xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:12 executing program 5: 20:15:12 executing program 1: r0 = socket$inet(0x2, 0x4020000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f00000001c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='ip6_vti0\x00', 0x8) shutdown(r0, 0x1) shutdown(r0, 0x1) [ 236.962042][ T9844] binder: 9843:9844 unknown command 255 20:15:12 executing program 0: 20:15:12 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 237.008750][ T9844] binder: 9843:9844 ioctl c0306201 200001c0 returned -22 20:15:12 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="0adc1f123c123f3188b070") socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0x3b, &(0x7f000059dffc), &(0x7f0000d8cffc)=0x4) 20:15:12 executing program 5: 20:15:12 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:12 executing program 0: 20:15:12 executing program 1: r0 = socket$inet(0x2, 0x4020000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f00000001c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='ip6_vti0\x00', 0x8) shutdown(r0, 0x1) shutdown(r0, 0x1) 20:15:12 executing program 4: r0 = syz_open_dev$video(0x0, 0x3, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:12 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="0adc1f123c123f3188b070") socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0x3b, &(0x7f000059dffc), &(0x7f0000d8cffc)=0x4) [ 237.256771][ T9873] binder: 9871:9873 unknown command 255 20:15:12 executing program 5: 20:15:12 executing program 0: [ 237.301519][ T9873] binder: 9871:9873 ioctl c0306201 200001c0 returned -22 20:15:12 executing program 4: r0 = syz_open_dev$video(0x0, 0x3, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:12 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0x3b, &(0x7f000059dffc), &(0x7f0000d8cffc)=0x4) 20:15:12 executing program 1: r0 = socket$inet(0x2, 0x4020000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f00000001c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='ip6_vti0\x00', 0x8) shutdown(r0, 0x1) shutdown(r0, 0x1) 20:15:12 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:12 executing program 5: 20:15:12 executing program 0: 20:15:12 executing program 1: r0 = socket$inet(0x2, 0x4020000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f00000001c0)={0x2, 0x4e23, @dev}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='ip6_vti0\x00', 0x8) shutdown(r0, 0x1) shutdown(r0, 0x1) 20:15:12 executing program 4: r0 = syz_open_dev$video(0x0, 0x3, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 237.515704][ T9897] binder: 9896:9897 unknown command 255 [ 237.544891][ T9897] binder: 9896:9897 ioctl c0306201 200001c0 returned -22 20:15:12 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0x3b, &(0x7f000059dffc), &(0x7f0000d8cffc)=0x4) 20:15:13 executing program 5: 20:15:13 executing program 0: 20:15:13 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:13 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x0, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:13 executing program 1: r0 = socket$inet(0x2, 0x4020000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f00000001c0)={0x2, 0x4e23, @dev}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='ip6_vti0\x00', 0x8) shutdown(r0, 0x1) shutdown(r0, 0x1) 20:15:13 executing program 5: 20:15:13 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0x3b, &(0x7f000059dffc), &(0x7f0000d8cffc)=0x4) [ 237.752925][ T9917] binder: 9916:9917 unknown command 255 [ 237.780418][ T9917] binder: 9916:9917 ioctl c0306201 200001c0 returned -22 20:15:13 executing program 0: 20:15:13 executing program 5: 20:15:13 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:13 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x0, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:13 executing program 1: r0 = socket$inet(0x2, 0x4020000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f00000001c0)={0x2, 0x4e23, @dev}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='ip6_vti0\x00', 0x8) shutdown(r0, 0x1) shutdown(r0, 0x1) 20:15:13 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0x3b, &(0x7f000059dffc), &(0x7f0000d8cffc)=0x4) [ 237.955013][ T9935] binder: 9933:9935 unknown command 255 20:15:13 executing program 5: [ 238.004547][ T9935] binder: 9933:9935 ioctl c0306201 200001c0 returned -22 20:15:13 executing program 0: 20:15:13 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:13 executing program 5: 20:15:13 executing program 1: r0 = socket$inet(0x2, 0x4020000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f00000001c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000000)='ip6_vti0\x00', 0x8) shutdown(r0, 0x1) shutdown(r0, 0x1) 20:15:13 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x0, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:13 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0x3b, &(0x7f000059dffc), &(0x7f0000d8cffc)=0x4) 20:15:13 executing program 5: 20:15:13 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(0xffffffffffffffff, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 