a25cd11b74d117620573a79efb0e346acb3fce757beffbc69e3a6f38d542a5bf2ad67235cae30e534aba467a07d96e693f8eed0536e54a7f32b1ad1916ac9dcdb4b02816e517b790b1d83a61b7c55e6c1fd6abbbc1d9f80777afeac93ab36023cc81c0dcd11cb1c221a5288fe46461f9157e235a12a061a6b981f78c3aac6fc64280f4bb8301cd375e5b275b5030d06cf53ced945e536113adf25969e95d35ec2f668764a3be5073cd9ae8f3a0712aa0a51c47747c6b2812c1e7060fa534928f86808ee9888d16e7fe84b2909d56ea4b48064aa202b2f9960e8ec7d79aae382e6e071292946ed3da1a9df7f71399f0cb54db8fac1cf27ad07ef91e08b6133cc9fe8f8b9584ecd636e1dd9f175afbb0dbff77728479a408703d3fddfb2"], 0x0, 0x0, 0x0}) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000600)={0x6, 0x6, 0x2, 0x6, 0x3, [{0xfb7b, 0x1, 0x800, 0x0, 0x0, 0x2}, {0xfffffffffffffff9, 0x81, 0x5, 0x0, 0x0, 0x10d}, {0x800, 0x405fbbbc, 0x10001, 0x0, 0x0, 0x88}]}) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000380)={r3, &(0x7f0000000300)="ab80ab89785facff04907b65a3bf9da69f0be7f076c3ac3c5ce2a2ba68b9f45f58951b7063326fc52b57faaf4b9d2102b536f64445f54f0e03dce699ee314b871e860c45130c0650e240a1760a8df3b0fb4b1d449f171415f37530a9d99beca0a6e46695d50e1ad6b424e634a2b043efc3ac837cdb8034b2"}, 0x10) dup(r0) prctl$PR_SET_MM_AUXV(0x23, 0xc, &(0x7f0000000480)="25d57000a62423da1d36eb0567e1fdde51ed3d09c4fd9784b739f94b543cfafe5810187032d80af3562559d557a4900bda586f5a0b27dd9b082fdc6fad0a5066a40d114b36b88b77f37a3c986aefc60eed4c6c974405abdf43eed5fd71c217928fd8d18707afbe21b9affd39444c85cba95306f028ab3b3701cdb9f90ff4f2b1963ca5cd213df531699c98beab3498bb0ef2858f9b98575c630206164d88198348cf1c36de7860fd90bd4f99fd9a873bf94fe4fb9b057632a07d59100cb91926427d", 0xc2) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f00000003c0)) epoll_ctl$EPOLL_CTL_MOD(r3, 0x3, r0, &(0x7f0000000400)) 04:31:02 executing program 5: socket$kcm(0x2, 0x1, 0x73) syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x3, 0x1) socket$pppoe(0x18, 0x1, 0x0) socket$kcm(0x2, 0x2, 0x73) 04:31:02 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$mouse(&(0x7f0000000080)='/dev/input/mouse#\x00', 0x7f, 0x803) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x8) socket$kcm(0x2, 0x0, 0x73) ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000000)) getsockopt$bt_BT_SECURITY(r1, 0x112, 0x4, &(0x7f0000000040), 0x2) 04:31:02 executing program 2: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x10000, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r0, 0xc018643a, &(0x7f0000000040)={0x2000003e, 0x9, 0x3f}) r1 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000100)={0x0, {0x2, 0x4e22, @empty}, {0x2, 0x4e24, @multicast2}, {0x2, 0x4e23, @multicast2}, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff, 0x8001, 0x1fc0000}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) ioctl$VIDIOC_DECODER_CMD(r0, 0xc0485660, &(0x7f0000000200)={0x0, 0x2, @raw_data=[0x7, 0x6480000000, 0xfffffffffffffe01, 0xffffffff, 0x2e2, 0x6, 0x6, 0x5, 0x1, 0x100000000, 0x401, 0x6, 0x1, 0x2, 0x7, 0x1]}) ftruncate(r1, 0x0) [ 594.804470] binder: 25510:25513 unknown command -2073580032 [ 594.810398] binder: 25510:25513 ioctl c0306201 20000440 returned -22 [ 594.914205] binder: 25510:25513 ioctl 4008af00 200003c0 returned -22 [ 594.960102] binder: 25510:25513 tried to acquire reference to desc 0, got 1 instead [ 595.011831] binder: 25510:25525 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 595.062131] binder: 25510:25530 unknown command -2073580032 [ 595.067975] binder: 25510:25530 ioctl c0306201 20000440 returned -22 [ 595.083138] binder: 25510:25525 ioctl 4008af00 200003c0 returned -22 04:31:03 executing program 5: socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) r0 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1f, 0x541) ioctl$DRM_IOCTL_GEM_FLINK(0xffffffffffffffff, 0xc008640a, &(0x7f0000000040)={0x0, 0x0}) ioctl$DRM_IOCTL_GEM_FLINK(0xffffffffffffff9c, 0xc008640a, &(0x7f0000000080)={0x0}) ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f00000000c0)={r1, r2, 0xffffffffffff0e13}) ioctl$DRM_IOCTL_IRQ_BUSID(r0, 0xc0106403, &(0x7f0000000100)={0x8, 0x2da8, 0x1f, 0x7}) 04:31:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='numa_maps\x00') ioctl$CAPI_NCCI_GETUNIT(r1, 0x80044327, &(0x7f00000000c0)=0x1) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r3 = dup(r2) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:31:03 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:03 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/attr/current\x00', 0x2, 0x0) socket$kcm(0x2, 0x5, 0x73) socket$kcm(0x2, 0x2, 0x73) r1 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x3, 0x76eeeb427eab0329) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffff9c, 0x84, 0xf, &(0x7f0000000080)={0x0, @in={{0x2, 0x4e24, @remote}}, 0xede6, 0x8, 0x86a, 0x1f, 0x30}, &(0x7f0000000180)=0x98) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f00000001c0)={0x5, 0x800e, 0x58c, 0x69, r2}, &(0x7f0000000200)=0x10) 04:31:03 executing program 0: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) sendmsg$inet_sctp(r0, &(0x7f0000000340)={&(0x7f0000000080)=@in6={0xa, 0x4e24, 0x8, @empty, 0xffff}, 0x1c, &(0x7f0000000100)=[{&(0x7f0000000240)="e7ad0a2c3d85b20a9415447c273e595e8f6fe57115ec2e76af3c384c390ce6d15d852fedcacffba68a686c358c3b9c1eb86a9d45f159a69a4276dddfc315c37b4f1fbfca3f1b0717189e30b9728ca843ad01fc76b80e7fbdb4b4fd70d2546b6532ad71a44d69a6caca6c1c123a9747a98a92e752217e9771d7becf5ef7a8b685029c6a12ed87f37ec3fc557b63259d122e429a8d272314ceaddaca391a23c2b8bae0", 0xa2}, {&(0x7f00000000c0)="b5d609334117be2a158ad189fb44", 0xe}], 0x2, &(0x7f0000000300)=[@dstaddrv6={0x20}], 0x20, 0x40}, 0x20000000) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:31:03 executing program 2: r0 = syz_open_dev$swradio(&(0x7f0000000100)='/dev/swradio#\x00', 0x0, 0x2) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f0000000140)=0x7ff) r1 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x2000, 0x0) fcntl$dupfd(r1, 0x0, r2) ioctl$BLKPBSZGET(r2, 0x127b, &(0x7f0000000040)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ftruncate(r3, 0x0) [ 595.354224] binder: 25540:25549 tried to acquire reference to desc 0, got 1 instead 04:31:03 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:31:03 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) umount2(&(0x7f0000000040)='./file0\x00', 0xd) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) ioctl$sock_SIOCGSKNS(r1, 0x894c, &(0x7f0000000000)=0x1) [ 595.394962] binder: 25540:25549 unknown command 536872576 [ 595.400623] binder: 25540:25549 ioctl c0306201 20008fd0 returned -22 04:31:03 executing program 5: r0 = socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) recvmsg(r0, &(0x7f0000000140)={&(0x7f0000000000)=@alg, 0x80, &(0x7f0000000080), 0x0, &(0x7f00000000c0)=""/77, 0x4d}, 0x2) [ 595.472552] binder: 25540:25553 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:31:03 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84800) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f00000000c0)={0x0, 0x45, "18a50ef8832cfbdf656ac8dd00195a135c6ae7917b5ec95a3f84faf0ec77d365388613b4707ef81bba58e02e97f3d50344e80c9e6421933d16472323fd3fe69066175c9b5a"}, &(0x7f0000000140)=0x4d) setsockopt$inet_sctp_SCTP_AUTH_DEACTIVATE_KEY(r2, 0x84, 0x23, &(0x7f0000000180)={r3, 0x3f}, 0x8) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r5 = dup(r4) ioctl$TIOCLINUX2(r1, 0x541c, &(0x7f0000000280)={0x2, 0xfa8d, 0x1, 0x4, 0x1, 0x9}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f00000001c0)={0x992b, 0x8, 0x3a, 'queue0\x00', 0x6}) 04:31:03 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000040)={0x0}, &(0x7f0000000180)=0xc) sched_setparam(r0, &(0x7f0000000200)=0x8) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ftruncate(r1, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x10200, 0x0) ioctl$KVM_GET_XCRS(r2, 0x8188aea6, &(0x7f0000000240)=ANY=[@ANYBLOB="0600000005e4a2144347000000930e00000000000000020000000000008000000000000000040000000000000001000000000000000000000000000000ee00000000000000010000000000000006000000000000000001000000000000ff070000000000003f00000000000000b47ec45c345d43d160a75631712263d834899af6d5d7596d8c828e381427a8cf3dd6806487521421585d55b4bea1950c6b657a9d83d2bb9296be55037a8150db8f68dca0603489a894fddcb1df97850200000000000000e318135cd3e3560c07bc405a2f022ada8ae7a6b57de41e2c0a305713f503180c4e35539d5572f6992d7f0d3f713079d8e4c2a8bb8219c41e9720a87504"]) 04:31:03 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) prctl$PR_GET_SECUREBITS(0x1b) [ 595.874015] binder: 25577:25580 tried to acquire reference to desc 0, got 1 instead [ 595.949960] binder: 25577:25584 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 595.988320] binder_set_nice: 5 callbacks suppressed [ 595.988334] binder: 25578 RLIMIT_NICE not set [ 596.005801] binder: 25577:25584 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:31:04 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000380), 0x12) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000240)={0x101, {{0x2, 0x4e23, @broadcast}}}, 0x88) pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) write$sndseq(r0, &(0x7f0000011fd2), 0xfffffffffffffe1b) ioctl$KVM_ENABLE_CAP(r3, 0x4068aea3, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x4, 0x400, 0xad8]}) read(r3, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:31:04 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, 0x0) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0xfffffffffffffe7b, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) r2 = dup2(r1, r1) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000240)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x18, 0x0, &(0x7f0000000280)=[@register_looper, @free_buffer={0x40086303, r3}, @increfs={0x40046304, 0x1}], 0x23, 0x0, &(0x7f0000000300)="d5a9989b0e54b8f4927b313480647c7d274bfeb0101e126aee4d75b54c63e11b7bbeb8"}) ioctl$KVM_SET_CLOCK(r2, 0x4030ae7b, &(0x7f0000000100)={0x1, 0x5}) ioctl$VIDIOC_CREATE_BUFS(r2, 0xc100565c, &(0x7f0000000140)={0xfffffffffffffffa, 0x5f07, 0x5, {0x1, @raw_data="e2800378a9443d5febbffaf322f6759d913e47151ef63fd07a55f27e4c31f57fc7cb609e452fd934db4cd1d7fb9da543484f8022691601e746f00e47916dd747b8288466c1825a25caf8df9f5a0a0d32976d87a90c24cc614c693178e00578ba212e74ea2d8aa19ec81dd9b26ce25a9f9628bbdf8a0981222f762bde009a4e3c2e648d6a73c452785377ba2937a717c5fc0fca0a893eb52f70b9a9ce7bf95722598354741a083a3bc040465cdf1de499a34d34a312d9858a4d631aae171fc774fd0a7170f1cec8ef"}}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) fsetxattr$trusted_overlay_nlink(r0, &(0x7f0000000000)='trusted.overlay.nlink\x00', &(0x7f00000000c0)={'U+', 0x101}, 0x28, 0x2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r4 = dup(r1) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:31:04 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0x0) [ 596.262201] net_ratelimit: 24 callbacks suppressed [ 596.262218] protocol 88fb is buggy, dev hsr_slave_0 [ 596.262265] protocol 88fb is buggy, dev hsr_slave_0 [ 596.267585] protocol 88fb is buggy, dev hsr_slave_1 [ 596.272869] protocol 88fb is buggy, dev hsr_slave_1 [ 596.277855] protocol 88fb is buggy, dev hsr_slave_0 [ 596.293071] protocol 88fb is buggy, dev hsr_slave_1 [ 596.298843] protocol 88fb is buggy, dev hsr_slave_0 [ 596.304430] protocol 88fb is buggy, dev hsr_slave_1 04:31:04 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x400000, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x200001, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x6000, &(0x7f0000000040), 0x0, r2, 0x2}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) [ 596.304749] binder: 25601:25602 ERROR: BC_REGISTER_LOOPER called without request [ 596.317441] binder: 25601:25602 BC_FREE_BUFFER u0000000000000000 no match [ 596.324712] binder: 25601:25602 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 596.332568] binder: 25602 RLIMIT_NICE not set [ 596.366357] binder: 25601:25607 ioctl 4030ae7b 20000100 returned -22 [ 596.385038] binder: 25601:25607 ioctl c100565c 20000140 returned -22 [ 596.401038] binder: 25601:25607 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:31:04 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x80000) ioctl$DRM_IOCTL_RES_CTX(r1, 0xc0106426, &(0x7f0000000100)={0x1, &(0x7f0000000040)=[{}]}) ioctl$VIDIOC_SUBDEV_G_DV_TIMINGS(r1, 0xc0845658, &(0x7f0000000200)={0x0, @bt={0x4, 0x101000, 0x0, 0x3, 0xb6a, 0x200, 0xffff, 0x7, 0x1, 0x0, 0x9, 0x1, 0x6, 0x7c, 0x18, 0x17}}) ftruncate(r1, 0x8) [ 596.420825] binder: 25607 RLIMIT_NICE not set 04:31:04 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, 0x0) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 596.468606] binder: 25601:25619 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:31:04 executing program 5: socket$kcm(0x2, 0x2, 0x73) r0 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f0000000040)) prctl$PR_SET_CHILD_SUBREAPER(0x24, 0x1) socket$kcm(0x2, 0x2, 0x73) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x80, 0x0) 04:31:04 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) prctl$PR_SET_CHILD_SUBREAPER(0x24, 0x4) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x100, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_GET_INFO(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, r2, 0x904, 0x70bd29, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x10000}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x20000000}, 0x48000) 04:31:04 executing program 2: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0xdca, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0xc3a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) openat$uhid(0xffffffffffffff9c, &(0x7f0000000100)='/dev/uhid\x00', 0x802, 0x0) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x20000, 0x0) setsockopt$ALG_SET_AEAD_AUTHSIZE(r2, 0x117, 0x5, 0x0, 0x1) ioctl$DRM_IOCTL_GET_STATS(r2, 0x80f86406, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r3 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uhid\x00', 0x802, 0x0) ioctl$VT_ACTIVATE(r0, 0x5606, 0x7) ftruncate(r1, 0x0) write$UHID_INPUT(r2, &(0x7f0000000200)={0x8, "b5ea31e717934bf6ed9797bb97ba0a9d451915d77aa73f1205164666f571b3b60f4e20a96f86e1924b4f16577610eaf55a679d12438ffdf5d363678f41b36f6513ba73c757b23c23fe0a2484f26d2c36fb05ffc17ccb0389a646a4bb28af4676592e932954c3b3ee6c17fa33ba030c38be819890b0d963834e54c426ebdb6e29df31bf36a30162942d98574e44d2a1f689e084907235cf224074f04a10da1da9a89888c30ea9d40b23596115ca49ef562b8b399210bb74e162e13f3143a45451eaa0c1625bc0c9fea07bc7b6ebae3e99faa10422171c10ecfa8f71f458251b4bd03908da9ff9d2833813e746c009735813ee9ca3f558a8c924605b1b518771f8f90eea476aa7dad3aaceadb1b2417d9e19cbaf6aa3a72c11de0ef7737eea05a680f0074e65877ef10e14ef74d17be5aa2079612ea131e720e6c3f7b1aa40cc422184305cbbbcc7b8a15effe3642ad0a3f593f7c3684b0bb4429e19a5bf37ac9a17793cf16a44a3d62b29815a65549a62e384dabdd58acb32a51c37d9ac8dfb9ba1462931b8cf53595e5b073f812946595fd0070deb75eb4b5f533510bcd9399a89e6e3b20f291f83303d469c1605e370ad6510ab16c88b43715937b2426b82f68f62b9ae2a5242e68d747047bb16777e54dfe992c1c513d76e480a1c72c30b15582e0734ee215e36a7f102f79f0a3585538508407d31444822a521ae1c52166771fd89536a8ebced34edf4ab7ebecffd7615f8c6fa8aaff389e0a0af901c9b29494a493e09d48bd7c958acaaf13604b10272ec451b17f629896356dbd9fc00e93b4f5d3dde9466de67a0a7ebe9a03f9a352997522094f79d26b45d3922fed3858e277b0e56b341f94bda5ab060c9d4f2b42d50b799a956a8ed718f77cc190ba9b0042e4a44b71c1681bb74ade9978256023f596cc1b5c427bcc5eb48f3f08f5a13d3975fc02899e95683d7287ee810349f89a8607d13b2c6cad5f86e4c5c7c3d9f408e656ecab6f85b6b8cf1b54ea3407828f269888ed6913a529a5c22294057af13168c9424594070c6964fef13b995f6ddbe7a69bd449eab973b13d1bcb4dd1ddb4816e9523d67a284baecf70ca941f3aa8f990edf701ecf731e384fd310b99e37775486c4884f6f51978b5dcfb696ca4e6c615a19c185663b4d05d00c81d4eb0b4c8b3eed9a2f3d70aa16e44d5514d8d8f25296865d8a3fc2bbf8725b9939a81f7102fafa68a16bd365107b9f9cec513d921fb683c51f07434dd89a666f54e2bc7bb63e179a65bddce660f2b1c42b231233cf7b2bd803d9796d1feeb5d9a4da339b1529886d6686bba94f73c39385ed0b9600aaccdcdb876f29975f2b8328aedc7a12a421eadeef4c305dc3e7bf5fc17afd64f039fc5c159245397fb0e94487a25aaa39dce734ed42921c8569829f27b72101027f6fb894a5d6522829ad437cd990cea3894175dbf1345218b52d61422e875fdf7596aec1d936fd577a0238a4ac59baec51c5fd9340bad94fc751649987ca39199a9bf698796e094e68e40fc4d2825b82b95068766933ec0f0592d45af44bcabd8336bdd45e1ec769fbb5c612612c5de152749177346e3ab742590f4ea0e56b8da9eef1820c82f52c17c9e5369a7c9bf4415b8f78b4ed3e0f9f1772c7ce0197cd354123c813b8bf5df39bff7a814f1164e10a3fa3806456bf2e4f0fcd7285bba92026931ae3f5cb4d464921ad691aedb3ecc628b5e21f8960331d3755ff9313bcfac9d7507fc3fc76ce916f64f0c4421b0d507e1889402ed00106ec83e10f1b60fe03a4fad88a850c15c39672bf16e2299b69c63c6bce553b395e4dcc243a0de2564f0c4ad36080ae95f2cca1d194f529966df1194ecbec4bfabb7b609616e248c2e200502e9cdd038f1e0077af145e5d72da0cbc2ec95e1d08fedaec834ceb18c657fbffb27c04a9c4e2afb0a30a341dfaebd8428e4b16d3123ca871a1fb3b3c51714304966cbe0dc7fbf746c6f46b2f15f85d421997dfc4e3ad9334a3fcd7b5b5c7c1cbc6b9bd4b9074027d145a408568647e9472299d0db20773d86dd4e597c16c49025f79d7b25868f82e3e757fb611c2926680f3706ae9339a5f3f88d070780ccd6c03bbbaefd088fff3d1b5d22b565f86b436dfb5ae3afab48197bf406ef4102af785a82fe4aaa5e11f1ff638a4cd64895fa328fe48a09ab1a209bfc1ae0677f13665032d80be610c2a4737de2ecc343f587a3123686df4b4469f35842f26f283835e874a9d353f421dbb414fbf30f7cf42e24a2246862e46b899b116decd2b6eb19381f287ca4b7ab37d52ef755a3b33ec330495bad62525de3702eaaab3a8acb2798ca291d64be055cb5ce78c024f0583bf6fbb855e2c957f10ff0e05cb0c91d7b023e648a8f27165b6fe7e90051e3e2bfeb2c8c3dd65cff7c9de18c3bb2639ddb2399398c2781ad504cab5380c53e47d709a30190b67b79813aa0229a403459ee975208734cf6935dbdb7c12cb0785815942ca5a07424fcef56883086c7a28996cf63da8493a7535d1a823227833b4ab5cdc685d34b97353a5daa059ca617f6d556e764592c1471abcf673ad742e2dd356ef63619df6b70bbe5bf3d9f8a385be1b77a8f2f9dd58a40be1519180a40a0cc48d584ca321c2242dd6a14dc3d4f1a8cd6757370a1ca106cf7bdab2479367da80e8bc2be518189fed8a3445c56686064db4b32aaca3c7f7722d2c8017a5c2fb7d65d79c4c51ac776baea4a96e029f34209d734ba45fa444936f5c80e0d8c8bfa00e40ee4683dff5b2a21745e7001ef1a8025b8da68d167202fefc13af9369c828c90ca5d46beabbd0400707aa50587aea2ea7f81503ae7d8d7fda182201465e35c83a0334c8040d31b29032da8dd24b3a178d5bcf0ac0642935eeec6cea0e9ac30903efb0bd13e209b740e58ec2361324338ec0c62ce8b2c82590b11c5dc8ff60c5d960782c2187a28d67ecba429a308e10de33e99de988c1908649387f58bb9ed025e3ecae5eef644b5045a1aa9c8fb5f37203f28441e21a657a6fb24d3494d0ccb0f7d2bbbfabc6902ae12939c9cdddad697b8cf1425fd6ccb9017a04be0038701c211f61ea662cf65d53729b292182c8020ddb8f6f67b8bb6dd5a03e45827e43e4f97aeb173df6aa4e29ac4f8a5c4192960b39c1365c47a11771801bed51f53dbc32b2cb6b4e75eca8b0bb5b45e254ca5ae2f1b5c0b518b7cc0957afd417eaa6b40624aa82be7c9b85a624b3d8f7821b10e3f5a62eba0cb042965018b9d0fd03da6ac19e018a4341f9a913a6c7c1d356a2c668ca9218adbff04c387240a6ad554d9a287dc5fb5dcb4e34b561fbb175804d0d30e261fc621f9f33f43fc3f473596be676396cdff14598f2c46118c5b1db796f1d62e33098886ec9795556f86b1d51a7bd66d8e6bcbabf45d031ba8903471142b81ad57ba1393e9e10570c1fbc410f067143fd01bac9a5b1a4ffc3d978e06316fe7805f5487d88ddf77ca7edaedb14a62e9eb39c3e5a0831a992e712e9d57aee161bf1e6b8d15c96bd13290a44fdbd7b23516024e77ce7ddd706223a06a86869d579c2de7ba26cc0557e56c3482b67a7349e2c2c64bd613b0cf7e3f4b55df15865c8ef162ed91c657eed737805c20a5766d59ce05c23f52a966e0961d3599080f8d81003883f54a83d7c6eef8be0fc763152866258b5c79a9c90ed2bd5554d629dd6fa527b37e37036fbc0317ab08482d634ef93aff35179c0c68afe0c00b53af0379d9514df3205dcd2fbdccfb5cb2a2c3144ede7d86dfc8baf697a2bfade17d3a518a10c4d6cdba299301a4fdda7896ed9a178080925f9e1ab889b309b75f9a45bccbf914013de30fdba61aa9ec350c45d68694198c32988930c5de021de072b7080ce02b8c9bb7ede27b8de9acd4daad5c6b777e2b286cf87e007b8ae794a6d66b137f0a07d61e296075aab23ca88cbbfe0efd5d9f5df5b7e9fd98b4b394336a305e5e7d292027a5179623799576b437d05e5c07d03c8b40849b40b9ccd43199d31e4817495764583c0ff9f908b434c632686ef31ef1004825fc2bae5c2ee2cf2089f1a25be1e4970a8d7d1895c710d209577ee00de07230ef2424d8b937a2904eefc43f289a19279978801e76b77d8f1c1e0d70e8845aca494cf33717c33f5be4af2acd724a56fcc5517cf7994069499a1756c5a82223d9d4aa69b9cebd76cd0d60497a83c1938a49ffbf59b81ec33103abd042a33d83f49c26c3d240de1b2a88d01f2af613c7fde8c787a31c89b6d03563d89c1fe9aec38682afff0dc85677f5168f1b681c2dedca69d49c7b4ea8e6b686c0196522261a56f803b0e3ac801d0b5286d5db7ed5b036c4eb4a0f167e1e93f433ff0033c9461646338b2886d873564beb61d13c0dcde138eb2c817f1957ac2186069516d7d68bec6a808fa61bd0f42a2295cf1458e5b46a8ee218cf78c591e6d5c7b60cb162d655d35c2e2c13afc36c4500a655df59687f80457e2fa4fc5e44b1f381d20109cdb6be19267634fe9f54a202cb6c6c21a941faf2fe8ae867c21a2a77471c1365df72b6c1ddb32dd8feb1cad4fcab81dfdcfc456201fc10c5c6485f8e921fde0c2a3acfcabd67223d1a64f9c37300faa3b269122084e3a13f79575d95facedece859b87259499c4185a4628af59da0331d53b708a77a4b5f09f8597216af626d6678d738bec159465a2af9ad157582201b071a1efe5efe256a3af6c130873f8068604d6f93a71cd762b842fc09ab811abc1943fd05ff32434decdca169a4e347bce6cb3c2b13855847b1b3b9deca340384c269ea7290c5209dfe177c1e3b4dc42e35d2f32764c39a923f053fee7eda1d8f8f9cf68c2e263f40e2f64154d21a653e4a9294d29afc9881a966c0b5af63a4d09b7afc6cd6b4c77670e47b0f3cbb4922dd4e05721e14a08f1b3bc76693bb31de34c9b5c88fe8527206d91c8b57eec7103f1c4fea9a48c5fa58a778818ab476784aa5936722ae64e4b27d5d257ddcb43f0a59029e3c44f95de9424dfe051cba42002931075fdd35e2fb11bd0c18da3e7ec4ef54f37fe61c360e8f01ae30e8070d616d73baaaf46a80182f24e0edb4cce288443e2be010a6b36b2ca6236d061e0de0db7f372e15202ea04104faa397ba83e61833d98b67b294b6dd92232c82bfee5a2f93f115a2f0c0b3b3490b012bd97304fd78243a9296d5c56c75330b9750307ce973e48f46addad57ef5432b133b81f3c74f7efab55ba4fe99135414aef978cdfd5bacc430765a9a0acf12222ccb62974382f6ce93c3091999406c55cb168fcacb709269aa6dbefc77b72831a9e8973b698b978ac9e5883657e482e84c844e09447332e4ea0daa4678e095a29a5051e42c37fbcb7298592fd2a914eb40f7485eba89eb4cc2c01aff90b6bfbf3b79b26d6d460c3a3d6d21fea86187c436d80d431a0f73b48b4280bc067823ab10aaabba5d18492ccec510d0b46655f098eff274ab4d8d65f3083c29448c531159ef77c55335c8d46f9ac5912a37a19bd7b50d3aefbfad25eb71aaee28f4428699e837c692ee544b5cfd1aba60c8be8e2147e18d23fcd62260fcd0cc879dfc738cffb17deb7d1b0167a9651cd288a0c446cf54c4f0cd4fb13e034880a002b8385c6be04409286f321d77280d53e8994626b18dcc81b613bcee30c22095b77cba19f94c61bdf3d555043cacc43c6636024f39783332f6babdca09c87f78abb79d4e8bcfe19e160e2f7d6cb610072d8ff8466bebcce0990eaf92e8083eaae2e6cf3462d497632da7ffed51db56", 0x1000}, 0x1006) r4 = pkey_alloc(0x0, 0x2cf3c40223bc996c) ioctl$GIO_UNISCRNMAP(r2, 0x4b69, &(0x7f0000001240)=""/251) write$UHID_CREATE2(r3, &(0x7f0000001340)=ANY=[@ANYBLOB="0b00000073797a31000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000073797a3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000094003f00080000000900000000000000b1c400004121803af0d6242a8ea749a5394d9848b5dd1549df40b5735b03d025cb4edce7c91468fc73aa0a039199e08dfc23ab30229649a620cc2c387fc9b66df8ca58b663d2b92513c32ec60fd7fb3e1122dd2bdc575fe9c52099b58b44a6f1a1739c01a17f1737a552c4f52f95c8c3130b497636d5a2821c02de122bba7f914a3ed02c4083b1f06f196f086193cdc06597c758cc0000000000000000000000000000000000"], 0x1ac) pkey_free(r4) 04:31:04 executing program 5: socket$kcm(0x2, 0x25, 0x73) mount(&(0x7f0000000000)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='romfs\x00', 0x2000, &(0x7f00000000c0)='securityeth0wlan0userwlan0\x00') socket$kcm(0x2, 0x2, 0x73) socket$inet_icmp_raw(0x2, 0x3, 0x1) 04:31:04 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, 0x0) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 597.007280] QAT: Invalid ioctl [ 597.046500] QAT: Invalid ioctl [ 597.099150] QAT: Invalid ioctl [ 597.100560] binder: 25601:25619 ERROR: BC_REGISTER_LOOPER called without request [ 597.110193] binder: 25601:25619 BC_FREE_BUFFER u0000000000000000 no match [ 597.117291] QAT: Invalid ioctl [ 597.120637] binder: 25601:25619 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 597.128529] binder: 25619 RLIMIT_NICE not set 04:31:05 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r4, &(0x7f0000011fd2), 0xffffffee) read(r3, &(0x7f0000000000)=""/126, 0xfffffd6d) write$FUSE_LSEEK(r0, &(0x7f0000000080)={0x18, 0x0, 0x8, {0x9}}, 0x18) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:31:05 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 597.213193] binder: 25601:25662 ioctl 4030ae7b 20000100 returned -22 [ 597.214152] binder: 25601:25663 ioctl c100565c 20000140 returned -22 [ 597.230841] binder: 25601:25663 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 597.238736] protocol 88fb is buggy, dev hsr_slave_0 [ 597.239224] protocol 88fb is buggy, dev hsr_slave_1 [ 597.253317] binder: 25663 RLIMIT_NICE not set [ 597.299797] binder: 25601:25668 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:31:05 executing program 5: r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x101000) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000040)}, 0x10) socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:31:05 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:31:05 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = shmget$private(0x0, 0x3000, 0x1012, &(0x7f0000ffc000/0x3000)=nil) shmat(r1, &(0x7f0000ffd000/0x1000)=nil, 0x2000) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x20400, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e24, 0x7fff, @local, 0xffff}, 0x1c) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0x0) 04:31:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000040)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x90, 0x0, &(0x7f0000000380)=[@transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x18, 0x40, &(0x7f00000000c0)=[@flat={0x77622a85, 0x100, r3, 0x2}], &(0x7f0000000100)=[0x0, 0x40, 0x0, 0x0, 0x28, 0x0, 0x48, 0x30]}}, @reply_sg={0x40486312, {{0x2, 0x0, 0x2, 0x0, 0x11, 0x0, 0x0, 0x68, 0x28, &(0x7f00000001c0)=[@fd={0x66642a85, 0x0, r0, 0x0, 0x1}, @ptr={0x70742a85, 0x0, &(0x7f0000000140), 0x1, 0x0, 0x3d}, @ptr={0x70742a85, 0x1, &(0x7f0000000180), 0x1, 0x4, 0x2}], &(0x7f0000000240)=[0x28, 0x0, 0x38, 0x20, 0x0]}, 0x4}}], 0x1000, 0x0, &(0x7f0000000480)="5f2fbedb676a60d43ad65fe9257a201467e88b0ce48c9006c4dc5fef6cc91cca9471483b4b7c72356f44e6484f53baee77b23a2a005e13be374fe9ac234bed9a377282d4c7c20aaa263e56b38bb3f660e406e8faad18c0bb6387a04f2c68c8166e0d14e91a875064db12e50c9fd967f39d522e45782afdab03337c23f02079768cf1e8b1baa03bafdd11cc55f148a2e31ab327be525365440551fd6b639b2817d34b29c1a0e665067a4c82c1e5b79953d23c57e8bd8c8a3e8337dd9305994d062fea1e71e33befd3b6451d03e1492e7c9245125af5966fd8d88ff28ed47917d985eae6a9c77a23480cc9c710952cab9537ec84e242f85d545e811d6c517dcb7a61d6f45d1a2c0b3752cdc673ce0bdc6bd37937f81628aaa7311af44382c9c854b879c2109632f0aab4dbfc276469d48d3b863f112a62475a9a7745d36b85129695602d66685bec9ffafb1db8b6b224f6cd03a7809c40bf654bc71ee40591d7cb097da2f64e660c523794bc21b3a8e5ef616dbd25072cf13fb150c8326f80f4e3b155f0f007d8fef16372c4321d0cb140c994d52961f6bd15d407d4c82d5b3c8c3c25d1af0f25c8310098397896d8de6adddf62663e5bcb15381e7779a8d5db433eda5596276e9d9bc3328a6bcd341020f8a1d444579f9bb46f16b69eda64c59d7577638a7267c4c5389eb045666c2af9ec45a3871ebfaddf5cf767c6816497266ac5844673a0dc3a27e3541f4bd002a9740658e3e3bd6a714eddf4ee74d6b4f4f38cd0064a154dceb7654fd732a16e2831e01e0dbeb361b9d77534fa6e6b364c4ecb4fe4f7c49790cff003c58e1bdc5f4b3d4beab8f5df3e6c16a7cf12cd1183258bdf0eeafd15fa3caab0445f25a53eb495898783df6dd12e978429eacf737961a9a809a17a626084989918852a6f6c96ec80f04e1b9635414d1ee77d0ba6e9b34c699dec6ba1e4532abb607c23bc2193251f7fc8cfe12cb9a1e866e05eee4c77f1c87ced8fbfa7271e2b175310c979966d1fcdc0251aa1ce3f567b8b47aa9d12e0538fe4924e79c63c6ba7e77c48e0519c36b6ddd8abc917350a13e18e84fe451607436e84c5272bdeb84d7d1ab86a63c1ae41d3fede607204765ab999d7319493783b1ed29120b66be0d538a353463905e6c59cbaee255eaaf324514a7af3131889e588e1fb6d829f86ca261a016e39d2ad91dd5519f511ec5c544259963e35409a6617c42d320b338a76daee39e4fd5d84f53795a4471430ed330d287a5eb776a520ba738a21ac2bbee892be5daeffa0bad36ce8d5fdd8c96b049d98c004ccc453e84c3aba90315e06d59aa20174ed5acc06deacd1ecab720fc0f153efc69e361c6ee6d42218c076c29c0ec54e4fba3517d0a9dfcf71f7f0509b9848f37ace865d26a5bf177d13927273873d877332e80ab485a2a823809b04990323088505224c45dba509ac6250ada0ebbff861dda77c469f3999fe46a3586123595ef644b857d5af7199a292fd70448ec9b9cfd268d7cfdaba8700366d09ba3afe40c8be9d8f592d607f26c30eef59907c446639b69fa7a535c05864ea66072fbe406b33bd192132b99040d9660ca82545020a448d247d2382357b0fff22fe4c8ee22c70cd63cf0b84645cac640720d47b51ac3ed68463d41b2d6197e1252c54c80bab7a4f85b2970379a4eddb8ffa207af70c4118ae0bde2b7827a7d82d18a2ab2526ffcc69b703f3a60d965cb66fe69791a35b28be9f4d53a650af459fad6c823faff9623eb84b0c40530a9108d5c507b489674f76ab413cf458ca327aef7e2d263ac09b85f7202686fb4e3cfb80bcc0449caa25a21415bcd1c34d4ab78effd90c7053a6246ad55fe1c11c72bbab71ecd2f463638618faca1268e2e878fc8c3967ccb025f7bc6229334e3ca215f13783de9165f4536d31d92a965bcd22d1e8147a897c40fa0d2b6b5dec361d38e422e728a32de1ffed1f111a024550c0c541fc76969ebcc94350b5a3ebe7f0d55aa2a0d51c315793ff89f9aac2069f88596a4e6f64c4c7bb0c45cf89af011dab4b465537457e27e16207b1f98a914a30d253b6b82d4cdc7ec6d00b5d845b324e0806db8f238384c2a04da83abb3d848fc49860f5481a01487813d775527b6d2d326bc9303f50b435aaa12009191c7695a56d860c814dba37c2e6fccd25b6d10715927fa213958ca263a3f112326e5efcedd3ab86e3d2c69389e937d492390fe7c5534e29c6a66a77ce49a4d0d8b16c0d53f36567a17ac18a2cd7114726fb545bff3a13ac99b4bad97d5e0a4cb4e9413c18143f08e4b4b13a2e123b858ce7096e0d91e1765831f9879947c569a4908f7e5b3d80de6c5c84b7af5eb9b3acffb5954f8ffbcb48ff758ca3fdd8b5d959f1ab0f58e26893b9c1b1c060091f6ed1f6f919d5aeb5a81b646e61410627ee9a6725da0a87c16a039849141b97f1d2f09df2551756c1fdba715aa24805876d837d309b97e90800f1e654cd25b105e71f45a4643fe90d331e9e651c9440390c33a19982fb7775ab8ed566cdae1bc4f6f4ac70b52064924d99fcc616ee5e2474fee4e9aac0b8a6a1e0ff44a5574affa98e25cde384644fe20b9065e1dc8f8883d7d9bc534792fd2229e423c2da8af8db6ab941d35ba8efcef0f16ccc68cc6a12597644da2d604e6c3539b1faa3e4069af0e5c2f9d959dcb20957c54febe4fed2d79e976ee79e51c9ff55635cf8288685164b3af048107442d0e29db1797122959578b22188f6c77b6ef731eecd3026f27c6ee2e2933774cd880c2ee3998aa07b3cf3c7e12e503832e915729acc9ff35e0bd24b48c2332bee4c03856925359a3723b16334528ded5fb983b4ab57ecf16e5e59d8d33b6d05395884e6ddc7d0740b86a89f0eb3af4ed1fadaaaaaec1df03a2adfede0d832bdf4d370376e7ea8a65641257ec46cd892df2a18c396224ce27fa64cedef8650db2a26a2a0924e92053d2d1ee9654479ad69e3530979b951e104f1050b281d78d14ed65e8fc5e2e3a31451ff5faf5967293c8828b452c935f220e3618bd65acf74e3f9d79d55ecb61674f8ecd295a4603cae789de0ae86c07638e1be64ebbc1164f7337623ad01c90138f1239f2e56afb2ef035b0f74c3c1981eeaf177ec35358f7c3648748ff819e41034b887f6229b1b287ec23b411e1e178885ab0159c2a4a9692b71aeb95f354383ee8a2e89c9a0a0887303b2e423d9e299ecb800f22f1dd6edd44627b1830cc54a5f096831b5a300befb094547e7e73e46027fc274bd68586936693cecb1140c8aa250b9f768999cc18c1c845306707a97f4337a961b2dd54d5084ba0c9caab966fdd7e784d98e51cd117a70c54353792583d282294f51accc0749709eb9f25e15a58b8706a0932360233d2b3ee0a7da97c1c1b57f14ebb5c3394e3fa2b1edaaf005cc0b4c8e017154e33e7cf59feb60a59ac6d057faf442483fdd7ebd3d0e444e129e11ac7dba338ddc5638fe37faa46bf133f6fad6457ea2e0702778402dd3f2942ecba54c83a2c4b5e8421874ffb4d4f5f6b16050fe4d257f431127251df1ef271d19e9f7146da8bf8fcda7e2e6bb59cf297b76993ee3706b10b52b56456f77119ed988e8f79945e40634f4e2aaff42b841ecfb682a7089cb29ecdfd287637a3ac961f0c5f59a427ea803088ba473185ded987b2a9488e9c41286aa89a0a79e485767cc24098d8fd0042f11f88e1817bfd5aa23f1dec8a951f8583795b85f00ce22e135d89d23a7a7b2f35dbca92d88f4926b60385d87f6d15baca9e686fe1bbd3f862258a6cadfdbfce562ef946d503cf2bc929c6a2b98f783d0cb88a5298ec3832c14d0a85d269b4957370e1f1235531dc62e244f080aec6c1b1be2da0ef56b51e34f61008207cb95c2f0ad324eb75320052674c1679b9b533d2fcf8b73adc1c88c56c08dadc5c260f298e79b56d3ad8b08d6fa5c0ca01ee33dcf71e31ead7d6e57d1264c2de6cb7a8479ecee635968898a0ebe7773cf8e59962d0ec6ba33fb3f380f978453ee4b066b0bfee90fe8263c2323946e5fc6b32d62633ecf2761a28c77611cca1cfbec76f6a9836c3a9356494997eafbf662d5f8b6b31ebed87821280660c6f29dc3b3973f401ed4fe618090979e9d30065910e39ea571c834cfd8ad8ad4f9d51e141355afb21a611ef24f37d6a14f2ef31b649608810ca9fb6a2824769620ed373c126748141e02caac6045ad7b657d74656f0ce7102a6d34b8c0db2466c148b02c4817abfcc3bd72d0b721d1f73b16c4bb550a3774de572253845f6c9427e6164ada1849dc1a2f300e74921f864b03d5eda3411d30a72be96871bf3885902eeae8f757e174c9154f10e173682e16a4ee0e56f3f2c5a6c0e1f888342ed792603c29b8d0710a2cc39baf2aada0890ee4a9d3325d2d9028efd936053f251a3702161e5680d54449fa29f78a1e0311a0ff3b870ca2a24ceef2e34c322fd2318e8440db680aed985d1e0091ba0e246f8b377b69eda07611c7814f382be1805c943872850214eb2a49e5e092bd7129b46882bee22699ff3952c1ff6649b604faabddbec41f93a8000f25c1ba40d2476874e99789346b9edecd7e0299ce417a851888241c17636aa3ba57f5284a2c3b5dc4493f8188f4c19283c1d92f103e43299e05f6a0b73b6c27084ca85f4641f108fe527e0dcdabe4d18143bdf391a0a6ef2fa9297136fa782c4fba603d8637ed5cd59939d6551373c34fd80bba61c4c3c92f98abbaa319e4a0f7f57834188d5aa399f9fcd87df5ff41969f715d77b6046117bbaa6c3325f5152b7fc286c20d15207643a335019350462868a7a665e2ef295dcde50701911b8f3b524c4cd6bd3e90a90253ce34ff37fc5f1752fcd1f31dbbf3de26c67058ab74fbd76a75754e0415caf4ff25b364772af97146831e34d3457f847eab591d4283a58d5556b0934eeff5a13f94bdd646c6bee89de2e346330e5a12ac4b2074abbdb3ccdf822965e018b61fe235ffb508db6bef27ced6d4003533e35d53d737a6dbf4a1b42867e6df935892205a36c0bc79d003b6d084bcd712f6358f917516c003d44cef1d393e1b0c6da30e987e1e0ba39984722118ab9eafa585c682ee000f3781c1a9c3db33bcfee0f35401c4db8dc3f71a48fd938421818ab043d6f1c6d11a70c6ade5ef973d5064eda94dad50559c4015e83346fa93a64f602c9a8de2081a5c7878891acd1106ce4bdc3cfaf456c2501c4ad4800595d0f0e52c0b9fa60963c0fbc77caa727d2ba09db158249ee8d464d40e70b49a693c17e11255a689a9c1242268d1a121457345bb0b8a4efb6a317589d9878682c4dd73367ca89eab6ea4e4bf7a58f007b6be45d67b9aeb9785733f02050a64aac2745129a5e449ebdf51c14c81e53f008968b8f1c683ecd671f99df308fddf6ce08a70175640eedec1cc9e91bef7a3cb254cfb8ebec4fc13f58d81d6e5be5fb4c4339592c025fce8c1c5fa8eacbc4d540863f8e5064e76af9393f95af1b9011f5c5a04d7940c3d3102960fa0798e3e858d20d408be1182d598535e2eba3f8596866cf98e5fe048267ca556a1526e6b3457683f893782ad01a657f36833da4ddd97419f7a057f55df944eb7c8516262dba82ec9ecbea9019fe7a00331593f32aed394e74a09e47e19b31453265bd07dcabbdf80ba1713e9f7d0d229ccc8cdb4914ba3402ac20d1b6a8aa683c1d5af45c4126edfc704b1a7d5a7cdbb37bb4c4c0ec3a99c6b9debf3970b814aaa777a5968c08c69504f5949c115d9c307cfa019124509ed369d1f"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) ioctl$NBD_SET_SIZE(r2, 0xab02, 0xfffffffffffff449) 04:31:05 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 597.463448] binder: 25686 RLIMIT_NICE not set 04:31:05 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 597.490125] binder: 25677:25686 got transaction to invalid handle [ 597.496769] binder: 25677:25686 transaction failed 29201/-22, size 24-64 line 2834 04:31:05 executing program 5: socket$kcm(0x2, 0x8, 0x73) r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x8000, 0x200000) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x8, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) socket$kcm(0x2, 0x1, 0x73) 04:31:05 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x408500, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000100)={0x7, r2, 0x1}) ftruncate(r0, 0x0) [ 597.634641] binder: 25677:25696 ioctl ab02 fffffffffffff449 returned -22 [ 597.712885] binder: 25696 RLIMIT_NICE not set [ 597.738440] binder: 25677:25686 unknown command 536872576 [ 597.744275] binder: 25677:25686 ioctl c0306201 20008fd0 returned -22 04:31:05 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/expire_quiescent_template\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:31:05 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 597.780619] binder: 25677:25701 got transaction to invalid handle [ 597.787136] binder: 25677:25701 transaction failed 29201/-22, size 24-64 line 2834 [ 597.801880] binder: 25677:25706 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:31:06 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_aout(r0, &(0x7f0000000240)={{0x10b, 0x3, 0x8, 0x1ea, 0x2c0, 0xd519, 0xdc, 0x7}, "cbbcee73acf567017f34d34197c3710913404dbb96f8239598288c2c1e11fa86fd8599e27d62839d6ed017797fb0f4e898f92b92bef8228287266c73f14c87cb6c102c99b7be105071e9120fb6eba4becb89af6cf87b0a198454daa49367d5255d99efc5fc2a1420e184b4f01a378700e2aa548e576b016d61bf76ab2c3e4159688a92886c3a3165a847b1b83e80d770", [[], [], []]}, 0x3b0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0x0) 04:31:06 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) r0 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x10001, 0x101200) ioctl$CAPI_GET_FLAGS(r0, 0x80044323, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:31:06 