238.203258][ T9953] binder: 9952:9953 unknown command 255 [ 238.232943][ T9953] binder: 9952:9953 ioctl c0306201 200001c0 returned -22 20:15:13 executing program 0: 20:15:13 executing program 1: r0 = socket$inet(0x2, 0x4020000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f00000001c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000000)='ip6_vti0\x00', 0x8) shutdown(r0, 0x1) shutdown(r0, 0x1) 20:15:13 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) [ 238.312820][ T7760] binder_thread_release: 12 callbacks suppressed [ 238.312831][ T7760] binder: release 9952:9953 transaction 135 out, still active 20:15:13 executing program 5: [ 238.379007][ T7760] binder_send_failed_reply: 12 callbacks suppressed [ 238.379015][ T7760] binder: send failed reply for transaction 135, target dead 20:15:13 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0x3b, &(0x7f000059dffc), &(0x7f0000d8cffc)=0x4) 20:15:13 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(0xffffffffffffffff, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:13 executing program 1: r0 = socket$inet(0x2, 0x4020000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f00000001c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000000)='ip6_vti0\x00', 0x8) shutdown(r0, 0x1) shutdown(r0, 0x1) [ 238.420707][ T9976] binder: 9975:9976 unknown command 255 [ 238.440627][ T9976] binder: 9975:9976 ioctl c0306201 200001c0 returned -22 20:15:13 executing program 0: 20:15:13 executing program 5: [ 238.500838][ T3759] binder: release 9975:9976 transaction 139 out, still active 20:15:13 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) [ 238.573310][ T3759] binder: send failed reply for transaction 139, target dead 20:15:14 executing program 0: 20:15:14 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(0xffffffffffffffff, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:14 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12") socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0x3b, &(0x7f000059dffc), &(0x7f0000d8cffc)=0x4) 20:15:14 executing program 1: r0 = socket$inet(0x2, 0x4020000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f00000001c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) shutdown(r0, 0x1) shutdown(r0, 0x1) 20:15:14 executing program 5: [ 238.645980][ T9993] binder: 9992:9993 unknown command 255 [ 238.655750][ T9993] binder: 9992:9993 ioctl c0306201 200001c0 returned -22 [ 238.674864][ T7760] binder: release 9992:9993 transaction 143 out, still active 20:15:14 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:14 executing program 0: [ 238.764343][ T3759] binder: send failed reply for transaction 143, target dead 20:15:14 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:14 executing program 5: 20:15:14 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12") socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0x3b, &(0x7f000059dffc), &(0x7f0000d8cffc)=0x4) 20:15:14 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:14 executing program 0: [ 238.885688][T10012] binder: 10011:10012 unknown command 255 [ 238.925622][T10012] binder: 10011:10012 ioctl c0306201 200001c0 returned -22 20:15:14 executing program 1: r0 = socket$inet(0x2, 0x4020000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f00000001c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) shutdown(r0, 0x1) shutdown(r0, 0x1) 20:15:14 executing program 5: 20:15:14 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12") socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0x3b, &(0x7f000059dffc), &(0x7f0000d8cffc)=0x4) [ 239.012855][ T3759] binder: release 10011:10012 transaction 147 out, still active 20:15:14 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b0") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) [ 239.067871][ T7760] binder: send failed reply for transaction 147, target dead 20:15:14 executing program 1: r0 = socket$inet(0x2, 0x4020000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f00000001c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) shutdown(r0, 0x1) shutdown(r0, 0x1) 20:15:14 executing program 5: 20:15:14 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:14 executing program 0: [ 239.159338][T10034] binder: 10033:10034 unknown command 255 [ 239.188945][T10034] binder: 10033:10034 ioctl c0306201 200001c0 returned -22 20:15:14 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188") socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0x3b, &(0x7f000059dffc), &(0x7f0000d8cffc)=0x4) 20:15:14 executing program 5: [ 239.231723][ T7760] binder: release 10033:10034 transaction 151 out, still active 20:15:14 executing program 0: 20:15:14 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:14 executing program 1: r0 = socket$inet(0x2, 0x4020000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f00000001c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='ip6_vti0\x00', 0x8) shutdown(0xffffffffffffffff, 0x1) shutdown(r0, 0x1) 20:15:14 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b0") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) [ 