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x81, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_PUBL_GET(r2, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000240)={&(0x7f0000000140)={0xc4, r3, 0x2, 0x70bd2c, 0x25dfdbff, {}, [@TIPC_NLA_LINK={0x48, 0x4, [@TIPC_NLA_LINK_PROP={0x44, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5ab}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x40}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}]}]}, @TIPC_NLA_NET={0x38, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x100000001}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x80}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x2}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x3}]}, @TIPC_NLA_SOCK={0xc, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}]}, @TIPC_NLA_NODE={0x24, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_UP={0x4}]}]}, 0xc4}, 0x1, 0x0, 0x0, 0x20000040}, 0x20000041) ioctl$VIDIOC_S_CTRL(r2, 0xc008561c, &(0x7f0000000300)={0x81, 0x7}) r4 = dup(r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="010000000100000000000000"], 0x0, 0x0, 0x0}) 04:31:06 executing program 5: socket$kcm(0x2, 0x2, 0x73) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) socket$kcm(0x2, 0x2, 0x73) 04:31:06 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r4, &(0x7f0000011fd2), 0xffffffee) read(r3, &(0x7f0000000000)=""/126, 0xfffffd6d) ioctl$DRM_IOCTL_IRQ_BUSID(r0, 0xc0106403, &(0x7f0000000080)={0x80, 0x8458000000000000, 0x7, 0xfff}) sendmsg(0xffffffffffffffff, 0x0, 0x0) [ 598.351098] binder: 25746 RLIMIT_NICE not set [ 598.390773] binder: 25741:25757 tried to acquire reference to desc 0, got 1 instead 04:31:06 executing program 5: r0 = socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) ioctl$void(r0, 0x0) [ 598.442747] binder: 25741:25746 unknown command 536872576 [ 598.448421] binder: 25741:25746 ioctl c0306201 20008fd0 returned -22 04:31:06 executing program 2: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x101, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000008c0)='/dev/ppp\x00', 0x100, 0x0) ioctl$TIOCGPTPEER(r1, 0x5441, 0x80) pwritev(r0, &(0x7f0000000800)=[{&(0x7f0000000100)="89c6012c86046c9386fc689787e25d33bea0d6e1aa3cb8933e800f22ddb82ad707e51bc765535f1b0fdc9a2268fa8d15fa4d7aa1462a094b8e3048591c3f3aff3090fab205292c37fcd333e897fa394eeb9b3e074013ed915387190c438f2423376bc09739a8", 0x66}, {&(0x7f0000000200)="f7beb39d8d8e7acfcf30ecc1de06a172147d3eb000e5535dd3386952060a91f648621cc8aef2824c87351d85f2dc3a5513192ced11f7fda50bf5fbce8c1c6ab691c25a136f525b48bd8d6f63baeaf3e82105093f925723297e2cbea0f74da6b19328f3fc96951e3610f3432ffac53b745610d21391ce1ffd81c224ee37adfca8ec9687589a4bdd33f298a4b7a8cbe23b88d647260c897c7aebafa884ebde19e48250a4762e33d7aab1d3c30ea15ab65ba92b79f0850ea4cdcddd6f6d4f52a69e4b8136fb65d3f328a908ac4431e59a6b", 0xd0}, {&(0x7f0000000300)="831beb32ffc0b57685fa854d23a8c4de762a119d2ea3f1eb5b69753154ce4a3f4a8ca7b746a1692460ea8c4d07c0d98e9029f1b77908a17d2d92a475b47c2ae49e306bd9165deaa0767b23f9199ff139c7bec15ddf0776cdc8c99d46fd86131f0a3b", 0x62}, {&(0x7f0000000380)="4d0769f1c68aa0ab5e275979a9a7ef213ba31d88faaa2d653d8f48f4f6ecb4dfe62b5e87dc3a9ae7d0b9fe34d1514f45ab05532b14e89a2e7dff391f954d532f8782dc553fb1b1e033219a81808a4a2a160516ff92ca15d2cd4a30771e9676f153d31d58a7c3026a3c6a819bb463f47de84d6f1f2f181c5a3eeada37fe9a6d080f591b74c7e0db8ecc1500c5961b81a044f064e739a9dceead28a82824c9d6868fb328b16b087b685315e326097a0bf980d0c39137db1910c479c56b5d909a6330cf78efc7fcfb2ebc66d122a8c066571d831461197dcbcd17e3b647ba00f89d94d006d08cadb3514e", 0xe9}, {&(0x7f0000000480)="2c46652791fe30cb7fc7b22a62f80d7902bef2eedab97bf6f4019a19316eaa1a448945822854477ddf58dd27c56a6be99eccdf5be1d2ddc62b5d7a2523f02dd58370bb830fd2ed3c8d7dadaf650f69ff1a25af227d14585a36a5dfe29199c7e711189ada64a408cf327a06c5f95f0fac797d30551f12d4a21bfd81a695285d9fc97adf337ec336d8429bab236f45a914f3d88d72aaa7ed676cd6cab08331e770cc1dd07efb5289163a0254319e9e299194b618026269df9b943551c9853581427401fdc81f336bd17d4e44033e9b3befb085f5f7a82854af7050c09c6068ef", 0xdf}, {&(0x7f0000000040)="3a4c37f3dd19497d58a45a365657304c8d33348cf064b4bf1c164e4ddf1b1aad29a1a5411437b62718d5ebb022afca5e4626dc07", 0x34}, {&(0x7f0000000580)="cdea5aee406e388b9fec95e0c514e56b2555686470b937c1fcd0e7ec4db532092c609e0053fb95da5645e8fc5e006f6aa012f650088f5d405d87196eb048695f87974ca09ed628c07805b6994bdd22f77d", 0x51}, {&(0x7f0000000600)="b1a40242f802e7e2ce96ce59d22665ed53d9b854689f6bf93d9ace4d4862be35dd1c538c7d59c55fdc4b1212dd837cdd6e7a7b65421d3978fdd3024f070548afbc507dbe204d5701d8a8c8c7ece28753391faa1cdee12f0878687265a9081f13b5ac9fd9eaf2509c3c8b139480b8806dc037f053a403de44184784c88dabfe873ba0ee8d0d3c4aa55367a4fa240b24ba5afbed72b2ecd2249873290d90aeca3ff67603e4f133b855cef28040318f6ceaced72b2ad658c6f7a099bb066bddaed4b3acccc826031c6458b4dce1675312cf369261f82753ee6b00aecfb0d5f97781b69bb595d2f3dab8022f8d1c1ef26095e3e7bba4a6", 0xf5}, {&(0x7f0000000180)="9e7cc83012b1f945ae18d8e7b266e0701542d1239296d4d4", 0x18}, {&(0x7f0000000700)="8c887b2b3c2a4b752736faebcf583c778533c3803dd603c62cc76e86af62b29fc4480169984c19d990bf8de88b476d95a014659b4ed05809a72fe996e177a4629559fbb2fc0aa7db42ceb1dce762e599284c330042dc1b836fe7509d4771557619b81e7114d214ceae40a428c616d52ac8e117ad86327fb45a923d2f306eac6d0b5e8c389c2e69a2a74e56aac2e4ec8fa48bb54e3b0334085f5f593300c139ea04e1b952ecc09f70ce8534ce0826be87b120cd01ee4c50090cc6083e17c4a74c0003723a0f4172fe5a3a0bae48268dc3ae855a887a5b65628fccec48c560d2b663bf74991bcc3ae6b4", 0xe9}], 0xa, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ftruncate(r2, 0x0) [ 598.496121] binder: 25760 RLIMIT_NICE not set 04:31:06 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x0, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:06 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x40) ioctl$DRM_IOCTL_GET_MAP(r1, 0xc0286404, &(0x7f0000000040)={&(0x7f0000ffc000/0x2000)=nil, 0x94e, 0x5, 0x1, &(0x7f0000ffc000/0x4000)=nil, 0x9}) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:31:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000200)='/dev/admmidi#\x00', 0x4, 0x0) getsockopt$inet6_mreq(r1, 0x29, 0x1c, &(0x7f0000000240)={@ipv4={[], [], @loopback}}, &(0x7f0000000280)=0x14) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x7, 0x800) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000140)={0x41e08f1d, 0x0, 0x2, 0x2a35, 0x8, 0x3, 0x800, 0x1000, 0x0}, &(0x7f0000000180)=0x20) ioctl$VIDIOC_S_CTRL(r1, 0xc008561c, &(0x7f0000000300)={0xffffffff80000001, 0x2}) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f00000001c0)={r4, 0x100000001}, 0x8) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0e630c4800000000607ad03b550bce0ba9574abf85d98a3f2f9464a9f4951f56db42c576be1c11aa5e6bbdbae6b41da4f95c11aabb56857936079c831bb6422d0cda25b4f717287b3cabcc436520a98dc6496358bd13c9621428"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r5 = dup(r2) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:31:06 executing program 5: socket$kcm(0x2, 0x2, 0x73) 04:31:06 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x9c7b, 0x200000) ioctl$BLKGETSIZE(r1, 0x1260, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0x0) 04:31:07 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f0000000380), 0x10) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:31:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x2, 0x2) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r1, 0x404c534a, &(0x7f00000000c0)={0x2, 0x4, 0x80000000}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r3 = dup(r2) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:31:07 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x3f) fcntl$setflags(r0, 0x2, 0x1) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:31:07 executing program 5: r0 = socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) r1 = dup3(r0, r0, 0x80000) symlinkat(&(0x7f0000000000)='./file0\x00', r1, &(0x7f0000000040)='./file0\x00') 04:31:07 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x0, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:07 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x200000, 0x0) connect$vsock_dgram(r0, &(0x7f0000000040)={0x28, 0x0, 0x2711, @host}, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ftruncate(r1, 0x0) 04:31:07 executing program 5: socket$kcm(0x2, 0x2, 0x73) r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x0, 0x80800) ioctl$VIDIOC_ENUM_FRAMESIZES(r0, 0xc02c564a, &(0x7f0000000040)={0xd5e, 0x34363248, 0x3, @discrete={0x9, 0xffff}}) socket$kcm(0x2, 0x2, 0x73) 04:31:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r2, 0x84, 0x13, &(0x7f0000000040)={0x0, 0xffffffffffffffff}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f0000000100)={0x20, 0x5, 0x1, 0x9a7e, r3}, 0x10) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:31:07 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x0, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:07 executing program 2: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x0, 0x2) ioctl$CAPI_NCCI_GETUNIT(r2, 0x80044327, &(0x7f0000000040)=0x400) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ftruncate(r1, 0x0) dup3(r0, r0, 0x80000) 04:31:07 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x535000, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000040)={0x0, @in6={{0xa, 0x4e23, 0xa84, @remote, 0xfffffffffffffbff}}, 0x81, 0x4}, &(0x7f0000000100)=0x90) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000200)={r2, 0x4c, &(0x7f0000000180)=[@in={0x2, 0x4e23, @rand_addr=0x200}, @in={0x2, 0x4e21, @broadcast}, @in6={0xa, 0x4e22, 0xa, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2}, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x29}}]}, &(0x7f0000000240)=0x10) [ 599.682990] binder: 25840 RLIMIT_NICE not set 04:31:07 executing program 5: socket$kcm(0x2, 0x2, 0x73) syz_open_dev$sndctrl(&(0x7f0000000100)='/dev/snd/controlC#\x00', 0x3, 0x3) r0 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x2, 0x0) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000000180)=0x1014000, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0xffffffff, @dev={0xfe, 0x80, [], 0x21}, 0x3ff}, @in={0x2, 0x4e21, @rand_addr=0x6}, @in6={0xa, 0x4e24, 0xf17, @mcast2, 0x9}, @in6={0xa, 0x4e24, 0x3, @empty, 0x800}, @in={0x2, 0x4e24, @multicast2}, @in={0x2, 0x4e22, @local}, @in6={0xa, 0x4e21, 0x5, @mcast1}, @in={0x2, 0x347, @broadcast}], 0xb0) socket$kcm(0x2, 0x2, 0x73) getegid() setsockopt$inet_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140), 0x4) [ 599.740241] binder: 25838:25840 tried to acquire reference to desc 0, got 1 instead [ 599.771470] binder: 25838:25846 unknown command 536872576 [ 599.777195] binder: 25838:25846 ioctl c0306201 20008fd0 returned -22 [ 599.836044] binder: 25838:25852 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:31:08 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f0000000080)={&(0x7f0000ffb000/0x2000)=nil, 0x2000}) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x42040, 0x0) r1 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r4, &(0x7f0000011fd2), 0xffffffee) read(r3, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:31:08 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:08 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0x0) 04:31:08 executing program 5: r0 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x1, 0x2) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) getsockname$packet(r0, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000000c0)=0x14) fstat(r0, &(0x7f0000001680)={0x0, 0x0, 0x0, 0x0, 0x0}) getpeername(r0, &(0x7f0000000180)=@can={0x1d, 0x0}, &(0x7f0000000200)=0x80) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000140)=""/4) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0xc) sendmsg$nl_xfrm(r0, &(0x7f0000001640)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x14000}, 0xc, &(0x7f0000001600)={&(0x7f00000002c0)=ANY=[@ANYBLOB="401300002100000026bd7000fedbdf25fe8000000000000000000000000000bbffffffff0000000000000000000000004e2000004e2400090a00a08029000000", @ANYRES32=r1, @ANYRES32=r2, @ANYBLOB="bc6b6e00030000004c10120061656769733235362d6165736e69000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000a002000091d356b7b8d8921bda8575bd3ae029982bccc4fe4ba8e267d79e0cb8baad26d11a4ea644ef78a2adc81cd2f85108a103c06136ea908d559d9af9e9b40bf7c7f1497d7f3c40b0b162d6ea609ed9131b86b9864caa7cb5a023d0ce40c8cc0b55cee7e351f2eaca3ec9cb5ad5481a16a790d449b9c817cab72b505563409ac02f7bed723283fd5c496e895a49057a701df4c90625c070902ec68a183693979d840462c487df820cedf851a042097dfcbf8e0979f8b31a3278845ec40f715490ee8fb8c04773a31c580bf78cdd71a927d21010d29adcf1150f1fa348cdda04c347b4ac4c43e6888e88df06e23e2afe816e166501a7fdd1755d897476f498cff59f3a54cee8efd3f00e22e60fe485270612c155ad9b8fedf5e897c674293ba12f2dc082011be8b5cf6f3ad4b3f9cb724d131bb20e7dafd17a1a4547c8c68a53893c0ebd338b746d3d3d061ad6647b3beb558fdb9ee9cfff7e42da2871094ff886b6465c7f6d303933d09ac8e1fadba290371d3123ab7d0cd5760cf49430f313c23aff6e14fcd786898a5bb523a0b6ea47209cafa089cc53e60c06c721c340f6e5c43b5b255f60d5c231867f3289ae7f6fef3882a083a82f8be846877377e2192ba77e54041d73bfc5e9201baed7580cb0c761c95344af3e3f298aac7e2ca4f93b4b15abf803d5e3b5efee5e2cf5c574319fd32c70646ec784c16137d99a1e2db1e87d09baf9d20076ca1f5deab36e5d3a2b45c57e2dd692c3971d4f86de203b69cda70deff253b3bc9c5b0bd01f478b2dfbd6c278e03092fecc399dc63e231d91a68a7616c9d919ec963dedaf1b32d01231f889e7e6699f1e84115f3f0e44b78653e6623156a2a792991c609d2f4430211ee112217eb8d91c9aa839d599b589c961526bd8689af6af823f28c78d81fbb5c6fb60a4fe8c65db2625559ed8abaeb238691a2fddc97c0549e3f128bf9d53116b7dc2a7d0dc1676e60155bffa55bad43dd61cd4936d736d54b4a05cbb91f8c1bb7bc70ecd353d77f139757fee72193c2cb5d4fbd6420c88aeb3e5f584a7141630141bd0b87366127b7a0794bf8d63f9360297b34fe77ab47d13027ae3181bed40f2f7026d130578fa28e46d5c08ff4bcae3060cf2d0f3eace8fa92df888470d7add7aa7cbe369c3db3fa3d9ab230ad3e2a822055f68be1bddd21cdbf03da48ba80c8b1e149b4f76750ab4e247ea276f4c86c772d6ba5aad406b2143c4354aca47a993fdc1439790295f9189d9d0735ee2a0e22e09338849566f5c32a10b029ce41460e987391511f5ca08ee52e00b37c3832eeb186ccaa2e241fbba1913960341130804fedd47bedf7154fa78b8230958c8fd2fd80a0fe610afe24f9a9de6f1f26efac7529f42ea794949d150cf5332c02a90c4e653bec8d3a65d1535d9b93ad9db555dc72a28188f76d4a8357a8dd8528b397a308e359798faac90433efc5231b8a21a5c7f7262fb0487795cfd43c26b95f614752dd8ee9815d7bbc569b9c7ad93374abc300f1d757a0dd6d1f2c3922225d57d7daf9858b2396b999f1f54aaa60e18877326ec807d15acb6f91eef8d09b1c684f014111995d3f56850a52552b51204f448697df1ca90f10063ff9f17725598855175ff34ec3530b0d165fd6e34a419c25e9c315483f4359a55be9da9265b2b2ac3a026ab4fe37a232022f33c304d6a1554b88b4fb441800afed19aeae9a3455ea6a66fe1db400f833fa8da41eb6be97be8b226aa8f49847c04236648435e476262484fc52aa210d6534b841a2e21cf8e514b2fe5ed284435c1e38bf2a4f40a3327443072fb809e9446888cf95614330a5647041c99eebaa7e6fd1339294e8d3587d0ecc7169c61420a54bfff3d33a3c349b2a4c9280e94c52ddfa5e57c828f0d8dc8b9bed05a6f927ee508f4a73df68ef0e3c114d2b9ce2b2702198aac3dc1676eeedb69947f8f90cf140b2f7f00b33498f68d0c427a40517150f0ef36bb1ef7c43c544c8174bdea88ab0d1af5edfd6369ba38db748f0edbd3dc38df1657aa782b1db70f279fcf26d8f94a45b5b17940c512169bb604c5c20d489240c2f7bf41cfaf65ccbad6844540489ce1937da107a13e3698406ccae953b207bce2ce99f2af71fc7d1aeb7c258807c04b5ca447ce9c78594490329162b75e82479d5d0ce8fb1cee1127e9e25e4957e6cc05acf809106f0210e4507b164c6992e4c154430b14662e14cb7c3e5444cdef05a82315dfd5caba66105f6eb1125e87802acdf88a17087b77708523ca9ee7197ec0d2df5738b6e14834a503a50c0bbe5a7fe1b8271c267a5a0e7f4a116923544a434f581de7e150d76e1bf8eb8e12d777c57514286170e52622193506ba2a179e836d06da28d459c9c68f4b8edc4c3e3040cb6a7a130113ea14df29aefb2886dfed2ede1e9f179e3524d455c945c78653f67c366a54d72cac6fab6c1667329b4752c7ec08aa4da0305cabd6e845df600e372c03f27ca17223ce711c9b4e51213c60fc91f88ee0c57f715086d1e425b0e6a688cf0a6ec223a8280a56b285ab9bb395087361a0866ba352a7f3e130e342d0704b0b9fb08050dd50f3d3babf26ab7d50aacf2cbe3b11bd5e50f84378ab153263ef857828248fe5082136c1fc9678b6a1f95c49d546ee69a0b5bbe4ad2ad9bd73cb05069b6928dcc8d339492e9904156fb2eb0f6e20431348c926310e7c5d7d99d184dfedd3a86773cf5d03404d1214aa68395edb063a0d34b7df63e55f0f9320127b93a3e1932a243621c974e540e56e36595b5ed415e6a4e30b50b014b3331dae964d0c7b8132b4b46424de50f60653a9b0ce61e2e36f26affcdd665822d10271bfb144fe9921a419965e9452fa55fb34906cadb57ce6b3dd4df077873038930b74bc1546f0ed1e40765ecb2f6a669820c8941d855edaadedcd64fa17eb5eab5449431105522579d6ed3329ccc5d64e1152acdde719914a1adc276dc7e38e4ce99d7e9dbab82ba8da76804a39f671d7abbe21f0816920189a84ed207fde1513aee25766c45715528313043c94f6df6a6bd516769e790c2d43ea85b3c17ec569b3be00759c350e90871d6afefd8206a1aeb059aaa839b9c7e1807061c7cd3de1a2f25067567eab9358817e4bffded065ff69b449842ac8cf27dc2ed43240bfc6265d7582d82e2465eef47474045ff68276cc7d2e5c52f04dada0f337b5c7bb7c68d1123f460906895cb6b7087df6a53f084ce7869ec806000000000000003a2066afa36ec0a091c6dc8b4918fd671e67722914d3b37b15c1740abc25528261e2cf8a1d6c4932cd8619043497955e3e26975df390b136aed14fbf321389dafc025104cf4e500ae70267b52b798e03448adde12c5f6339297b2fac5aa5fb209dfaa6b52de3142a912a6e4c0999bc32741d861082ded168a9bd466444e77e65662a750a8596c67bca0000feaaac5f3ece7038df7c3b8659945f88ca96161330e6f62627d87e398e42dbfda37d06d97d6f363eecc89755bf1e604e3c2fa824bd519c6b06051d7161f29b08710ac7d948af72b135cb96c5ec77ed8b1f02f1d182f8c70755ba51d7c4c6bfabb0e0404ac97224b5c6ac187a533dbd68c09b16171116b8bb9befc819c8ec96d2b91c57ebb7f1707ac20d7784a64474d12d3b5dcb3184cdfebf359055e530c92698e80c1c58d60a939debff50b9597d83f76a8db96760afe548a1f229d3dac867ae53840ddfd63192bdb284ca36bdc450572db2aac7974fff99f7724f50586af28d778a1061b8bdc23bd3b342efd77ff8d34720841addc966c9218830f7e180aa7a8e10ac54b3787d22e86db058c6e4dd286b718fed8bb70db77c37f3b2026fd50914cf0c850791b448175ae759a6dc60ebc3fce5ef911e1996528dee6b12a1735279c39e0327bd71817ca3967e8e36858e24cb459eb16231b1ab68ccd47cff0bf61d0073d724a77860ff628b918ba8401b12a80e87ab1517062e039725e6953fe60b9bf5e77616226fe473f2e1971473008d4f97ab7d17ceef45e5a6a80c326846a140bdc2b3fa997cee92e34532de6919d09ed4d8d43fdca5dd32085642b6333affe8835fa769fcccce3fba8984ca70d959250748ff3de0362b72245cfd9a4f99702b19c82e0978136daaee6512cc74aeb3ca0c71448848dfa81ce50f76f1832d6adc7ec34175265a5ad3bedfc83140dc8d18eba957047d4c703877975b2d9a08a2fa74d47768993a17df711d2d321b30af10efa97fae47e12c2c85798414296984802f5a0c172e9c7424f598295906b739f828052e9cc8f718431f617e8f342f3b830a140fea41aeed32c1603405c9a20c30305ace4acf51df39f1cd6c894bbd22eb257ebeea01e09d83c2b58534d26e8e30584684e11d278d56d5e57d9f857dc76697471d2f4d99860ad21e9697526b3772c3b68aba5053cdc556a905dd8f4a5a1b6847fd8a0689be57854613aa76cf5117f99a176204eb95e807a72057838d3144ddf8b879ffedaeaf1969d0cfc78bf73c5c9e952dc8ada4c2901f2e38645dbbcf23e37cd72534dff8d53f8df9e9eeba2444df7326bdc74d83a799a830df94619bf7c1daeac22fd13a6f345cab85c8ba4cc10b23770190ac6730c9871fbf93babf72a86642ea1b946e1b5df87ce8708a099a0c2373e15024a51cd619d3d394c8e64ddc7eabbeb064c99be5455cb7a0a1cb7195cc1da1bee5e1e4c4d0090ede7218b638ec8293e7abc79397aacc750fba07dab79cd780546e8cefd557f8874b322d337f04f5639aca24d4631c022daa490d0548a94ee1f80152df4f1da28e6f6bab4ae75e031b50b65856e15145f9a1f268a2145c1491348c557c6cdc5290826a46ff70b13ad2e95f88c99ebb945711ddc9ef5a10876944d35558259b391568cbb4ff10992fa9b63f8708c3fd985135fb8fa7f723587d0266e84e18f5c134e9d63e83ec486ff38c07070d2c64190a39b969e3f7feba20eda2f6966ccfac44f6f3d414f0159b8b6e3b9bcc4295fccd725dc731b631af2292377a7e924e7ca9524d09cddb8149ce3b23e385e40859b061acb38fa4e0fbf72fe9db60f713e0645a9a169fe9fd6557b99e56fe11f6eb39bdee62c235e73464bf13304018acd336f98fe961e7cfca73f4796325182e5db0c1445b32621cccec7cdde98553f25132682e54221433ebfcce2ac3b31355e7459aa09c0619322d54fb8aa726c36a9d031b8d18e761fe5ef52fb84f0b01a1aec11fb2c28d8352ce615f40346d463e41111f7874100d8a5d20f04fa673efbdeda54ddb8f6b8acbe982777c96300ea18ce2ab5063d7a48229e13b5aec2e62c26c908600d0d89b4e4d5a88740eaf2e83e8a63b7d97619c71fea7ce9dbb5f673c96373b334f72aa1dde492f31cbbbfa7afa5a894180abae8d57e3018b0db90b8b386a647691e840023f101bbfca7d2d15e8ed11fda4756a8ea22bc8695910bda299a81fa65c21c260fff60420ce1f8631b67ff47d600b2977d24ff92d2f8d39949443c0032af6855ab01a989a953a3eeb01f279a89137b10ddb7d514579cfcbafaaf1d4339fe9ee32d5aae2af0f88831d63c5b7b356d4f29bc514ffc21d3fd18fdfadbd2367cf83387eb263bca72462fa29faf34ce6429179b5682b8415978a496beb5b2d7dbdba5b6b5622432ff591924b5d11f82676c98de63a39d0d37782549a2ed514f37733b9145e6e91d6580ab553eefacc004089d52137ba103ead6bc2dafa83056df17223db427b23f6e1faa151fe03f0325f0bd9c79589b63a8fb893cc2f5518e978ce060a5a0c0015005c07350007000000400101007368613232342d617678320000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a8070000cb1723cdf6e2461f21a77ae09c7425af90cdbe00c6df69e78f9cf3bb4d375eeb6d31a0ed10b583ff28ddbbaf173cd89a658774acc1dcb63ee690c9d00677ce29ec3e7c1f7a42979c639f2c383517ad040a662da671e3ac14048cead389e754898e4839ae217f6f5721b419768cbb26008427300335eba4c5d93da6854e9e4eac732cc6e1bf53c0abea3e4e7f485f5d6632461509688adb7cd419af4f92f0a6583a81e6f7424a79d7e6fdadff3fa8f6e1e1c4e1f696e22057b5bbedfc557692af4316bd9cd7fab97672a1bd59849258378177ee7e85ebacd4f972f8167a7cd044cb922197e69fe8479eda925cbd2af55c3e111fe74800000008000b00eb2500000c0015005907350002000000e40006007f000001000000000000000000000000ac1e01010000000000000000000000004e2200004e2300060a0020a03c000000", @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="fe880000000000000000000000000001000004d5ff000000ac1414250000000000000000000000000500000000000000000000000000000001000000000000000101000000000000ffffffff00000000010000000000000009000000000000000100000000000000010000000100000001000000000000000000000000000000ef0000000000000008000000375a0000fdffffff28bd7000000000000a0003008000000000000000600003006465666c617465000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b80000002979ea4558970009254a112f960fe4976a9dcb744a8c7400"], 0x1340}, 0x1, 0x0, 0x0, 0x8000}, 0x4) socket$kcm(0x2, 0x2, 0x73) ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000100)) 04:31:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:31:08 executing program 3: r0 = syz_open_dev$mice(&(0x7f00000000c0)='/dev/input/mice\x00', 0x0, 0x200000) ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000000480)={"f1ea123642d99c5c0e3c98e525f2ca9dc787dc113c5c38b909b12a1e54b906b998e2d42b62c41e0fb7ee65a24d9ce88366a52bed799518ef4f9c66cd176104e89b289464fba8c042ec2074b87b0552dadebec1deeccc06a7395109499b795e99939ec08b9aee6e02c36fdefb6e72dca101488a93ee94a453fd9cdd81e7a0b591d42d175cc5baad051d7efe5648063d6b93863e53610abe915a9b2a3c847ceb3915a2459acc145bc2bc5f9c3e5228d92ee1ab02a8fe580f116464fdf54a9f41d119aa93da416c51b961c14dc5636c4c91d8ed102b35af82d0416c225b1a2cb6380a9800875e8955866a03c2cc9fdaf0e4c01efbf2bc4227bcb22d1e8a660902fdfe6dbf54a78c183e2891b63273eff9f15ae3c784b3c5de66d1cedebee7b8b82ee3e242027af1962cd9fd4942dc9827edb1a882771802a2a0097dff5058d6db3a2d97dc729daa66cf691f22b9007d63500a63cfc850298fb697cf62320663ff69a8df993b1c5bd87aceac3954c52cae66126a5773e2bce9cb013e3d085379733e42366513425c26bbaf639e913d39aa291c2df184916390a3292e4a674a293168d3064fec33bf3dfcc36799db96dbb062de8bfe5c4924d9bf1c22e40b863e64efcec368ccd531ed20f602a881c2f1e5669a1ef56988371ec2e5a5860f3ccafa8af31421a0f8809c22cfe2a2196d78630940133276fde93eb54737dcd28bef82d8dc6f98c6812771a7cae679aa71b71f8451e0046cdf2b99f7f9f0861fc63d60500537384f521855d95a1a3dd1b1a1703d0ed86587c2a7270ce94038eee1be08c089debac35229c4104c060603476d17c897e10a399e8e99535e48dd9ad14ca1543a1d9a12a2ed869df230b58725d101c6f185f0d6975514e22bf9cb8e0dcbe64649e695ba3700cba1b967e08aa43cfdd9e36d24dfa85a4c75571531b5f342224552b192ec2d51a57cc39de6c66d9d04102695e53bb93966764ecdb13555f47544009e16984bb7279d2ffb1d527e62df6638595756617984ebbdd4838f227883ba93b27abb23353c3b40e3fbcf167a368d10316783aab611f6bdfa1e269659b278ac86aeff8a59acfa15e4762efa641d6483df17971f9139d50cc7dbc44ab389382ee5bb45d931e4fab947b5ea8c13ce393e15626efed5e896467c7657fe68d97ad50e60c310182d920fab0cd7c8d2a2c8de84d076067ae5773d6a906d0c496a16365635b2c6b6ccc2e5157b518aca3dfb3802a14dd78054586cd0ef9c3fddffe4a833876bc72d82eedf743ca72635b997eecb5eadbcdaa1d41fb9b7386080762b71c0e0c2890f2ab6957acf313356932ca92179e316bc083d4b26d0ec296c07adefc0d0029791b3342387227662035a88ae5811f854358329db6c0371cbf1a1229c9d6c99b38735344e5c65c1c9cda29fe885370c1eb3d9656a8a4b46f847e20a"}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x10000, 0x0) r1 = syz_open_dev$radio(&(0x7f0000000180)='/dev/radio#\x00', 0x1, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x9) socket$kcm(0x2, 0x0, 0x73) r2 = syz_open_dev$dspn(&(0x7f0000000280)='/dev/dsp#\x00', 0x2, 0x8b00) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000040), &(0x7f0000000080)=0x14) setsockopt$inet6_mtu(r2, 0x29, 0x17, &(0x7f00000001c0)=0x80000000000, 0x30e) socket$kcm(0x2, 0x7, 0x73) sendto$inet6(r2, &(0x7f0000000380)="ff0f44c5040648dc172a9b4e21074acd524a3d1f9ee53706ffdb7078181add3ac40af8848daabfc63554e291fe6e03b8c76796fc4ee027b477b0712fa648286090478b5592da449558338c06656435520250855fc4aa014caaf0c0738ddd040be8bd8162a1342fed4d39a42653b777e1a537f2dd717c8205ca75bfa2255492c563451aba2668b439f31f6a8618a17f78a0e395bb54ec9fdd82f9c610ebb6893f52aa303647b030d0b67acf86523266024b21c8a633ec2ee6f655e241bd4ea49c3765ae4f2a586e0c7327730000000000000000000000000000000000000000", 0xdf, 0x800, 0x0, 0x0) 04:31:08 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 600.342648] binder: 25871:25881 tried to acquire reference to desc 0, got 1 instead [ 600.371351] binder: 25871:25881 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 600.428124] binder: 25871:25875 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:31:08 executing program 5: chmod(&(0x7f0000000000)='./file0\x00', 0x8) socket$kcm(0x2, 0x100000000002, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:31:08 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000680)='/dev/snapshot\x00', 0x0, 0x0) ioctl$IMGETDEVINFO(r1, 0x80044944, &(0x7f00000006c0)={0xfffffffffffffffb}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0x0) 04:31:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="106300"], 0x0, 0x0, 0x0}) 04:31:08 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:08 executing program 3: socketpair$unix(0x1, 0x4, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$kcm(0x2, 0x0, 0x73) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000080)) socket$kcm(0x2, 0x2, 0x73) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000000), &(0x7f0000000040)=0x30) syz_open_dev$mice(&(0x7f0000000100)='/dev/input/mice\x00', 0x0, 0xbe4b4d1b6f27726b) ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000140)) [ 600.745308] binder: 25915:25916 unknown command 25360 [ 600.750668] binder: 25915:25916 ioctl c0306201 20000440 returned -22 [ 600.867431] binder: 25915:25916 tried to acquire reference to desc 0, got 1 instead [ 600.906602] binder: 25915:25924 unknown command 536872576 [ 600.912504] binder: 25915:25924 ioctl c0306201 20008fd0 returned -22 [ 600.932716] binder: 25915:25927 unknown command 25360 [ 600.938063] binder: 25915:25927 ioctl c0306201 20000440 returned -22 04:31:09 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) ioctl$VIDIOC_DQEVENT(r0, 0x80885659, &(0x7f00000003c0)={0x0, @frame_sync}) r1 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000380), 0x12) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000080)={0x0, @in={{0x2, 0x4e20, @multicast2}}}, &(0x7f0000000240)=0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000300)={r3, 0x9}, 0x8) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f0000000280)={r3, 0xffffffff}, &(0x7f00000002c0)=0x8) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r5, &(0x7f0000011fd2), 0xffffffee) read(r4, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:31:09 executing program 5: socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x80000, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000040)={0x3, 'ip6tnl0\x00', 0x1}, 0x18) ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205647, &(0x7f00000000c0)={0xa10000, 0x0, 0x2, [], &(0x7f0000000080)={0x9909e5, 0x5, [], @value=0xc2}}) 04:31:09 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:09 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:31:09 executing program 4: pipe2(&(0x7f0000000080)={0xffffffffffffffff}, 0x80000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='--M\x00', r0}, 0x10) r1 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0c6300008aedcee70159175d4a5fbe321bd2da9f619d85df0563f50ee02052058193cbb3a73014789de0db1b02f7f995d5d046875c76c667d2166f3e8151ec00ecbe6f34a8c7a1d658e8c5d0b92068b59f9db2c0dec562a2c18c8aad9dab3c2aa03e2229e569f9167b8e90e86cb3c126a7fe97b8edaf6b98"], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r3 = dup(r2) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:31:09 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f0000000180)={0x0, 0x0, 0x6, 0x0, [], [{0x6, 0x44, 0xfb, 0xa7a, 0x8, 0x98}, {0xf99, 0x7bd, 0xffff, 0x10000, 0x5, 0xfffffffffffffff8}], [[], [], [], [], [], []]}) [ 601.337557] binder_set_nice: 5 callbacks suppressed [ 601.337571] binder: 25943 RLIMIT_NICE not set [ 601.369435] binder: 25942:25943 unknown command 536872576 [ 601.375310] binder: 25942:25943 ioctl c0306201 20008fd0 returned -22 [ 601.382490] net_ratelimit: 22 callbacks suppressed [ 601.382505] protocol 88fb is buggy, dev hsr_slave_0 [ 601.382980] protocol 88fb is buggy, dev hsr_slave_1 [ 601.423747] binder: 25953 RLIMIT_NICE not set [ 601.429656] binder: 25942:25959 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:31:09 executing program 5: r0 = socket$kcm(0x2, 0x2, 0x73) r1 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0xd173, 0x8200) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000080)={0x0, 0x3}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000140)={r2, 0x7}, 0x8) getsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000), &(0x7f00000000c0)=0x8) socket$kcm(0x2, 0x2, 0x73) 04:31:09 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:09 executing program 2: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r1, 0x0) 04:31:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0xa0000, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r1, 0xc0045516, &(0x7f00000000c0)=0x2) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="e46204400000000096bfd54eed86cb52e19814ea359854fa914566ba99813354e99d38b74686b5deaeff959530919bee61422ac216012fd84cab1a3ca4f07fc3489e7eb169205b297088245a50179e9362210b5f3ac57d0f6605ee9ddc32148d8dbf0d4187d2b68a18c18a6728757a03ec966ba13c597af0936d35b1aa4d7e95090dbe6b176357b5b94c747dbeb113b9d8bc"], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f000000dff8)=[@enter_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r3 = dup(r2) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:31:09 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)) syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x8, 0x12000) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x400000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x4) socket$kcm(0x2, 0x0, 0x73) r1 = socket$kcm(0x2, 0x2, 0x73) bind$tipc(r1, &(0x7f0000000000)=@name={0x1e, 0x2, 0x1, {{0x43, 0x4}, 0x3}}, 0x10) [ 601.685702] binder: 25970:25971 unknown command 1074029284 [ 601.691482] binder: 25970:25971 ioctl c0306201 20012000 returned -22 [ 601.784516] binder: 25980 RLIMIT_NICE not set 04:31:09 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 601.831163] binder: 25970:25971 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 601.862385] protocol 88fb is buggy, dev hsr_slave_0 [ 601.868500] protocol 88fb is buggy, dev hsr_slave_1 04:31:10 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x400000, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x10000, 0x3, 0x4, 0x1000, &(0x7f0000fff000/0x1000)=nil}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f0000000100)={@rand_addr=0x1, @rand_addr=0x4, 0x0, 0x2, [@multicast1, @loopback]}, 0x18) signalfd4(r1, &(0x7f0000000140)={0x8}, 0x8, 0x80000) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000200)={0x0, r1, 0x0, 0x14, &(0x7f0000000180)='\xf6&vboxnet1md5sumem1\x00', 0xffffffffffffffff}, 0x30) ioprio_set$pid(0x2, r2, 0x7ff) ftruncate(r0, 0x0) 04:31:10 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r4, &(0x7f0000011fd2), 0xffffffee) read(r3, &(0x7f0000000000)=""/126, 0xfffffd6d) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:31:10 executing program 5: socket$kcm(0x2, 0x2, 0x73) r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x80, 0x0) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x6, 0x1, 0x2000}, 0x4) socket$kcm(0x2, 0x5, 0x73) 04:31:10 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, 0x0, 0x0, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:10 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x1ffffffffffe, 0x73) openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/attr/current\x00', 0x2, 0x0) r1 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x329, 0x8401) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000020}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x24, r2, 0x302, 0x70bd2d, 0x25dfdbff, {{}, 0x0, 0x800b, 0x0, {0x8, 0x2, 0x80000000}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4048040}, 0x40000) 04:31:10 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, 0x0, 0x0, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 602.465495] binder: 25970:25971 unknown command 1074029284 [ 602.471185] binder: 25970:25971 ioctl c0306201 20012000 returned -22 [ 602.502318] protocol 88fb is buggy, dev hsr_slave_0 [ 602.502329] protocol 88fb is buggy, dev hsr_slave_0 04:31:10 executing program 3: socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x7, 0x73) [ 602.502852] protocol 88fb is buggy, dev hsr_slave_1 [ 602.508083] protocol 88fb is buggy, dev hsr_slave_1 [ 602.513197] protocol 88fb is buggy, dev hsr_slave_0 [ 602.528249] protocol 88fb is buggy, dev hsr_slave_1 [ 602.529926] binder: 25970:26019 unknown command 536872576 [ 602.538999] binder: 25970:26019 ioctl c0306201 20008fd0 returned -22 04:31:10 executing program 2: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ftruncate(r1, 0x0) finit_module(r0, &(0x7f0000000300)='em0\x00', 0x2) rt_sigaction(0x2a, &(0x7f0000000180)={&(0x7f0000000000)="c4e17a125add2e9b646766460f382ba5cd000000c442454793e7730000c48135da157a0000008f497812ccf345dfd98f8850b6171bf3f0804d7341c40102c2910600000032", {0x6}, 0x10000000, &(0x7f0000000100)="65640f0da6c0000000c4012bd026f3470fbde6440f01d7c4e2f932072e2e66400f38df2cecc4c2fd35350500000066410f73d007c4a228f530c4c3c16c99d28e000053"}, &(0x7f0000000280)={&(0x7f0000000200)="0f33460f2ff143d3fec46221acf367f30f51e0c4835d38a147e70000d6f341ae2e65208a4aa5000040f58fa8088781380000000d", {}, 0x0, &(0x7f0000000240)="c4a2490d3ac4627d306808c4014012448300c4e3897936b3660f3815d8c40175654da4c403791d289ef20f2c5c9d42adf3460f2a6e02"}, 0x8, &(0x7f00000002c0)) r2 = syz_open_dev$midi(&(0x7f0000000340)='/dev/midi#\x00', 0x55, 0x102) ioctl$UFFDIO_ZEROPAGE(r2, 0xc020aa04, &(0x7f0000000380)={{&(0x7f0000ffb000/0x4000)=nil, 0x4000}}) [ 602.604129] binder: 25970:26029 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 602.604138] binder: 26020 RLIMIT_NICE not set 04:31:10 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, 0x0, 0x0, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:31:10 executing program 5: socket$kcm(0x2, 0x40000000011, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:31:10 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) lsetxattr$trusted_overlay_origin(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='trusted.overlay.origin\x00', &(0x7f0000000100)='y\x00', 0x2, 0x3) ftruncate(r0, 0x0) 04:31:11 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) r1 = getpgid(0xffffffffffffffff) rt_sigqueueinfo(r1, 0x1b, &(0x7f0000000000)={0x1, 0x936a, 0x30985e5f}) socket$kcm(0x2, 0x2, 0x73) [ 603.078098] binder: BINDER_SET_CONTEXT_MGR already set [ 603.083657] binder: 26056:26058 ioctl 40046207 0 returned -16 04:31:11 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:31:11 executing program 5: socket$kcm(0x2, 0x2, 0x73) prctl$PR_SET_MM_AUXV(0x23, 0xc, &(0x7f0000000000)="76ccb617e8b1bb7aca6e3cf61895f36cc958b728ba0122814545d660e34346712c68dcdc03b0cdcc0523d9027008ceafe5cc8ed6a589cfe5e38c5472797259681baa38807632db00298a73a0a0c23f70259a231af2c85ee40e44b09c356b79b4476cc76a0b39bc806410e1df6a9887881b20250d98d798cea13c580a5a52f408579cfb0a522af67433ac91d26e321658a42d1e0674ba3a14d31783c4752620475d94464dc409806385f446a9894f4195fd88973280a0e823bf88ce3c5cd41e", 0xbf) 04:31:11 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000040)={0xd003, 