239.328685][ T7760] binder: send failed reply for transaction 151, target dead 20:15:14 executing program 0: 20:15:14 executing program 5: 20:15:14 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188") socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0x3b, &(0x7f000059dffc), &(0x7f0000d8cffc)=0x4) [ 239.421376][T10060] binder: 10059:10060 unknown command 255 [ 239.451242][T10060] binder: 10059:10060 ioctl c0306201 200001c0 returned -22 20:15:14 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:14 executing program 1: r0 = socket$inet(0x2, 0x4020000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f00000001c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='ip6_vti0\x00', 0x8) shutdown(0xffffffffffffffff, 0x1) shutdown(r0, 0x1) [ 239.486043][ T3759] binder: release 10059:10060 transaction 155 out, still active 20:15:14 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b0") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:15 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188") socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0x3b, &(0x7f000059dffc), &(0x7f0000d8cffc)=0x4) [ 239.586347][ T3759] binder: send failed reply for transaction 155, target dead 20:15:15 executing program 0: 20:15:15 executing program 5: 20:15:15 executing program 1: r0 = socket$inet(0x2, 0x4020000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f00000001c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='ip6_vti0\x00', 0x8) shutdown(0xffffffffffffffff, 0x1) shutdown(r0, 0x1) 20:15:15 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b0") socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0x3b, &(0x7f000059dffc), &(0x7f0000d8cffc)=0x4) [ 239.736374][T10085] binder: 10083:10085 unknown command 255 [ 239.750527][T10085] binder: 10083:10085 ioctl c0306201 200001c0 returned -22 20:15:15 executing program 0: 20:15:15 executing program 5: 20:15:15 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 239.781590][ T7760] binder: release 10083:10085 transaction 159 out, still active 20:15:15 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:15 executing program 1: r0 = socket$inet(0x2, 0x4020000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f00000001c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='ip6_vti0\x00', 0x8) shutdown(r0, 0x0) shutdown(r0, 0x1) [ 239.869244][ T3759] binder: send failed reply for transaction 159, target dead 20:15:15 executing program 0: 20:15:15 executing program 5: 20:15:15 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b0") socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0x3b, &(0x7f000059dffc), &(0x7f0000d8cffc)=0x4) 20:15:15 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, 0x0) 20:15:15 executing program 1: r0 = socket$inet(0x2, 0x4020000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f00000001c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='ip6_vti0\x00', 0x8) shutdown(r0, 0x0) shutdown(r0, 0x1) 20:15:15 executing program 0: 20:15:15 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:15 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b0") socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0x3b, &(0x7f000059dffc), &(0x7f0000d8cffc)=0x4) 20:15:15 executing program 5: 20:15:15 executing program 0: 20:15:15 executing program 1: r0 = socket$inet(0x2, 0x4020000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f00000001c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='ip6_vti0\x00', 0x8) shutdown(r0, 0x0) shutdown(r0, 0x1) 20:15:15 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:15 executing program 5: 20:15:15 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, 0x0) 20:15:15 executing program 0: 20:15:15 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0x3b, &(0x7f000059dffc), &(0x7f0000d8cffc)=0x4) 20:15:15 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:15 executing program 5: 20:15:15 executing program 1: r0 = socket$inet(0x2, 0x4020000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f00000001c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='ip6_vti0\x00', 0x8) shutdown(r0, 0x1) shutdown(0xffffffffffffffff, 0x1) 20:15:15 executing program 0: 20:15:15 executing program 5: 20:15:15 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0x3b, &(0x7f000059dffc), &(0x7f0000d8cffc)=0x4) [ 240.535980][T10156] binder_alloc: 10154: binder_alloc_buf, no vma 20:15:16 executing program 0: 20:15:16 executing program 1: r0 = socket$inet(0x2, 0x4020000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f00000001c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='ip6_vti0\x00', 0x8) shutdown(r0, 0x1) shutdown(0xffffffffffffffff, 0x1) 20:15:16 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, 0x0) [ 240.610760][T10156] binder: 10154:10156 transaction failed 29189/-3, size 24-8 line 3148 20:15:16 executing program 5: [ 240.689713][T10161] binder: 10154:10161 Release 1 refcount change on invalid ref 1 ret -22 20:15:16 executing program 0: 20:15:16 