0x1000}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ftruncate(r1, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x10010, r0, 0x0) r2 = dup2(r1, r0) bind$rds(r2, &(0x7f0000000000)={0x2, 0x4e20, @rand_addr=0x6}, 0x10) getsockopt$packet_buf(r2, 0x107, 0x5, &(0x7f0000000580)=""/168, &(0x7f0000000640)=0xa8) 04:31:11 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0), 0x0, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="106308400000000000000000fb0429cabc551af04f0c756e64891fc0cc858bf8452fcd171ddade4c4a9294a459c03926e6188f9ec797a6b7281723166f5a01ebd023c906758dcafe69c95bd1bce680dae09f0f672588e11efd23a488412aac3df9f20196663eda5a76cb07cc7d36b29190e981ca8e02888947e96d45be28f1e56728a4d8e85e0001563f9e9ab0dffa0a70bb150ded379a6f230f552a7e558684729d29e27d54c499104ba657b80558eb889696e054a5ddb7c6f848ca13d564ede7f68a66f5756b68319b4e3f41d1f50120aa3029816f57e1a56734703b69264c37370f1c1c546cd172c6f347f0c91e2fe4c1d46596ef4cd0edfd9b1465837c98f57d63852f68eced518a66811955a155d180a2a5937eeff14d8acc671d0c7c7f915b8edf317420806b87e2388bcc0ef8b3acafe92ca8361a54ac067497fccda6787b1fc1394d8f82f89a8cb48cf4f4ebd2e4f889ba8316a972b08a95e77ec33e1aa821c01d847a9ade17ac990ac3ce92ae25d8c86e4d5cfed54858d0"], 0x0, 0x0, 0x0}) 04:31:11 executing program 3: socketpair$unix(0x1, 0x9, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) pipe(&(0x7f0000000000)) socket$kcm(0x2, 0x2, 0x73) [ 603.451122] binder: 26081 RLIMIT_NICE not set [ 603.506566] binder: 26080:26081 tried to acquire reference to desc 0, got 1 instead 04:31:11 executing program 5: socket$kcm(0x2, 0x6, 0x73) socket$kcm(0x2, 0x2, 0x73) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/net/pfkey\x00', 0x400080, 0x0) io_setup(0x7, &(0x7f0000000000)=0x0) io_getevents(r0, 0x0, 0x7, &(0x7f0000000040)=[{}, {}, {}, {}, {}, {}, {}], &(0x7f0000000140)={0x77359400}) 04:31:11 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000, 0x20000010000002, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_bp={0x0}, 0x0, 0x0, 0x2}, 0x0, 0x2, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0x0) [ 603.548646] binder: 26080:26090 unknown command 536872576 [ 603.554599] binder: 26080:26090 ioctl c0306201 20008fd0 returned -22 [ 603.612241] binder: 26096 RLIMIT_NICE not set [ 603.643750] binder: 26080:26090 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:31:11 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{0x0}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000280)={0x8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f00000002c0)=0x24) r3 = syz_open_dev$vbi(&(0x7f0000000140)='/dev/vbi#\x00', 0x3, 0x2) ioctl$DRM_IOCTL_CONTROL(r3, 0x40086414, &(0x7f0000000100)={0x2, 0x6}) read(r3, &(0x7f00000001c0)=""/152, 0x98) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0xffffffffffffff7e, 0x0, &(0x7f0000000180)=ANY=[], 0x4cb0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="d0892954c5783be8d52f6b7b00000000"], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r4 = dup(r1) openat(r4, &(0x7f0000000300)='./file0\x00', 0x204000, 0x9) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:31:11 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0x80007) 04:31:12 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) r1 = syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x6, 0x20000) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r1, 0x28, 0x1, &(0x7f0000000100)=0x5, 0x8) ustat(0x7, &(0x7f0000000200)) listen(r0, 0x8) socket$kcm(0x2, 0x2, 0x73) r2 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x2, 0x2) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000001c0)={0xd000, &(0x7f0000000180), 0x3, r2, 0x1}) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r2, 0x84, 0x6e, &(0x7f0000000040)=[@in={0x2, 0x4e24, @multicast2}, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in={0x2, 0x4e22, @multicast1}, @in6={0xa, 0x4e22, 0x0, @empty, 0x8}, @in={0x2, 0x4e24, @remote}, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1b}}, @in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x27}}], 0x7c) [ 604.010235] binder: 26124:26125 ioctl c0306201 20008fd0 returned -14 [ 604.047826] binder: 26124:26125 unknown command 1412008400 [ 604.053714] binder: 26124:26125 ioctl c0306201 2000dfd0 returned -22 [ 604.075387] binder: 26124:26125 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 604.110770] binder: 26124:26125 tried to acquire reference to desc 0, got 1 instead [ 604.168032] binder: 26124:26134 ioctl c0306201 20008fd0 returned -14 [ 604.203053] binder: 26124:26125 unknown command 1412008400 [ 604.208836] binder: 26124:26125 ioctl c0306201 2000dfd0 returned -22 [ 604.232152] binder: 26124:26137 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:31:12 executing program 0: openat$dsp(0xffffffffffffff9c, 0x0, 0x8000000, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:31:12 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{0x0}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:12 executing program 5: socket$kcm(0x2, 0x5, 0x73) rseq(&(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x5, 0x200, 0x8, 0x6}}, 0x20, 0x0, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x9, 0x0) ioctl$LOOP_SET_CAPACITY(r0, 0x4c07) socket$kcm(0x2, 0x7, 0x73) 04:31:12 executing program 2: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r2, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x1, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x40082406, &(0x7f0000000680)='\\:@!vboxnet1&\x00') ioctl$FIDEDUPERANGE(r2, 0xc0189436, &(0x7f0000000300)=ANY=[@ANYBLOB="05000000000000001b060000000000000600000000000000", @ANYRES32=r0, @ANYBLOB="00000000030000000000000000000000000000000000000000000000", @ANYRES32=r1, @ANYBLOB="00000000ffffff7f0000000000000000000000000000000000000000", @ANYRES32=r3, @ANYBLOB="00000000030000000000000000000000000000000000000000000000", @ANYRES32=r2, @ANYBLOB="00000000060000000900000000000000000000000000000000000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\t\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00']) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_NAME_TABLE_GET(r3, &(0x7f0000000180)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f0000000200)={0xdc, r4, 0x8, 0x70bd29, 0x25dfdbfb, {}, [@TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x87a8}]}, @TIPC_NLA_SOCK={0x8, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_MON={0x3c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x100}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3f}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x5}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xbda}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3ff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3}]}, @TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x2}]}, @TIPC_NLA_NET={0x30, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x4e202a9c}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x5}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x2}]}, @TIPC_NLA_NODE={0x14, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xac}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2}]}]}, 0xdc}, 0x1, 0x0, 0x0, 0x4000000}, 0x8800) fcntl$getownex(r0, 0x10, &(0x7f0000000400)={0x0, 0x0}) ioctl$CAPI_GET_MANUFACTURER(r3, 0xc0044306, &(0x7f0000000480)=0xe3d) ptrace$getregs(0xc, r5, 0x9, &(0x7f0000000440)=""/9) write$apparmor_current(r3, &(0x7f00000005c0)=@hat={'changehat ', 0x3, 0x5e, ['TIPCv2\x00', 'vmnet1%securityprocvmnet0securityem1vboxnet0cpuseteth1.%GPL/eth1@loppp0\x00', '/dev/hwrng\x00', '\\:@!vboxnet1&\x00']}, 0x85) ioctl$VIDIOC_S_FMT(r3, 0xc0d05605, &(0x7f00000004c0)={0x0, @vbi={0x1, 0x0, 0xbc, 0x33363248, [0x9, 0xaea], [0xfffffffffffffffc, 0x40], 0x13a}}) 04:31:12 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) keyctl$join(0x1, 0x0) socket$kcm(0x2, 0x0, 0x73) r1 = syz_open_dev$video(&(0x7f00000000c0)='/dev/video#\x00', 0x9, 0xa00) ioctl$VIDIOC_G_FREQUENCY(r1, 0xc02c5638, &(0x7f0000000040)={0x3, 0x3}) r2 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x3, 0x2) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r2, 0x40bc5311, &(0x7f0000000180)={0x5, 0x1, 'client1\x00', 0x3, "15a5266e060a8127", "7b7ca88c01626fb7c86f3a94b6d1c6f65ca413279d6d01cf7d76bbd498ee0951", 0x1, 0x200}) socket$kcm(0x2, 0x2, 0x73) 04:31:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000040)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x14, 0x0, &(0x7f00000000c0)=[@increfs_done={0x40106308, r2, 0x2}], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0c63e6e3b263290a703fc376"], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r3 = dup(r0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:31:12 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{0x0}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 604.481744] binder: 26145:26154 BC_INCREFS_DONE u0000000000000000 no match [ 604.542680] binder: 26145:26154 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:31:12 executing program 5: socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x7, 0x73) [ 604.604900] binder: 26145:26166 unknown command -471440628 [ 604.610649] binder: 26145:26166 ioctl c0306201 2000dfd0 returned -22 04:31:12 executing program 3: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) socket$kcm(0x2, 0x7fffffc, 0x73) socket$kcm(0x2, 0x2, 0x73) socket$inet6(0xa, 0x7afa4b7e1db5f124, 0x35f) r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x0, 0x2) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f0000000040)={0x1f, 0x8000, 0xa4, 0x572, 0x0}, &(0x7f0000000080)=0x10) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000000c0)={r1, 0x7ff, 0x20}, 0x8) exit(0x7ffe) 04:31:12 executing program 2: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000100)={0x0, 0x70, 0x7ac, 0x3, 0x7, 0x6, 0x0, 0x7f, 0xa0009, 0x0, 0x6b7, 0x100000001, 0x4, 0xffffffff, 0x5, 0x9, 0x7f, 0x6, 0x1, 0x969, 0xfffffffffffffffd, 0x5, 0xe308, 0xf8, 0x6, 0x0, 0x2aec, 0x2, 0x1, 0x7, 0x9, 0x0, 0x100000000, 0x8, 0x1f5, 0x1ff, 0x2, 0x1, 0x0, 0x9, 0x2, @perf_bp={&(0x7f0000000000), 0x8}, 0x0, 0xb06, 0x2, 0x8, 0x2, 0x7, 0x7fffffff}, r2, 0x9, r0, 0xb) ftruncate(r1, 0x0) [ 604.700317] binder: 26145:26166 BC_INCREFS_DONE u0000000000000000 no match [ 604.743612] binder: 26145:26166 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 604.796386] binder: 26145:26154 unknown command -471440628 [ 604.802391] binder: 26145:26154 ioctl c0306201 2000dfd0 returned -22 04:31:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0c630000c2c929d244b781574cbc33ff525554fc92862d9c5ef54c97cb045a0ee153ae7d6a8e22715e2506ed341a15c640ac412d8c7c66e9d51460b5edc88404d039e6dd4bce092734b79c5e59"], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000080)='fou\x00') sendmsg$FOU_CMD_ADD(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1080000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x38, r2, 0xa00, 0x70bd2b, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e20}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e21}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e21}]}, 0x38}, 0x1, 0x0, 0x0, 0x4008010}, 0x10) sync_file_range(r0, 0x6, 0xfff, 0x5) r3 = dup(r1) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:31:13 executing program 5: socket$kcm(0x2, 0x2, 0x73) syz_open_dev$sndctrl(&(0x7f0000000000)='/dev/snd/controlC#\x00', 0x80000000, 0x2000) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getpeername$inet(r0, &(0x7f0000000040)={0x2, 0x0, @empty}, &(0x7f0000000080)=0x10) socket$kcm(0x2, 0x2, 0x73) [ 605.050845] binder: 26192 RLIMIT_NICE not set [ 605.080859] binder: 26189:26192 tried to acquire reference to desc 0, got 1 instead [ 605.109083] binder: 26189:26193 unknown command 536872576 [ 605.115098] binder: 26189:26193 ioctl c0306201 20008fd0 returned -22 [ 605.137106] binder: 26195 RLIMIT_NICE not set 04:31:13 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0x0) 04:31:13 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x400042, 0x0) mkdir(&(0x7f0000000140)='./file0/file1\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000080)='./file0/file0\x00', 0x0, 0x0) getxattr(&(0x7f0000000280)='./file0/file0\x00', &(0x7f00000002c0)=@random={'btrfs.', 'cgroup2\x00'}, &(0x7f0000000300)=""/57, 0x39) r2 = openat$cgroup_procs(r1, &(0x7f0000000100)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000240)={0xffffffffffffffff}, 0x0) write$sndseq(r1, &(0x7f0000000080), 0x0) mkdir(&(0x7f0000000340)='./file0/file1\x00', 0x40) read(r3, &(0x7f0000000000)=""/126, 0xfffffd6d) getsockopt$inet_dccp_int(r0, 0x21, 0x0, &(0x7f00000000c0), &(0x7f0000000180)=0x4) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:31:13 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(0xffffffffffffffff) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:13 executing program 5: socket$kcm(0x2, 0x2, 0x73) r0 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x4, 0x8141) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0xc0000, 0x0) syz_kvm_setup_cpu$x86(r0, r1, &(0x7f0000fe5000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, &(0x7f0000000080)="e7e566ba2000edc4c2791ee2f20f005f0066b880000f00d00f20c035000001000f22c0c401f97cbe2000000066b80b000f00d0650f00d2f364360f08", 0x3c}], 0x1, 0x2c, &(0x7f0000000100)=[@cstype0={0x4, 0x4}], 0x1) socket$kcm(0x2, 0x2, 0x73) 04:31:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="05630441030000009a115f21f40a09690d196b61189accb392498efab62ed386442c0724800337af8b46cfdadf2c2bf1efaf5e1105325eea7f1d69b06548c9f522d1edb4279aedb6c8f183d74bf366a313c61ef308f50100000062da50f2b5fdc028722bb82b4d91fb40e53b470e0e310f658f9b10159c3f7c95b007c78bc8ffced09914ecafa691e6ab7ce8b52efcf52aa40e26602e903116ce46b4bfd1e786de197f5e7c74c254dbdb5ecde32d3a4195ee9dd5b52232c784be1e869499830e1ac46d8448bac795f94e54ede3185aeeb328a4d882d16b5c465933f9d59e9870fb"], 0x0, 0x0, 0x0}) r2 = syz_open_dev$sndpcmc(&(0x7f0000000340)='/dev/snd/pcmC#D#c\x00', 0xffffffffffffff01, 0x2000) sendmmsg$alg(r2, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000480)="03d7ea44dd867e0ade369f4c38bbe00051747047b7a68d6b156f8282b6e105de487cd37faefe63056e26c0efecc17975693298c0c33bfc488585a580548bd0077ca55b1d7abb535d9262f0dbbf19a1df3daaeacc077d11372ec62156e16cf06c1fadd02f2f88c71c0b4db454d685fdc2a409efb0325fc9ebcb21a4e9dcd1e2f1dc2e51e387b0001f1e7809fa54f988592d88893a1d77da2aaaf7083538b55fa466dd015127da6bb2c8609c9ae1adc167722e", 0xb2}], 0x1, 0x0, 0x0, 0x44801}], 0x1, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0e630c4000000000842dc7c4ef93e8e5167ce4bc249e0275af1b0831a3b9ba68dfa51e2785c60aca1f691ffbe2f066e8d4b291dd170f22eae66fe59df4bee617d71b1e6436150051ef3fceb6ff168b49817b86355ec3c81f3709"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r3 = dup(r1) setsockopt$IP_VS_SO_SET_ADDDEST(r3, 0x0, 0x487, &(0x7f00000000c0)={{0x1d, @loopback, 0x4e20, 0x0, 'none\x00', 0x3a, 0x1000, 0x4d}, {@broadcast, 0x4e24, 0x2001, 0x7f, 0x4, 0x648}}, 0x44) ioctl$DRM_IOCTL_ADD_BUFS(r1, 0xc0206416, &(0x7f0000000040)={0x3, 0xff, 0x9, 0xcd, 0x1, 0x3f}) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) clock_gettime(0x7, &(0x7f0000000580)={0x0, 0x0}) fcntl$setlease(r2, 0x400, 0x2) setitimer(0x3, &(0x7f0000000380)={{r4, r5/1000+10000}, {r6, r7/1000+30000}}, &(0x7f00000003c0)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x2a0, 0x0, &(0x7f0000000340), 0x0, 0x0, 0x0}) [ 605.425568] binder: 26209:26210 unknown command 1090806533 [ 605.431317] binder: 26209:26210 ioctl c0306201 20012000 returned -22 04:31:13 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x0, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:13 executing program 5: socket$rxrpc(0x21, 0x2, 0x2) socket$inet6_udp(0xa, 0x2, 0x0) r0 = socket$inet6(0xa, 0x6, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) listen(r0, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/rtc0\x00', 0x0, 0x0) ioctl$IOC_PR_PREEMPT_ABORT(r1, 0x401870cc, &(0x7f0000000400)={0x200, 0x71c, 0x0, 0x5}) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000340)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) r3 = getuid() fsetxattr$security_capability(r0, &(0x7f0000000040)='security.capability\x00', &(0x7f0000000080)=@v3={0x3000000, [{0x7, 0x2}, {0x1f, 0x40}], r3}, 0x18, 0x2) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 605.483350] binder: 26209:26210 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 605.503514] binder: 26210 RLIMIT_NICE not set 04:31:13 executing program 2: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x20001, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x4c, &(0x7f0000000100)=[@in={0x2, 0x4e24}, @in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in6={0xa, 0x4e24, 0x80000001}, @in={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f0000000200)={r2, 0x9}, &(0x7f0000000240)=0x8) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000000340)=0x40, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) poll(&(0x7f0000000280)=[{r1, 0x1}, {r0, 0x2}, {r1, 0x80}, {r4, 0x1}, {r3, 0x81}, {r1, 0x8000}, {r0, 0x4201}], 0x7, 0x9) ioctl$SG_SET_FORCE_PACK_ID(r1, 0x227b, &(0x7f0000000380)=0x1) accept$inet6(r1, &(0x7f00000002c0)={0xa, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x1c) [ 605.549476] binder: 26209:26218 ioctl c0206416 20000040 returned -22 [ 605.583252] binder: 26209:26218 unknown command 1986356271 [ 605.588998] binder: 26209:26218 ioctl c0306201 20000440 returned -22 04:31:13 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) getsockopt$IP_VS_SO_GET_SERVICES(r1, 0x0, 0x482, &(0x7f0000000000)=""/173, &(0x7f00000000c0)=0xad) 04:31:13 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:13 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000180)={0x0, 0x0, 0x20}, &(0x7f0000000200)=0xc) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000340)={r1, @in6={{0xa, 0x4e24, 0x6, @remote, 0x1}}}, &(0x7f0000000300)=0xfd31) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ftruncate(r2, 0x0) 04:31:13 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:14 executing program 3: socketpair$unix(0x1, 0x4, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$kcm(0x2, 0x0, 0x73) write$binfmt_script(r1, &(0x7f0000000000)={'#! ', './file0', [{0x20, '\\\'ppp1-cpuset'}, {0x20, 'uservboxnet1*%cpusetvboxnet1'}], 