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0x3b, &(0x7f000059dffc), &(0x7f0000d8cffc)=0x4) [ 240.750969][T10161] binder: 10154:10161 unknown command 255 [ 240.780510][T10161] binder: 10154:10161 ioctl c0306201 200001c0 returned -22 20:15:16 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:16 executing program 1: r0 = socket$inet(0x2, 0x4020000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f00000001c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='ip6_vti0\x00', 0x8) shutdown(r0, 0x1) shutdown(0xffffffffffffffff, 0x1) 20:15:16 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x0, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:16 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") socketpair$unix(0x1, 0x3, 0x0, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3b, &(0x7f000059dffc), &(0x7f0000d8cffc)=0x4) 20:15:16 executing program 0: 20:15:16 executing program 5: 20:15:16 executing program 0: r0 = socket$packet(0x11, 0x2, 0x300) sendmmsg(r0, &(0x7f0000000140)=[{{&(0x7f0000000080)=@nfc={0x27, 0x1}, 0x80, 0x0}}, {{&(0x7f00000001c0)=@vsock, 0xc, 0x0}}], 0x2, 0x0) 20:15:16 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f0000000040)) [ 240.990522][T10197] binder_alloc: 10194: binder_alloc_buf, no vma 20:15:16 executing program 1: r0 = socket$inet(0x2, 0x4020000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f00000001c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='ip6_vti0\x00', 0x8) shutdown(r0, 0x1) shutdown(r0, 0x0) 20:15:16 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") socketpair$unix(0x1, 0x3, 0x0, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3b, &(0x7f000059dffc), &(0x7f0000d8cffc)=0x4) [ 241.030672][T10197] binder: 10194:10197 transaction failed 29189/-3, size 24-8 line 3148 [ 241.079756][T10197] binder: 10194:10197 Release 1 refcount change on invalid ref 1 ret -22 [ 241.109176][T10197] binder: 10194:10197 unknown command 255 [ 241.119765][T10197] binder: 10194:10197 ioctl c0306201 200001c0 returned -22 20:15:16 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r2 = creat(&(0x7f0000000300)='./file0\x00', 0x0) r3 = creat(0x0, 0x0) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) ftruncate(r4, 0x2081fc) fcntl$setstatus(r3, 0x4, 0x6100) write$cgroup_type(r3, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000200)={0x0, r2}) 20:15:16 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") socketpair$unix(0x1, 0x3, 0x0, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3b, &(0x7f000059dffc), &(0x7f0000d8cffc)=0x4) 20:15:16 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:16 executing program 1: r0 = socket$inet(0x2, 0x4020000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f00000001c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='ip6_vti0\x00', 0x8) shutdown(r0, 0x1) shutdown(r0, 0x0) 20:15:16 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x0, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:16 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SMI(r2, 0xaeb7) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000000)=0x3) ioctl$KVM_RUN(r2, 0xae80, 0x0) 20:15:16 executing program 5: [ 241.323396][T10224] binder_alloc: 10223: binder_alloc_buf, no vma [ 241.358493][T10224] binder: 10223:10224 transaction failed 29189/-3, size 24-8 line 3148 20:15:16 executing program 1: r0 = socket$inet(0x2, 0x4020000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f00000001c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='ip6_vti0\x00', 0x8) shutdown(r0, 0x1) shutdown(r0, 0x0) 20:15:16 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x0, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:16 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3b, &(0x7f000059dffc), &(0x7f0000d8cffc)=0x4) 20:15:16 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) [ 241.411566][T10234] binder: 10223:10234 Release 1 refcount change on invalid ref 1 ret -22 20:15:16 executing program 1: r0 = creat(&(0x7f0000000340)='./bus\x00', 0x0) write$9p(r0, &(0x7f0000000100)='f', 0x1) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x40000100000003, &(0x7f0000000200)=0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) io_submit(r1, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 241.482005][T10234] binder: 10223:10234 unknown command 255 [ 241.512603][T10234] binder: 10223:10234 ioctl c0306201 200001c0 returned -22 20:15:16 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:16 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3b, &(0x7f000059dffc), &(0x7f0000d8cffc)=0x4) [ 241.611356][T10254] binder_alloc: 10251: binder_alloc_buf, no vma [ 241.637886][T10254] binder: 10251:10254 transaction failed 29189/-3, size 24-8 line 3148 20:15:17 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) ioctl(r0, 0x800000000008982, &(0x7f0000000080)) [ 241.672881][T10261] binder: 10251:10261 Release 1 refcount change on invalid ref 1 ret -22 [ 241.703592][T10261] binder: 10251:10261 unknown command 255 20:15:17 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3b, &(0x7f000059dffc), &(0x7f0000d8cffc)=0x4) [ 