0xa, "454fafb66aff88c2d6662e3376bd8515ec04b32577c3b5c5a56d834421aa620164ba6257292d2301fbcbee5ac8d8e6226cfbe5edbd34f3129b805fa4678e5ff23716355f2f375ada5972f2565912db07d1209a6289045e6a4f3a21be1d4011832681d686653acb94541b4ff4d71058138a927c1933bea1f7f19e164ea96773a579e6abc09af01e08d7a58117eb1c47abe7f095562f8a8d7a2681b09accf7fc8881811bf697d20d"}, 0xdd) socket$kcm(0x2, 0x2, 0x73) [ 606.211350] binder: 26209:26218 unknown command 1090806533 [ 606.217392] binder: 26209:26218 ioctl c0306201 20012000 returned -22 [ 606.219598] binder: 26209:26273 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 606.225448] binder: 26274 RLIMIT_NICE not set [ 606.237020] binder: 26209:26218 ioctl c0206416 20000040 returned -22 [ 606.244871] binder: 26209:26273 unknown command 1986356271 [ 606.250634] binder: 26209:26273 ioctl c0306201 20000440 returned -22 04:31:14 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$KVM_SET_SIGNAL_MASK(r0, 0x4004ae8b, &(0x7f0000000080)=ANY=[@ANYBLOB="00004a6500000001000000"]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000280)='ocfs2_dlmfs\x00', 0x0, 0x0) r1 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r4, &(0x7f0000011fd2), 0xffffffee) read(r3, &(0x7f0000000000)=""/126, 0xfffffd6d) setsockopt$IP_VS_SO_SET_STARTDAEMON(r3, 0x0, 0x48b, &(0x7f00000000c0)={0x2, 'yam0\x00', 0x4}, 0x18) link(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000340)='./file0\x00') sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:31:14 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:14 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0x0) 04:31:14 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x101, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0x7, 0x4d, 0x1}, 0x7) 04:31:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000940)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/btrfs-control\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r2, 0xc0bc5351, &(0x7f0000000980)={0x5, 0x3, 'client0\x00', 0xffffffff80000000, "7b7ff7310002a7c0", "d4b72a2e86e32d64a03bdfd595a0b29845fdecd973507e8a4365df5c39663e49", 0x1, 0x5}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) r3 = syz_open_dev$usb(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x40, 0x80000) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r3, 0xc058534f, &(0x7f0000000880)={{0x8000, 0x10001}, 0x1, 0xea, 0x3, {0x40, 0x100000001}, 0x41, 0xfffffffffffffe01}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="4c631400"], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r4 = dup(r1) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f00000003c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000380)={0xffffffffffffffff}, 0x111, 0x1}}, 0x20) fsetxattr$trusted_overlay_opaque(r1, &(0x7f00000007c0)='trusted.overlay.opaque\x00', &(0x7f0000000800)='y\x00', 0x2, 0x2) write$RDMA_USER_CM_CMD_REJECT(r4, &(0x7f0000000480)={0x9, 0x108, 0xfa00, {r5, 0x5b, "a1a67c", "795a179e752b9b01cf2bc4ca06503dcca52565db882c61c28777ee2f16683e969feb2bb399cf4beedb107c26c57ef63b19b69b7ff0122851a0408aa562194949fa0a64db0e41aa6b104ee40536088b25d715a3cd38fa71b915e9ecaa1984be9abca949370b892b13bb346478256dfd9a0385d47e2598b83df1100f63d8663b5b01929d785fa5e0cd51918b13788590820e42e487578dde0fe88b648cac22c0e992c76c8e7b309d1072de277e7204c6d959e75b0384d296e3a941c915cb9fcb254f6b8ea8f1f36804c00dce34e75c960f4ae689faf6022e3c3285b468bf719c18c00a67d0fc4a20d2517268437a48dea06313d33d3c3a749e828f084f9eaa682e"}}, 0x110) r6 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x40000, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(r4, 0x84, 0x0, &(0x7f00000005c0)={0x0, 0x9, 0x2, 0x4}, &(0x7f0000000600)=0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r6, 0x84, 0x70, &(0x7f0000000640)={r7, @in={{0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}}, [0x80000001, 0x4, 0x5, 0x4, 0x1, 0x100, 0x8, 0x6, 0x400, 0x4, 0x3ff, 0x3, 0x1, 0x7fff, 0x10001]}, &(0x7f0000000740)=0x100) ioctl$sock_inet_tcp_SIOCOUTQNSD(r4, 0x894b, &(0x7f0000000780)) write$P9_RSETATTR(r4, &(0x7f0000000400)={0x7, 0x1b, 0x1}, 0x7) sendmsg$inet_sctp(r6, &(0x7f0000000300)={&(0x7f00000000c0)=@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x27}}, 0x10, &(0x7f0000000140)=[{&(0x7f0000000100)="68f03eeeb9a029c49f2972", 0xb}], 0x1, &(0x7f0000000180)=[@init={0x18, 0x84, 0x0, {0x4, 0x864, 0x8000, 0x2}}, @authinfo={0x18, 0x84, 0x6, {0x7}}, @dstaddrv6={0x20, 0x84, 0x8, @mcast2}, @dstaddrv6={0x20, 0x84, 0x8, @local}, @dstaddrv6={0x20, 0x84, 0x8, @loopback}, @dstaddrv6={0x20, 0x84, 0x8, @mcast1}, @dstaddrv6={0x20, 0x84, 0x8, @remote}, @init={0x18, 0x84, 0x0, {0x6, 0x9, 0x8000, 0x6}}, @dstaddrv6={0x20, 0x84, 0x8, @mcast2}], 0x108}, 0x801) r8 = dup(r6) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:31:14 executing program 5: syz_extract_tcp_res(0x0, 0x2, 0x6) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f023c123f3188a070") socketpair$unix(0x1, 0x0, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x1, &(0x7f000039a000)=[{0x6}]}, 0x10) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = dup(r1) ioctl$TIOCCONS(r2, 0x541d) setsockopt$inet6_tcp_int(r1, 0x6, 0xa, &(0x7f0000000000)=0x81, 0x4) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$inet6_int(r2, 0x29, 0xb, &(0x7f0000000280)=0x2, 0x4) pause() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x19, &(0x7f0000000180)=0x6, 0x4) r3 = gettid() clone(0x807ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$SNDRV_TIMER_IOCTL_STOP(r2, 0x54a1) clone(0x2102001fec, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = getpid() exit_group(0x0) perf_event_open(&(0x7f000001d000)={0x200000002, 0x70, 0x6d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r4, 0x0, 0xffffffffffffffff, 0x0) ptrace(0x10, r3) wait4(0x0, 0x0, 0x0, 0x0) creat(&(0x7f0000000040)='./bus\x00', 0x0) ioctl$sock_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) [ 606.438223] binder: 26284:26285 unknown command 1336140 [ 606.443853] binder: 26284:26285 ioctl c0306201 2000dfd0 returned -22 [ 606.503761] binder: 26284:26285 ioctl 894b 20000780 returned -22 04:31:14 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, 0x0) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:14 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='coredump_filter\x00') ioctl$VHOST_SET_VRING_NUM(r1, 0x4008af10, &(0x7f0000000040)={0x1, 0x578b8a42}) [ 606.544350] binder: 26284:26285 tried to acquire reference to desc 0, got 1 instead [ 606.623055] binder: 26284:26300 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 606.662298] net_ratelimit: 18 callbacks suppressed [ 606.662315] protocol 88fb is buggy, dev hsr_slave_0 [ 606.663010] protocol 88fb is buggy, dev hsr_slave_1 [ 606.667762] protocol 88fb is buggy, dev hsr_slave_1 [ 606.683268] protocol 88fb is buggy, dev hsr_slave_0 [ 606.683433] binder: 26284:26314 unknown command 1336140 [ 606.688820] protocol 88fb is buggy, dev hsr_slave_1 [ 606.693902] binder: 26284:26314 ioctl c0306201 2000dfd0 returned -22 [ 606.699592] protocol 88fb is buggy, dev hsr_slave_0 [ 606.711005] protocol 88fb is buggy, dev hsr_slave_1 04:31:14 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$kcm(0x2, 0x0, 0x73) r3 = dup2(r2, r2) r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x200, 0x0) ioctl$sock_bt_hidp_HIDPCONNDEL(r4, 0x400448c9, &(0x7f0000000180)={{0x80, 0x4, 0x80000001, 0x8336, 0x0, 0xfff}, 0x5}) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r3, 0x660c) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r3, 0x84, 0x71, &(0x7f0000000100)={0x0, 0x7}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f00000001c0)=@assoc_value={r5, 0x9}, 0xfffffffffffffe61) read(r1, &(0x7f0000000200)=""/82, 0x52) socket$kcm(0x2, 0x2, 0x73) ioctl$UI_SET_EVBIT(r3, 0x40045564, 0x6) write$FUSE_NOTIFY_STORE(r0, &(0x7f0000000280)={0x29, 0x4, 0x0, {0x4, 0x9, 0x1, 0x0, [0x0]}}, 0x29) rseq(&(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x8, 0x3ff, 0x6}, 0x2}, 0x20, 0x1, 0x0) [ 606.744365] binder: 26284:26307 ioctl 894b 20000780 returned -22 04:31:14 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, 0x0) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) socketpair(0x2, 0x0, 0x9, &(0x7f0000000040)={0xffffffffffffffff}) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e21, 0x8, @dev={0xfe, 0x80, [], 0x17}}, 0x1c) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r3 = dup(r1) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:31:15 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000000)={0x0, 0x80000, 0xffffffffffffffff}) ioctl$DRM_IOCTL_ADD_CTX(r0, 0xc0086420, &(0x7f0000000040)) r1 = syz_open_dev$vbi(&(0x7f0000000100)='/dev/vbi#\x00', 0x2, 0x2) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000200)={0x4, {{0x2, 0x4e23, @local}}, 0x1, 0x5, [{{0x2, 0x4e21, @broadcast}}, {{0x2, 0x4e22, @empty}}, {{0x2, 0x4e20, @multicast1}}, {{0x2, 0x4e23, @multicast1}}, {{0x2, 0x4e22, @rand_addr=0x9}}]}, 0x310) write$P9_ROPEN(r1, &(0x7f0000000140)={0x18, 0x71, 0x2, {{0x0, 0x4, 0x3}}}, 0x18) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ftruncate(r2, 0x0) [ 607.062312] binder: 26341 RLIMIT_NICE not set [ 607.147579] binder: 26333:26335 tried to acquire reference to desc 0, got 1 instead [ 607.195499] binder: 26333:26335 unknown command 536872576 [ 607.195614] binder: 26347 RLIMIT_NICE not set [ 607.201218] binder: 26333:26335 ioctl c0306201 20008fd0 returned -22 [ 607.230111] binder: 26333:26348 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:31:15 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:31:15 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, 0x0) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:15 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) fchdir(r0) 04:31:15 executing program 2: r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ftruncate(r1, 0x2) 04:31:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$sndpcmp(&(0x7f0000000280)='/dev/snd/pcmC#D#p\x00', 0x8000, 0x200000) r2 = syz_open_dev$binder(0x0, 0x0, 0x0) ioctl$SIOCGETNODEID(r1, 0x89e1, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4c, 0x0, &(0x7f00000001c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f0000000140)=[@ptr={0x70742a85, 0x0, &(0x7f0000000100), 0x1, 0x4, 0x10}], &(0x7f0000000180)=[0x28]}, 0x6}}], 0xfdee, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r3 = dup(r2) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f0000000240)=0x7fff, 0x4) ioctl$sock_inet_SIOCSIFBRDADDR(r1, 0x891a, &(0x7f0000000300)={'veth0\x00', {0x2, 0x4e22, @multicast1}}) ioctl$FS_IOC_FSSETXATTR(r3, 0x401c5820, &(0x7f0000000040)={0x7, 0x3f, 0x8, 0x0, 0x7}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) [ 607.444930] binder: 26359:26360 got reply transaction with no transaction stack [ 607.452692] binder: 26359:26360 transaction failed 29201/-71, size 40-8 line 2741 [ 607.460384] binder: 26359:26360 ioctl c0306201 200000c0 returned -14 04:31:15 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000580)='/dev/snd/controlC#\x00', 0x0, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r0, 0xc0045520, &(0x7f0000000080)=""/218) [ 607.519619] binder: 26377 RLIMIT_NICE not set [ 607.534486] binder: 26359:26376 unknown command 536872576 [ 607.540149] binder: 26359:26376 ioctl c0306201 20008fd0 returned -22 04:31:15 executing program 2: r0 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x0, 0x20000) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000300)={0x0, 0x1, 0x2, 0x2, 0x6, 0x7, 0x10001, 0x0, {0x0, @in6={{0xa, 0x4e24, 0x9, @mcast2, 0xfffffffffffff000}}, 0x1, 0x401, 0x8000, 0x8, 0x8}}, &(0x7f0000000140)=0xb0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000180)={0x0, 0x7}, &(0x7f00000003c0)=0x8) getsockopt$inet_sctp_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f0000000400)={r1, 0x200, 0x9, 0x40, 0x2, 0x2, 0x1, 0x5, {r2, @in={{0x2, 0x4e20, @loopback}}, 0x9000000000000, 0x1ff, 0x4, 0x74b5, 0xe2ca}}, &(0x7f00000004c0)=0xb0) r3 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x40002, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r6, 0x6, 0xe, &(0x7f0000000200)={@in6={{0xa, 0x4e22, 0x7, @mcast2, 0xffff}}, 0x0, 0x8, 0x0, "13433a1fd3f2a8859d20279bf6c3af34b72322af03565029ee1db34c10facdde4db03167d5bd877957cd3a284329bdfd97f9f197196d9543e8cf01dd37f35ab98e16b95b9e3ab033bd987ccba433c146"}, 0xd8) ftruncate(r5, 0x0) r7 = dup3(r4, r3, 0x80000) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r7, 0x6, 0x21, &(0x7f0000000000)="6ec58c84d56c5c5cdf90cdceaf2a6bb6", 0x10) [ 607.570007] binder: 26359:26377 ioctl 401c5820 20000040 returned -22 [ 607.594831] binder: undelivered TRANSACTION_ERROR: 29201 [ 607.622135] protocol 88fb is buggy, dev hsr_slave_0 [ 607.627686] protocol 88fb is buggy, dev hsr_slave_1 04:31:15 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:15 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) mknod(&(0x7f0000000040)='./file0\x00', 0x9, 0x2) lseek(r2, 0x0, 0xb023d0267e004539) ioctl$sock_inet_SIOCGIFNETMASK(r0, 0x891b, &(0x7f0000000000)={'irlan0\x00', {0x2, 0x4e24, @rand_addr=0x514}}) 04:31:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0xada5331dcc62be47, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0f630c420300000000000000eb030000e3f9ba37c733be3e0906d400068a201a02014fa898543e41"], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:31:15 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000200)='ip6_vti0\x00', 0x10) sendto$inet(r1, &(0x7f0000d7cfcb), 0xfffffffffffffd8b, 0x0, 0x0, 0x0) 04:31:15 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 607.949164] binder: 26407:26411 unknown command 1108108047 [ 607.955057] binder: 26407:26411 ioctl c0306201 20012000 returned -22 [ 608.070797] binder: 26407:26411 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 608.085098] binder: 26411 RLIMIT_NICE not set [ 608.102276] protocol 88fb is buggy, dev hsr_slave_0 [ 608.131293] binder: 26407:26418 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:31:16 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ftruncate(r1, 0x0) r2 = socket(0x2, 0x801, 0x50) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000180)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[@ANYBLOB="640000002e0060322dbd7000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="07000f0008000b000b00050008000b000000008008000b003800000008000b00d500000008000b000000000008000b000300000008000b000600000008000b000000000008000b0002000000"], 0x64}, 0x1, 0x0, 0x0, 0x40000}, 0x24000000) 04:31:16 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000180)={0x0, r4}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:16 executing program 0: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x4) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20ncci\x00', 0x103800, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x0) 04:31:16 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuacct.usage_user\x00', 0x0, 0x0) ioctl$KVM_GET_IRQCHIP(r1, 0xc208ae62, &(0x7f0000000340)) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ADD(r1, &(0x7f0000000300)={&(0x7f00000000c0), 0xc, &(0x7f00000002c0)={&(0x7f0000000180)={0x118, r2, 0x4, 0x70bd2d, 0x25dfdbfe, {}, [@TIPC_NLA_NET={0x3c, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x4}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xffffffffffff8000}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x9}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x9}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x9}]}, @TIPC_NLA_NODE={0x18, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xe38}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_NODE={0x30, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xffffffffffffffe0}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x795062d8}]}, @TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9}]}, @TIPC_NLA_LINK={0x44, 0x4, [@TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffffffffffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}]}]}, @TIPC_NLA_LINK={0x28, 0x4, [@TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2415}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}]}]}, 0x118}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) socket$kcm(0x2, 0x0, 0x73) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x0, 0x0) setsockopt$RXRPC_UPGRADEABLE_SERVICE(r3, 0x110, 0x5, &(0x7f0000000040)=[0x1, 0x3], 0x2) socket$kcm(0x2, 0x2, 0x73) 04:31:16 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, 0x0) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:16 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, 0x0) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:16 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCMSET(r2, 0x5418, &(0x7f0000000040)=0x401) syslog(0x4, 0x0, 0xffffffffffffff94) splice(r1, &(0x7f00000000c0), r0, &(0x7f0000000080)=0xfffffffffffffffc, 0xb64, 0x9) getsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000100)={@remote, 0x0}, &(0x7f00000011c0)=0x14) bind$xdp(r2, &(0x7f0000001200)={0x2c, 0x4, r3, 0x19, r2}, 0x10) write$UHID_INPUT(r2, &(0x7f0000000180)={0x8, "0f2d4cd87adb49fcb4a46c72cdf879e979bf1f73a34f4447c7d15341b2352de069c0ea99a2a6bc2a204b327c5523b962023bd4a3f27681c120dcc80190b5152d86eb74f9c2273f82e87e66899b563e177abe720f0782dc4820155655b25634ec3127b7951e4f41466fef7f52e49f73fa9bc051d7688a641015de721450d1dd44afd78472f5db30ac6b1313f47afc80de7cad5f7e67a49727330126fc7aa7ce63b8f5a628275a590d5ac01ffd7ed23cde97812300f9d613f2d4e4829d0dd76e05c8ac1f1985e83c834d7c945d5552d18ed4739055f5569bfa0f911f59f4ed1c4e877c03549f3de850f45f5d177f00319ecee80ebf3492c8a22a5d1f4a45ac92c5a4fef17cf9eb39be707f8aac70fdcac924302ce95f7f7b602253b73b9b101a3e1e5baf802efb628a83b6a264b543fb2787b0dfee462b38fa8d458584c9b1d4e76a619b3aafbac49b6b298dbc271bfc9eefb368814d339e5a2491738d7872ab2b16458dd68fe9e141c4b9cb1ba53b6bafe3765357a7626585e540e0e37d5491f6cfa591f4252c622bd50eecb9453c4238c89dd41b866b71e97592513ac643483ce3085b05764f238e8b46685cf90907c77d8286e391610f1363c7eefc68f37ebfb6f431887362fd43998cbbb381f5e8ea9765fa8107723bec4cc03c49578067906e8b1f4a7d35fa145ccdab7ce8d5c9b50408c64cee101a83aee1bb0cc172b221067ab8e2e5a25e636a30be52b432882643004adc7851191f4697897ab8745a76db12774c8f1d2f00bf80c254dea03446110debc573d7706f4796dc0b87597b25c6cefba69e70933949c9006f2812825943e5ddc86f8a3bfbd5fab8776fe6f90bcc3c8ce25d972f52ff91034086f25c24eb36b83126d330a81318fa7d50d31cd46fcd0ff5fe648c85d018bd360737b79332a348846ba6ee82079e0f7c6f5b69c8233c979642c6ed5a68db1bec90055ac2fb55176288529843a4e29b1ab22ef539ee3418a433d3a77e03e219d29bdbee197f07cb9913d87313220ca00b855e3998c11cd7f05c371fa7ff5fb4b645d75ee43dcd0986ef145c2e1582c92624b73981abaa30eda6471e7544cdde3adefe504aa22a7bb2b9f9943247eccecc29233850d2621acfc5b5d5679bdaf5dfcd89032fe96c676da22b173e92dedab741fbefbbc315618a035c2864cea5ae5b0bb9f7490dd58e30386613bd966814451bbbd826573462d6b4a849ac7a60a6287539af1e3cf825eb61d8f752a6b6cd9f51a0307a809bb6e72c885eb45fb57cafc04cfaa3854ebc5520365f1acb569c87e7db1e21f4cddef73e2f4159ab955a37986bf9597c8cbee4c9e12112ebdc68945f3c307007882ba74b69945dfc6ffd40561eddd8af418cc00798598dbfe4c697272cd2bebe11fcf0c6750349210ec5e647c896013596385e5bce21943a51997bfa8d1441ec98d37fd612a2e8747ddfc32f2c7eb604318dc24eb55b813d32c9462e5dbd063ed3b2ee14b73c2ebe02a050c1120dd0b6cce3224201a22127d8244d5f341971ba08b6e4a29c3f740b3d5ac38d0ab1f3c389614f9b1ddfd64589b170cebedbfec4c6b873d296ca7eee55bac878a4e11b27a211db28cdc78f4404db5e9dd0b08a30b345b50991d9b7d3690bac4085e742876c602abe9cf7a64b3bc004083c71c17181f55ac6b46fa8e4cbc5c59a6a356207d2964d817a2b1753640dc91d9177c595086e1c7cf93421a4ef1cef87bb611ca7c0ba527b7c11a775f7ec4e1372f24da6bf368b25941e29a57c1acdcedfc0046207956797b4f70be7318b3441b190ba3ecd2d7b2448288a70553e2a8054500f9604fb5bd26f5547ca109891f125656deb1cd6c195f6335e64570564221d773d0e096dc6c788ca5e3a5f0d26aefbaacfec8dbc3f5961a9a281dc8f6925bd18573fc48ea5f9feca54f7d5637f7ac68c5c9df4760797b99324a323c4906e1e097e293f78716c67c9116bbc21e4ebb0f5b37e4271d690fd34636a3ae3a8e8a0009af79821e7e021cf6b95ae204ca73040aa57e9f66386e601c54bf997ccbd00857f9600b12dc0da720611f811e18072908c9669a84af6ca26a577f98d8303ccafb3bebbf4d0f4734cdad8718e6e8fb836e1b75da8e6dad930715df2a6ad9a0e16789c621457c184aee980420302a9ed00b5d240fed397d80da3a0416823a03a0a0d46fdb2f75c465a1366d9ea9d66b1c55898c2ab46c566cd52b6c850eeb0cffe15ae78dcdd59ee84f3432aee2d91f4db364e0afa333bcad1ec6c004555ee45fde06524eb170e7bf6e3f31b5889f739fe05f0124465b79ce63fd2d69893abf87d908e2bb7c5bcf23bd0566c6af2ee2b254751dc2e8d28a89588140c0de3f6f980ab7f6164b3d8321f5c3b8e8742dd0112bba2ad7dc3842095dba9f071ad5758240433b838918166bc464ffd6a658b99ff49454f7383c48a58605cccc18985628eb82fa744d018bd5a6ba953582a53b357e0670371fe61ce2a2044e31dcff376fabe4d18886783d2807cac1ef6afe90bcf87f991bddb0c312c93b445079d6cde4f0887698e804dc2ef6107ae0b86b41700a015b5192ef09167ff0283c87158c7ce6c19521427c2d70e4249a3166461a21ca5d4e503017177182a6f5df8bd0c51f93d3de37191e833d6b81ef73487077f003cae939f1060360566393145d9dd48489509eb6e16d40de3b14f6a688ab9116668ad64ec4dbcf051a0275cd18c0f65683351bfa2f516f307cfe72232bcdfa1c86c383ca1be1581d5a139cbf8acfff659517f315276c24f758cb00c6fec74e4b5c1f8a9c0cf4b158a606a138dd88494172889bec0e0eb8e9cc41d7db0ad3a7a160cfaa07ed5ce4d21c4a58dfb40cb544d4e7988eb521f3139c0ce6430c5ff342051a7447c0e4d8497cc7644ebb4af6f8b6687aabf7db57e383e8cc5268810fd6be6722fb3854b7468675a94310f5264cabe5c0a860ea23d6b3f7091f157298ea986cac138ef01f3486b35f051b072771bb907e93dc5862060996c735fa2ab0d07cc7e3cb7096af6d677fa861bd5c2118d4739608afc56bb4a6c4023ceab8ba3a0e058b531337da15f9a79a059185ab72614e08941463b40e394cb168a6281eb9cb73e4cf3ddc0e7df74cf2d772101dc822e912453af390b64c8bc9254efe5fefb4964c4960912a98e486349a01ae5f17443edaf6f7dc286e6e0ccd4067b04a9dc6904b74ce9888016b0d02a61a7a6ba26956e5f545708eea95d522ccfd842dd0ff0fcf64b6f72b50ce2b04012871e2338540adfd5fe740acae7c9e0a9774daeb9d1b5fb2e84080edf940a4d4faceb9eb59a8eb700cb42a5df11bab2bf85c2aa4532c2cd08e7dccd5eb0228e60e5ce244df69e5228bbc18170f4892b9f3abc42ff144ac5c449f6b2b314de7411cc80fb168e350dbd04cb5a57dd25060cd0ecc2b2a2fd538e7b8dbeba4cef089527735a0fba326dddf40a8be4a93e8f05babb775cfbfae48bb3bd546a53f2c3d396b37a29d99aafdddb1096a0fd6c04b57ea1021830c13135b3e63f729efa026b32372e940534d2db6b17f65addb2cbd4592b4b5a22a7dafc2b6d14270d3d9d6016e16ddc2d28a6ac62dc9050fed203e640496e275fd20f1d69d8dd8fe3284ad8cfce9b2f8f224e6d0dbee842bdef202c876bd3e530fecaaf2113fe6a34fb57b92e0b64d6428f75db1912a5d3fc12bbfa892701abb03a0c8ccf196469849fb6f38ad910f9bfbaad202719158d2d1552536019ef76f43b1b607640594de63975df4fa948a887bf0a427ac72ff040da05fd21c9ebe188bee992087933c1b17257155f34b7810fac836131b8f9fd2adee160bfb61ce0d97b6b5cdee852f719998f407832d63064e537a911d41eedd7c652657fa4bb46a81652b848d1e60e9a8487da77902e4952914b2d8b6e30acb2c1c8aef7d5d80eecbb6606590c7790d47e0ce42e11525f3bace921386c51a8f224c700e1027d241a7a1c836d4abc04202c4a25e81dcc9cb98326bf57743da64c757c39becec9e59354b95880b74c30a5078f3b1179e017d3e06d4772a7f9df370902d3bdd7e8cddaf9dc5f649a2955a3277463a0444d9719108e6395bdc2c1bcb16e8e3568e901f5b6061c93dd26f83e6d28da7284524380d31119d4810a4017c6e3ec2cfd62195d82ee8e4b89a6c4fb8d29b1e8bf7f866f3fbfb4d5ae58457c6431dcd80a7aea43ddb56b3efe17a920b83fc62fe303137f2ca4271d605847814438c9fdba31eb7b29a981a0c48833cc4bd71ee67aba497bb6d35784a228c433a19157c63a43d146a620c7ba49287c9bbb56f02151e5924159985a10e5f020ce6483c79fa56d4e5a1f379dde8dd7a59bb6f85eb45c2b57bfca57f79404eaba7025e1c9c6ea36fd5deab8daa597e7dba04fe0ae71ec62cf19662f246f77112ae371dce9675cd403bfaedd99b586cf071cd56a18b42bb416f681a63f3bf4ea2828a70eb5ac0f6bad69282df83c734da6e9068a3e5dd1977824442314da7b1fe4e75e9aaf46466a83414b83322dd2eb3f3b6e7f11f891d4a5a9d35e07a1f05ca3d7b688b3d9e96b30c07ccc8ece3918dde43257bcb5e80439a4f0fddd84538b44be730c9fe01e59f74e9a8c1b6776ad3e80f62387734563b8aa856c2448cfb5c80dd148f9e8d25c43086448dcd0b864da368ab6f18b7ebb527ec9085180b347535b7d1b15a63d31be0eacb5764263dc09b95da4fbf976d6d23392c84971fd7baf6bed1c77036fa2d46e1183a0c97b12853ef7ff585af534898ea9174449d543999c68fdd8844afb4f8a7f6c8830e608e6a8ef560bfab9bc0fafa8cf1505072fc12be3d54b1a3250cf9012051389f8f80a5572ccf6d379ab25318fe8856d7919991b6640480c27b62acddd9da4cb27abc5ec779aac29275d3e63af93f5da26b223483d413de8e05eaf9e8533c2a1ca46ffca4c1929f7278084404fe0624b90fbd48f53c18d249eeaf9efab0c90baaa4ccab1e64e7f243262dacb5fb4619c72b6c50564e35085d65ec03a9814b8adef94b055378331b96758cb83c7191e8b29fde03f68678efb0668fe303334464f975c670c9a434af9a950b1ebb3d4d3d79bab5e4ef227a2b52a6151fbdd13680dfa3047fb430b02f2beb91e8a41680842f23f4626d04ec6929ec67a30ae70d18e7252df54f3581f2969dd3ca822da7d6d2107d64a2cb6f6b16808172fe646aea2ddacca7824428aa8468a0f9ae80a991773b26830363c93e10976090fe9698d1c5454b9e9fc15b2356ff6d090fc020d1bdd528f37c8610109fd2a1cec4049497ba92ecef9b256f6699df7553045c46eb78cf36ea7d801c63863d4e9ad6e481cd59836e5da19911f5ebc170e3e13bfe70bda8f33294c9694c58fb5a4254f91e13488b2f2338475dbe15a7b089499a0b5a909936b67ddea5d1a249819485055e858a307e21397241c7700400def2d10b99adadb1bdb193a246952a19f4b78ce3b4a85d92c54717a9ae818e30bd768015c38c3c23e19443cf3d54e01c183d31e39c0a6cd76d1dcc1da444ef1444438fff085d5c5ad5c7009ff5d5b28ece85e991de04a2bc134ef27b06c873a3ba9f830b8ab1d8c18b7949b45f94b1af8211d88d3152af9f1602f8f9688159305b2262eb2635feef122e7d499fc30be8050fc8533f423c3fb7e8dd35bbbc60dd9c5bc564e51aa6a59b2cefe7129b96c876736594d67af9748e173cfd43fe488057895f3b596ef32524b1b629e4615e7e4ecdbb88b0fb7a07babc3f8bfbc23cd1953b9446b07e6abfa3075c25ebc40091a8d", 0x1000}, 0x1006) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x1c18) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) 04:31:16 executing program 2: r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x105001) ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0xcc17) perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x100, 0x0) ftruncate(r1, 0x0) [ 608.744335] binder: 26407:26418 unknown command 1108108047 [ 608.750133] binder: 26407:26418 ioctl c0306201 20012000 returned -22 [ 608.813193] binder: 26465 RLIMIT_NICE not set [ 608.818360] binder: 26407:26464 unknown command 536872576 [ 608.824186] binder: 26407:26464 ioctl c0306201 20008fd0 returned -22 [ 608.832744] binder: 26407:26465 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:31:16 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$NBD_CLEAR_QUE(r2, 0xab05) ioctl$TIOCNXCL(r2, 0x540d) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:31:17 executing program 5: mkdir(&(0x7f0000000780)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000800)='./file0\x00', &(0x7f0000f9cffb)='proc\x00', 0x0, 0x0) r0 = open(&(0x7f000054eff8)='./file0\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000e80)=""/1679, 0x68f) [ 608.992654] syz-executor5 (26459) used greatest stack depth: 53472 bytes left 04:31:17 executing program 2: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.stat\x00', 0x0, 0x0) recvmmsg(r0, &(0x7f0000000f40)=[{{&(0x7f0000000100)=@caif=@dgm, 0x80, &(0x7f00000002c0)=[{&(0x7f0000000200)=""/143, 0x8f}, {&(0x7f0000000180)}], 0x2, &(0x7f0000000300)=""/17, 0x11}, 0x1}, {{&(0x7f0000000340)=@vsock, 0x80, &(0x7f0000000500)=[{&(0x7f00000003c0)=""/192, 0xc0}, {&(0x7f0000000480)=""/128, 0x80}], 0x2, &(0x7f0000000540)=""/91, 0x5b}, 0x4}, {{&(0x7f00000005c0)=@ipx, 0x80, &(0x7f00000008c0)=[{&(0x7f0000000640)=""/236, 0xec}, {&(0x7f0000000740)=""/218, 0xda}, {&(0x7f0000000840)=""/96, 0x60}], 0x3, &(0x7f0000000900)=""/61, 0x3d}, 0x7}, {{&(0x7f0000000940)=@hci={0x1f, 0x0}, 0x80, &(0x7f0000000bc0)=[{&(0x7f00000009c0)=""/230, 0xe6}, {&(0x7f0000000ac0)=""/236, 0xec}], 0x2, &(0x7f0000000c00)=""/90, 0x5a}, 0x5}, {{&(0x7f0000000c80)=@ll={0x11, 0x0, 0x0}, 0x80, &(0x7f0000000ec0)=[{&(0x7f0000000d00)=""/170, 0xaa}, {&(0x7f0000000dc0)=""/110, 0x6e}, {&(0x7f0000000e40)=""/81, 0x51}], 0x3, &(0x7f0000000f00)=""/30, 0x1e}, 0xfae}], 0x5, 0x20, &(0x7f0000001080)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f00000010c0)={{{@in6=@remote, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}}}, &(0x7f00000011c0)=0xe8) sendmsg$nl_xfrm(r1, &(0x7f0000001340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000001300)={&(0x7f0000001780)=ANY=[@ANYBLOB="ec0000001b0000042bbd7000ff0000a99d48a695567867206000000000000000000000000000000000000000004e2000054e2407745aaaa3bef1a4f416b209b8c1b590029c5e0f7cc9a79f9fcd1d68fab12a245cf85dc17e9eed45931c73583b70494322fca9a1fe458a97a3186011a7b8fcd80ae2a419ad0d02eaa81afd35b9fcf87118b5509d40611581acb66c8b014bd64d5b8af62043856d17dc8c349267", @ANYRES32=r3, @ANYRES32=r5, @ANYBLOB="40000000000000000400000000000000d6000000000000008306000000000000030000000000000001000080000000005ac31b420000000001000000000000000f0076230000000001000000000000000200000000000000040000000000000004000000bd6b6e00010000030000000001000000000000000c0015005c073500000000000c0015005b0735000002000014000d0000000000000000000000000000000000"], 0x4}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000080) socketpair$unix(0x1, 0x80000000000001, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = syz_genetlink_get_family_id$team(&(0x7f0000001380)='team\x00') sendmsg$TEAM_CMD_OPTIONS_GET(r6, &(0x7f00000015c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000001580)={&(0x7f00000013c0)={0x1b0, r8, 0x2, 0x70bd2a, 0x25dfdbfd, {}, [{{0x8, 0x1, r4}, {0x194, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x7fffffff}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0xa7a2}}, {0x8, 0x6, r4}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffffffe}}, {0x8, 0x6, r3}}}, {0x5c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x2c, 0x4, [{0x6d1d, 0xe5, 0x9, 0x7bf}, {0xfffffffffffffffc, 0x800000000000000, 0x4, 0x400}, {0xc4f2, 0x8000, 0x1, 0x2}, {0x9, 0x78b, 0x7, 0x5}, {0x3c, 0x3dd3, 0x2, 0x8}]}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r2}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r3}}, {0x8}}}]}}]}, 0x1b0}, 0x1, 0x0, 0x0, 0x4000000}, 0x40) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) ftruncate(r7, 0x0) 04:31:17 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) [ 609.049071] binder: 26479 RLIMIT_NICE not set 04:31:17 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x2, 0x73) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x400, 0x0) getsockopt$bt_BT_POWER(r1, 0x112, 0x9, &(0x7f0000000040)=0x4, &(0x7f0000000080)=0x1) [ 609.081255] binder: 26478:26479 ioctl ab05 0 returned -22 [ 609.109746] binder: 26478:26479 ioctl 540d 0 returned -22 [ 609.155525] binder: 26478:26479 tried to acquire reference to desc 0, got 1 instead [ 609.200839] binder: 26491 RLIMIT_NICE not set [ 609.201986] binder: 26478:26487 unknown command 536872576 [ 609.210945] binder: 26478:26487 ioctl c0306201 20008fd0 returned -22 [ 609.234558] binder: 26478:26494 ioctl ab05 0 returned -22 [ 609.262477] binder: 26478:26491 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 609.301921] binder: 26478:26479 ioctl 540d 0 returned -22 04:31:17 executing program 0: openat$dsp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000900)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000380), 0x12) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$sndseq(r3, &(0x7f0000011fd2), 0xffffffee) read(r2, &(0x7f0000000000)=""/126, 0xfffffd6d) sendmsg(0xffffffffffffffff, 0x0, 0x0) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x400041, 0x0) 04:31:17 executing program 5: r0 = memfd_create(&(0x7f0000000040)='#em1#+\x00', 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r0, &(0x7f00000002c0)=ANY=[@ANYRES64=0x0], 0x8) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x80000000004, 0x11, r0, 0x0) clone(0x41fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f0000000100)) ptrace(0x10, r1) ptrace$setregset(0x4205, r1, 0x1, &(0x7f0000000000)={0x0}) 04:31:17 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) recvmsg$kcm(r1, &(0x7f0000001400)={&(0x7f0000000000)=@x25={0x9, @remote}, 0x80, &(0x7f0000001300)=[{&(0x7f0000000080)=""/79, 0x4f}, {&(0x7f0000000100)=""/61, 0x3d}, {&(0x7f0000000180)=""/160, 0xa0}, {&(0x7f0000000240)=""/168, 0xa8}, {&(0x7f0000000300)=""/4096, 0x1000}], 0x5, &(0x7f0000001380)=""/112, 0x70}, 0x1) 04:31:17 executing program 2: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_QUERY_BPF(r0, 0xc008240a, &(0x7f0000000100)={0x9, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ftruncate(r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EXT4_IOC_GROUP_EXTEND(r2, 0x40086607, &(0x7f0000000040)=0x1) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) ioctl$KVM_SET_LAPIC(r6, 0x4400ae8f, &(0x7f0000000380)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e3d63a98fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b5365c5dc26ca097ddda7c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df10010174a3ac8694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b2262d66ae793b6304a30b97077f1c131045cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f58e068af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b19eeb299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb56d9b962d2fc43fa01a047526865c888c9ff36056cc4ac258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d8191643"}) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r6, 0x4188aea7, &(0x7f0000000000)) getpid() dup2(r5, r6) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000000)) 04:31:17 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$radio(0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000003240)={0xffffffffffff0001}, 0x1) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) r2 = gettid() tkill(r2, 0x0) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r3, 0x40000000af01, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x0, 0x0) preadv(r3, &(0x7f00000003c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000180)) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) 04:31:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:31:17 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0x7) r1 = socket$inet6_sctp(0xa, 0x4000000000000001, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000540)={0x0, 0x1, 0x10}, 0xc) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) write(r1, &(0x7f0000000100), 0x10232) [ 609.796638] binder: 26533:26534 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 609.830255] binder: BINDER_SET_CONTEXT_MGR already set [ 609.835900] binder: 26533:26534 ioctl 40046207 0 returned -16 04:31:17 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffff9c, 0x84, 0xf, &(0x7f0000000040)={0x0, @in={{0x2, 0x4e20, @multicast2}}, 0x1ff, 0x1, 0x5, 0x3078, 0x3ff}, &(0x7f0000000100)=0x98) setsockopt$inet_sctp6_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000180)=@assoc_id=r2, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) socket$kcm(0x2, 0x2, 0x73) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f00000001c0)='dctcp\x00', 0x3b7) 04:31:17 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0xfffffffffffffffb, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ftruncate(r0, 0x0) [ 609.864364] binder: 26533:26538 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:31:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = accept4$inet(0xffffffffffffff9c, &(0x7f0000000040)={0x2, 0x0, @multicast1}, &(0x7f00000000c0)=0x10, 0x80800) getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffff9c, 0x84, 0xd, &(0x7f0000000100)=@assoc_value={0x0, 0x9}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp_SCTP_RTOINFO(r2, 0x84, 0x0, &(0x7f0000000180)={r3, 0x400, 0x1000, 0xffffffffffffffe0}, &(0x7f00000001c0)=0x10) r4 = dup(r1) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:31:18 executing program 2: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, 0x0, 0x0) write$evdev(r0, &(0x7f0000000040)=[{}, {}], 0x52a) [ 610.114810] binder: 26551 RLIMIT_NICE not set [ 610.153982] binder: 26550:26553 unknown command 536872576 [ 610.157599] binder: 26554 RLIMIT_NICE not set [ 610.159651] binder: 26550:26553 ioctl c0306201 20008fd0 returned -22 04:31:18 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000000)=[{0x28, 0x0, 0x0, 0xfffff034}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x1, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaaaaa9faa7bed30e186dd60093a0600080600fe8000000000000000000000000000bbff020000000000000000000000000001000000000008907849daf9fb98d019244e06f9e1fff6f6470e7106c7ef2289115351e6d796dfcee45112bd45dd1d85b512fafe30b04c2dcf970ccc0fd073593a27d350ce1d9f4976c1b6f038b3b36f22bdaa83004df1a2c7a3b97f2261bf78b8e7427cffc4b89fbbb558ef643022e16a8e76c0559c7f64fffee451f285644a297d5d114c21561929aebe6ddc5da7462094b4185816d75a76348e6679a22a8db27799648711295623ab787015f73a1b1880263ebbf6917ba7f9a4ec201ca77faa8d3c29031d12b65dcd48d33197"], 0x0) [ 610.239350] binder: 26550:26551 BC_DEAD_BINDER_DONE 0000000000000000 not found 04:31:18 executing program 0: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$alg(r1, &(0x7f0000007bc0)={0x0, 0x0, &(0x7f0000007a00)=[{&(0x7f0000007580)="c325f9e4ba29c5669e9998cffdef6b0a0fa09999fd36b67d310ac464ef3d571f852c1ceabe8b1ba028a6b16327964637381eeb6716192ae15eebeef0821ae6d5179c625c003860ef736336c6b22ef8eeee29fd21d8ac217910eb65a9b3e286170bebd4b9a015914626fed512649f2caa96a9b8de83f69db2de5f95", 0x7b}, {&(0x7f0000007600)="12def79becfac4a3ab480a2e3c8039160f011b4bb452ffffd23fc645bbc929a8b5e882aba80478e9db9594e7c495614f61c710872334bb0bab5133b731521675647ec442a6d4ef279e309db9b911c0d4425a18e7e2bacab20464a0efbd32a55af1df30ab58612fa9d6e9411bb067b509e42bd5036dbd32a958f0022ef581a6e82a9d73593ca56c0c31e360f56a2dea483abf3ebb806cb1854debaac8a487da914692ee3af571a33be5", 0xa9}, {&(0x7f00000076c0)="ffcb3347d401735a7b3d996a186ed160df514edfccd09afc351d374659c517eb4daeb82d075dc8cbb167f8f1d0d78e88f5de0cad990f7fe1b3f58f6ab6d0afa7dd637db05c76a368fc838be1e9d71387a8c832f88434e9b82d61ee45754a14edd62a46f7bbeb43b515c2cdd542d9a1692e25c714c987c48e54fca3299ec80d6684bfe8e060db09899de983796bb86eb1955d21ba1f6ead92445604a2f942ac4a58e8ca21072394a0625923996304f612660b9f083e241f671605ce40204e97acdb7664e7ad8d242d3ef20a67db58bfc4ef6fb479d072d683eb4869d99cc1dfd0ffc697dd3785a04b18c2e5e0a9d1", 0xee}, {&(0x7f00000077c0)="54fbfe7875c3aa568ae687875d97b1945b6a8ac611e14300445baacf2aa2180f3a28cd31def6b8b197d0f1996481ab8323ed378fbdd24401d8cfd6acb28f429fae545ca9cb83c2af6b91be586e712758f3ce77b8a8af197bb12c46e8e7da730ccda1d4d0e1a3bf53ba0ea781127dc5ead05f7830bc52d420447a1827d33603de58452dccd388", 0x86}, {&(0x7f0000007500)="fb2ec5b53cd730e153bf02b8b0c2b02ca8c5a2aeb3", 0x15}, {&(0x7f0000007880)="a26ef76bc7de433dff14bf92b744c3fafc4d65b6176570c74ca254d8a242c40f91dd00febf819a27fdcfe26d3332939f21ae0a596fd3ba", 0x37}, {&(0x7f00000078c0)="80e6945376051f1acf3038cd32b6dce6fc703f845a50be1640e0f9f9b8a753142ad0781122153cfc5bfbc7461f07e98310468ad6ca47283e58905ca565203cebeb274c55e33ab55c69f7bd3aa42fee329411455280c4430cf806e16476e44128e19b92772d2a0c18d502170fe96ee401ba0da8fa7089f68f1be886042e61f1dea9023716ae3284140aa7e3a58b1eec11578cd6da3f3f1476d6433c1efdec2526", 0xa0}, {&(0x7f0000007980)="5c1638af2b49cab888f1588ad4de3ebf83b296864c8b959e390d0a07cc05533e32b53c8fecce829a63b740965e95515691d68ee7fee59ad4c361ce1ee8ebd3195f0cf5f280814e6e45c75f0cc2ed69c6786c0b064dc843b4d44468fc3fa883d762575ab4eb35cfe8c3cf5d3fa3688d4d1812", 0x72}], 0x8, &(0x7f0000007a80)=[@assoc={0x18, 0x117, 0x4, 0xfffffffffffffffa}, @op={0x18, 0x117, 0x3, 0x1}, @iv={0xf8, 0x117, 0x2, 0xe1, "7b0bde84ee733e4fbc494d56d61bd0f9ed37431ff09b2a9f43a14d880659f0e26950676277f773ab33615c3a83d428cb482263e98e24fb2caf97ca8a54d635c2343e137fcf89cdacdfbddde9c16b913ec407449e754e2fd2cf4e8ed2d7c52f4e6b886e04df93dc8e15e8783b40b3cb7119bd4a26ebeae3e9e7c8bc3bfaa4e514670c4654ccfbeeb6cddebe8b98fef58004703fe81c0fba60c02f37876d815e3106f22f170f574ea49fc85f3a777a972583b447957e9c1514e4867f4570c4635f7863b8e0895a277d6f76a0fa699804306b6e233cd4228f8942773495236da4d1b2"}], 0x128, 0x20008090}, 0x24000005) r2 = openat$dsp(0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) dup3(r2, r0, 0x80000) mount(0x0, &(0x7f0000007540)='./file0\x00', &(0x7f0000007440)='fuse\x00', 0x0, 0x0) r3 = open(&(0x7f0000000900)='./file0\x00', 0x8282, 0x8) r4 = openat$cgroup_procs(r3, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000080), 0x12) getsockopt$inet6_mreq(r3, 0x29, 0x14, &(0x7f0000004b40), &(0x7f0000007480)=0x14) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000000, 0x80010, r4, 0x16) ftruncate(0xffffffffffffff9c, 0x733d) recvmmsg(r2, &(0x7f0000007240)=[{{&(0x7f0000000240)=@x25, 0x80, &(0x7f00000004c0)=[{&(0x7f00000002c0)=""/101, 0x65}, {&(0x7f0000000340)=""/142, 0x8e}, {&(0x7f0000000100)=""/3, 0x3}, {&(0x7f0000000400)=""/119, 0x77}, {&(0x7f0000000480)=""/48, 0x30}, {&(0x7f0000000940)=""/4096, 0x1000}], 0x6}, 0x7}, {{&(0x7f0000000540)=@vsock={0x28, 0x0, 0x0, @hyper}, 0x80, &(0x7f0000000680)=[{&(0x7f00000005c0)=""/93, 0x5d}, {&(0x7f0000000640)=""/25, 0x19}], 0x2, &(0x7f00000006c0)=""/234, 0xea}, 0x3ff}, {{0x0, 0x0, &(0x7f0000001bc0)=[{&(0x7f00000007c0)=""/224, 0xe0}, {&(0x7f0000001940)=""/217, 0xd9}, {&(0x7f00000008c0)=""/47, 0x2f}, {&(0x7f0000001a40)=""/9, 0x9}, {&(0x7f0000001a80)=""/90, 0x5a}, {&(0x7f0000001b00)=""/173, 0xad}], 0x6, &(0x7f0000001c40)}, 0x8000}, {{&(0x7f0000001c80)=@sco, 0x80, &(0x7f0000003300)=[{&(0x7f0000001d00)=""/227, 0xe3}, {&(0x7f0000001e00)=""/164, 0xa4}, {&(0x7f0000001ec0)=""/4096, 0x1000}, {&(0x7f0000002ec0)=""/250, 0xfa}, {&(0x7f0000002fc0)=""/127, 0x7f}, {&(0x7f0000003040)=""/156, 0x9c}, {&(0x7f0000003100)=""/53, 0x35}, {&(0x7f0000003140)=""/27, 0x1b}, {&(0x7f0000003180)=""/90, 0x5a}, {&(0x7f0000003200)=""/202, 0xca}], 0xa, &(0x7f00000033c0)=""/42, 0x2a}, 0x3}, {{&(0x7f0000003400)=@llc, 0x80, &(0x7f00000047c0)=[{&(0x7f0000003480)=""/90, 0x5a}, {&(0x7f0000003500)=""/244, 0xf4}, {&(0x7f0000003600)=""/4096, 0x1000}, {&(0x7f0000004600)=""/83, 0x53}, {&(0x7f0000004680)=""/33, 0x21}, {&(0x7f00000046c0)=""/140, 0x8c}, {&(0x7f0000004780)=""/55, 0x37}], 0x7, &(0x7f0000004840)=""/183, 0xb7}, 0x8}, {{&(0x7f0000004900)=@nfc_llcp, 0x80, &(0x7f0000005d00)=[{&(0x7f0000004980)=""/199, 0xc7}, {&(0x7f0000004a80)=""/119, 0x77}, {&(0x7f0000004b00)=""/20, 0x14}, {&(0x7f0000004b40)}, {&(0x7f0000004b80)=""/159, 0x9f}, {&(0x7f0000004c40)=""/168, 0xa8}, {&(0x7f0000004d00)=""/4096, 0x1000}], 0x7, &(0x7f0000005d80)=""/137, 0x89}, 0x5}, {{&(0x7f0000005e40)=@alg, 0x80, &(0x7f00000071c0)=[{&(0x7f0000005ec0)=""/139, 0x8b}, {&(0x7f0000005f80)=""/174, 0xae}, {&(0x7f0000006040)=""/211, 0xd3}, {&(0x7f0000006140)=""/4096, 0x1000}, {&(0x7f0000007140)=""/31, 0x1f}, {&(0x7f0000007180)=""/7, 0x7}], 0x6}, 0x5}], 0x7, 0x12000, &(0x7f0000007400)) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) lsetxattr$security_smack_transmute(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='security.SMACK64TRANSMUTE\x00', &(0x7f0000001c40)='TRUE', 0x4, 0x1) ioctl$TIOCMGET(r4, 0x5415, &(0x7f0000007c00)) openat$cgroup_ro(r2, &(0x7f00000074c0)='cpu.stat\x00', 0x0, 0x0) write$sndseq(r6, &(0x7f0000011fd2), 0xffffffee) write$P9_RWRITE(r2, &(0x7f0000007c40)={0xb, 0x77, 0x1, 0x5}, 0xb) read(r5, &(0x7f0000000000)=""/126, 0xfffffd6d) 04:31:18 executing program 5: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpgid(0x0) process_vm_writev(r0, &(0x7f0000000100)=[{&(0x7f00000002c0)=""/209, 0xd1}], 0x1, &(0x7f0000000600)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {&(0x7f0000001340)=""/4096, 0x1000}, {0x0}, {0x0}, {0x0}], 0x9, 0x0) 04:31:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x802) r2 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x1, 0x2) r3 = syz_open_dev$vcsn(&(0x7f00000000c0)='/dev/vcs#\x00', 0xc0, 0x400) ioctl$UDMABUF_CREATE(r2, 0x40187542, &(0x7f0000000100)={r3, 0x0, 0x8000, 0x2000}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r4 = dup(r1) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:31:18 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$kcm(0x2, 0x0, 0x73) semget$private(0x0, 0x1, 0x81) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x101000, 0x0) getsockopt$inet_sctp_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000040), &(0x7f0000000080)=0xb) socket$kcm(0x2, 0x2, 0x73) 04:31:18 executing program 2: r0 = socket(0x18, 0x2, 0x0) setsockopt(r0, 0x29, 0x2e, 0x0, 0x0) sendmsg(r0, &(0x7f00000003c0)={&(0x7f0000000000)=@in6, 0xc, 0x0, 0x0, &(0x7f0000000040), 0x10}, 0x0) [ 610.585294] binder: 26583 RLIMIT_NICE not set 04:31:18 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/\x00~WM\x00\x030\x80\x90\"\xcf\xde&U]\xc9\xec\xfe\x19t@n\xda\xd3\x83dx-c\xb6a(T\xb9\xe4\x9d\xbd\xca\xefq\x81\x97\xe3~\x87\n0\x8b\x1e:y\x8f\xa7\x88\xa4m0%\xef\x93>Q\x82\x8a\xb6u\x06N*\xdb\xe9\x12d#\xb4\xa7=h\xfb\xe9\x9cm\xb2\xf1`\xd4\x9c\xb6\xcc\xe7l\'(\x9aO\x9d\tsT\xaa\xa5\x86\r#\x83\xdf\x87Rk\xaa\x18M\x90\xbbw)6l\x17\xbc3\xd7e\xe9\xbc/\x88*\x13\xf3\xa9\xc1\xf6\x06`\xbdO\xd2\xfa1\xd2\xc0\xa7u$\"\x89\xbc\xe0b\xd1\r$\xde\xd5@i\x18\xa6k,u\xc4?\xe1\xffE\x8a\xe5\xcd\x9f\xecc\x03\x9b\xa5\xa7\xb6j`\xed\xe5\xcc\xda\xbc~\xe7v`\xef#X\xcc\xdf\xf0\"&\x02\x13\x84\xb0\xc25\xf1\x14\xed\x9a\xde\x92vz\xec\xc2V\xac\xde\xb6\x10\xdfB\xe7\x16\x9f$\x03W\xf75\xae_\xe2\x90\x17\xe5\x1e\'%/H\xb9[\xfb\xbb:\x86U5)\x8b\xdc6\xd7\x1d\xb65\xf4\x1cWw\x1d\xb7z\xea\xff\x88?\xeb=\xc3\xcc$\xbd<\x03n9j\xd3\xaf7\x94PX\x83\x9e\x81\"p\xbc@\x90\x1f\xa6T\xe7\xcc2\x92\xa8/\xc8\f7M\xc0qB\xa1\xc2\xe9\xd3\xe2R\x8eO\xda\xc3+\xca\xef\xe9\x10\xeb\xd3\xb9H\xa3\xbf\xeb\xef_\xa8\xd8$s\xc7\xfb\xf3\xec', 0x0, 0x0) getdents(r0, 0x0, 0x382) [ 610.644283] binder: 26581:26588 tried to acquire reference to desc 0, got 1 instead 04:31:18 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5, 0xb, 0xebe, 0x7df, 0x1}, 0x2c) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bc070") bpf$MAP_CREATE(0x2, &(0x7f00000000c0)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) [ 610.691956] binder: 26581:26588 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 610.774351] binder: 26581:26583 ioctl c0306201 2000dfd0 returned -11 04:31:18 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$kcm(0x2, 0x7, 0x73) socket$kcm(0x2, 0x2, 0x73) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000780)='/dev/sequencer2\x00', 0x8fd8df17ef2ba9b5, 0x0) write$UHID_CREATE2(r3, &(0x7f00000007c0)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x24, 0x9, 0x0, 0x3f, 0x2, 0x1, "068e8723cd5efcea3a66da776d02846e12663b99edb85d14fb03f381456ec591d1577a82"}, 0x13c) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000040)={{{@in6=@ipv4={[], [], @multicast1}, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@mcast1}}, &(0x7f0000000180)=0xe8) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) getresuid(&(0x7f0000000280)=0x0, &(0x7f00000002c0)=0x0, &(0x7f0000000300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000340)={{{@in, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@remote}}, &(0x7f0000000440)=0xe8) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480)={0x0, 0x0}, &(0x7f00000004c0)=0xc) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000500), &(0x7f0000000540)=0xc) lstat(&(0x7f0000000580)='./file0\x00', &(0x7f00000005c0)) lstat(&(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr$system_posix_acl(r0, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f0000000700)={{}, {0x1, 0x7}, [{0x2, 0x1, r4}, {0x2, 0x2, r5}, {0x2, 0x4, r6}, {0x2, 0x1, r8}, {0x2, 0x2, r9}, {0x2, 0x0, r9}, {0x2, 0x0, r7}], {0x4, 0x6}, [{0x8, 0x0, r10}], {0x10, 0x3}}, 0x64, 0x3) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000900)=""/6) 04:31:18 executing program 2: r0 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0adc1f023c123f3188a070") setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000340)=[@in6={0xa, 0x0, 0x0, @remote, 0x6}], 0x1c) getsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x6d, &(0x7f0000000000), &(0x7f00000000c0)=0xfd12) 04:31:18 executing program 5: r0 = socket$inet6(0xa, 0x2100000000000002, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @ipv4}, 0x1c) mlock(&(0x7f0000ffc000/0x4000)=nil, 0x4000) mremap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x8000000000000001}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6=@loopback, 0x0, 0x0, 0x0, 0x90}}, 0xe8) sendmsg(r0, &(0x7f0000001700)={0x0, 0x0, 0x0}, 0x0) 04:31:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) ioctl$FS_IOC_GETFSMAP(r1, 0xc0c0583b, &(0x7f0000000480)=ANY=[@ANYBLOB="000000000000000005000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000009000000d5a10000000000000700000000000000070000000000000001000100000000000000000000000000000000000000000000000000000000009f020000030000000700000000000000df00000000000000bd00000000000000fdffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d040f2ba9fca083c83bb97ad79074da1289104d1f02f13d4856c18413c0e5cc9594b52aaccef4257be512ac5e2515a066f8a1e294894f8357ded7b"]) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) 04:31:19 executing program 1: r0 = syz_open_dev$cec(&(0x7f0000000100)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x805c6103, &(0x7f00000000c0)) [ 611.031277] binder: 26614:26618 ioctl c0c0583b 20000480 returned -22 [ 611.064804] ================================================================== [ 611.071607] BUG: KMSAN: kernel-infoleak in _copy_to_user+0x16b/0x1f0 [ 611.071607] CPU: 0 PID: 26620 Comm: syz-executor2 Not tainted 4.20.0-rc7+ #2 [ 611.071607] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 611.071607] Call Trace: [ 611.071607] dump_stack+0x173/0x1d0 [ 611.071607] kmsan_report+0x12e/0x2a0 [ 611.071607] kmsan_internal_check_memory+0x455/0xb00 [ 611.071607] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 611.071607] kmsan_copy_to_user+0xab/0xc0 [ 611.071607] _copy_to_user+0x16b/0x1f0 [ 611.071607] sctp_getsockopt+0x164ef/0x17530 [ 611.071607] ? aa_sk_perm+0x605/0x950 [ 611.071607] ? aa_sock_opt_perm+0x121/0x270 [ 611.071607] ? sctp_setsockopt+0x12480/0x12480 [ 611.071607] sock_common_getsockopt+0x13f/0x180 [ 611.071607] ? sock_recv_errqueue+0x8f0/0x8f0 [ 611.071607] __sys_getsockopt+0x489/0x550 [ 611.071607] __se_sys_getsockopt+0xe1/0x100 [ 611.071607] __x64_sys_getsockopt+0x62/0x80 [ 611.071607] do_syscall_64+0xbc/0xf0 [ 611.071607] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 611.071607] RIP: 0033:0x457ec9 [ 611.071607] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 611.071607] RSP: 002b:00007f902a82cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 611.071607] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000457ec9 [ 611.071607] RDX: 000000000000006d RSI: 0000000000000084 RDI: 0000000000000003 [ 611.071607] RBP: 000000000073bfa0 R08: 00000000200000c0 R09: 0000000000000000 [ 611.071607] R10: 0000000020000000 R11: 0000000000000246 R12: 00007f902a82d6d4 [ 611.071607] R13: 00000000004c8d58 R14: 00000000004cf9e0 R15: 00000000ffffffff [ 611.071607] [ 611.071607] Uninit was stored to memory at: [ 611.071607] kmsan_internal_chain_origin+0x134/0x230 [ 611.071607] kmsan_memcpy_memmove_metadata+0x58f/0xfa0 [ 611.071607] kmsan_memcpy_metadata+0xb/0x10 [ 611.071607] __msan_memcpy+0x5b/0x70 [ 611.071607] sctp_getsockopt+0x16cee/0x17530 [ 611.071607] sock_common_getsockopt+0x13f/0x180 [ 611.071607] __sys_getsockopt+0x489/0x550 [ 611.071607] __se_sys_getsockopt+0xe1/0x100 [ 611.071607] __x64_sys_getsockopt+0x62/0x80 [ 611.071607] do_syscall_64+0xbc/0xf0 [ 611.071607] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 611.071607] [ 611.071607] Uninit was stored to memory at: [ 611.071607] kmsan_internal_chain_origin+0x134/0x230 [ 611.071607] kmsan_memcpy_memmove_metadata+0x58f/0xfa0 [ 611.071607] kmsan_memcpy_metadata+0xb/0x10 [ 611.071607] __msan_memcpy+0x5b/0x70 [ 611.071607] sctp_getsockopt+0x16b9a/0x17530 [ 611.071607] sock_common_getsockopt+0x13f/0x180 [ 611.071607] __sys_getsockopt+0x489/0x550 [ 611.071607] __se_sys_getsockopt+0xe1/0x100 [ 611.071607] __x64_sys_getsockopt+0x62/0x80 [ 611.071607] do_syscall_64+0xbc/0xf0 [ 611.071607] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 611.071607] [ 611.071607] Uninit was created at: [ 611.071607] kmsan_internal_poison_shadow+0x92/0x150 [ 611.071607] kmsan_kmalloc+0xa6/0x130 [ 611.071607] kmem_cache_alloc_trace+0x55a/0xb90 [ 611.071607] sctp_inet6addr_event+0x5c9/0xc10 [ 611.071607] atomic_notifier_call_chain+0x13d/0x240 [ 611.071607] inet6addr_notifier_call_chain+0x76/0x90 [ 611.071607] ipv6_add_addr+0x2361/0x2620 [ 611.071607] inet6_addr_add+0xc75/0x1bd0 [ 611.071607] inet6_rtm_newaddr+0x15be/0x3ab0 [ 611.071607] rtnetlink_rcv_msg+0x115b/0x1550 [ 611.071607] netlink_rcv_skb+0x444/0x640 [ 611.071607] rtnetlink_rcv+0x50/0x60 [ 611.071607] netlink_unicast+0xf40/0x1020 [ 611.071607] netlink_sendmsg+0x127f/0x1300 [ 611.071607] __sys_sendto+0x8c4/0xac0 [ 611.071607] __se_sys_sendto+0x107/0x130 [ 611.071607] __x64_sys_sendto+0x6e/0x90 [ 611.071607] do_syscall_64+0xbc/0xf0 [ 611.071607] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 611.071607] [ 611.071607] Bytes 32-35 of 2716 are uninitialized [ 611.071607] Memory access of size 2716 starts at ffff8881e15e0000 [ 611.071607] Data copied to user address 0000000020000008 [ 611.071607] ================================================================== [ 611.071607] Disabling lock debugging due to kernel taint [ 611.071607] Kernel panic - not syncing: panic_on_warn set ... [ 611.071607] CPU: 0 PID: 26620 Comm: syz-executor2 Tainted: G B 4.20.0-rc7+ #2 [ 611.481758] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 611.481758] Call Trace: [ 611.481758] dump_stack+0x173/0x1d0 [ 611.481758] panic+0x3ce/0x961 [ 611.481758] kmsan_report+0x293/0x2a0 [ 611.501891] kmsan_internal_check_memory+0x455/0xb00 [ 611.501891] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 611.501891] kmsan_copy_to_user+0xab/0xc0 [ 611.501891] _copy_to_user+0x16b/0x1f0 [ 611.522012] sctp_getsockopt+0x164ef/0x17530 [ 611.525744] ? aa_sk_perm+0x605/0x950 [ 611.525744] ? aa_sock_opt_perm+0x121/0x270 [ 611.534928] ? sctp_setsockopt+0x12480/0x12480 [ 611.534928] sock_common_getsockopt+0x13f/0x180 [ 611.534928] ? sock_recv_errqueue+0x8f0/0x8f0 [ 611.546910] __sys_getsockopt+0x489/0x550 [ 611.546910] __se_sys_getsockopt+0xe1/0x100 [ 611.546910] __x64_sys_getsockopt+0x62/0x80 [ 611.559366] do_syscall_64+0xbc/0xf0 [ 611.562859] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 611.562859] RIP: 0033:0x457ec9 [ 611.562859] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 611.581712] binder: 26614:26618 tried to acquire reference to desc 0, got 1 instead [ 611.562859] RSP: 002b:00007f902a82cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 611.562859] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000457ec9 [ 611.562859] RDX: 000000000000006d RSI: 0000000000000084 RDI: 0000000000000003 [ 611.562859] RBP: 000000000073bfa0 R08: 00000000200000c0 R09: 0000000000000000 [ 611.562859] R10: 0000000020000000 R11: 0000000000000246 R12: 00007f902a82d6d4 [ 611.562859] R13: 00000000004c8d58 R14: 00000000004cf9e0 R15: 00000000ffffffff [ 611.562859] Kernel Offset: disabled [ 611.562859] Rebooting in 86400 seconds..