241.717501][T10261] binder: 10251:10261 ioctl c0306201 200001c0 returned -22 20:15:17 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:17 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], 0x0}) 20:15:17 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:17 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x200, 0x0, 0x0, 0x0, 0x0) mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000400)='./file0\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000040)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) dup2(r0, r1) execve(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) r2 = open$dir(&(0x7f00000000c0)='./file0\x00', 0x841, 0x0) clone(0x3102001fe6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) io_setup(0x1, &(0x7f0000000080)=0x0) io_submit(r3, 0x1, &(0x7f0000000180)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r2, 0x0}]) 20:15:17 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0x0, &(0x7f000059dffc), &(0x7f0000d8cffc)=0x4) [ 241.930043][T10285] binder_alloc: 10281: binder_alloc_buf, no vma [ 241.968259][T10285] binder: 10281:10285 transaction failed 29189/-3, size 24-8 line 3148 20:15:17 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:17 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0x0, &(0x7f000059dffc), &(0x7f0000d8cffc)=0x4) [ 241.980718][T10290] binder: 10281:10290 Release 1 refcount change on invalid ref 1 ret -22 [ 242.008770][T10290] binder: 10281:10290 unknown command 255 [ 242.029975][T10290] binder: 10281:10290 ioctl c0306201 200001c0 returned -22 20:15:17 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:17 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0x0, &(0x7f000059dffc), &(0x7f0000d8cffc)=0x4) 20:15:17 executing program 1: r0 = creat(&(0x7f0000000340)='./bus\x00', 0x0) write$9p(r0, &(0x7f0000000100)='f', 0x1) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x40000100000003, &(0x7f0000000200)=0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) io_submit(r1, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 20:15:17 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], 0x0}) 20:15:17 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) [ 242.219785][T10313] binder_alloc: 10305: binder_alloc_buf, no vma [ 242.240032][T10313] binder: 10305:10313 transaction failed 29189/-3, size 24-8 line 3148 20:15:17 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0x3b, 0x0, &(0x7f0000d8cffc)) 20:15:17 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x13, 0x10, 0x3}, 0x2c) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0xb, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="00000000000000009500000000000000a1414c7b5580c17f9c5b61cc988a3051b6cde40966d466418ac1201313650b694dea506deb877b0ffee988c7c80ca3c57af09090675fb87c727d1a5cbbec3dd0494a4f64b99c24649e3e73d18c48bfbd9ebb24d53a97bc628d9de59adaf7a871e8"], 0x0, 0x5, 0x90, &(0x7f0000000200)=""/144, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x0, 0xe, 0x0, &(0x7f0000000000)="743d7d516f5b0e95d39148531a93", 0x0}, 0x28) ioctl$BLKIOOPT(0xffffffffffffffff, 0x1279, &(0x7f0000000180)) getsockopt$bt_l2cap_L2CAP_LM(0xffffffffffffffff, 0x6, 0x3, &(0x7f00000002c0), &(0x7f0000000400)=0x4) keyctl$describe(0x6, 0x0, &(0x7f00000005c0)=""/69, 0x45) 20:15:17 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], 0x0}) [ 242.270831][T10321] binder: 10305:10321 Release 1 refcount change on invalid ref 1 ret -22 [ 242.309709][T10321] binder: 10305:10321 unknown command 255 [ 242.339744][T10321] binder: 10305:10321 ioctl c0306201 200001c0 returned -22 20:15:17 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:17 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0x3b, 0x0, &(0x7f0000d8cffc)) 20:15:17 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:17 executing program 0: socketpair$unix(0x1, 0x400000001, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./file0\x00', 0x40, 0x0) mount$fuse(0x20000000, &(0x7f0000000180)='./file0\x00', 0x0, 0x2008007801, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x20026, &(0x7f00000001c0)=ANY=[@ANYBLOB=',fscontext=unconfined_u,fscontext=k']) 20:15:17 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$EVIOCGBITKEY(0xffffffffffffffff, 0x80404521, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0) write$binfmt_misc(r0, &(0x7f0000000400)=ANY=[@ANYBLOB='\x00\x00'], 0x2) 20:15:18 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0x3b, 0x0, &(0x7f0000d8cffc)) 20:15:18 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) [ 242.581718][T10344] binder: 10341:10344 transaction failed 29189/-22, size 24-8 line 2995 [ 242.647779][T10354] binder: 10341:10354 Release 1 refcount change on invalid ref 1 ret -22 20:15:18 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0x0, 0x0, [], @p_u8=0x0}}) 20:15:18 executing program 0: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x8001, 0x0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x484b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ftruncate(r1, 0x2008000) sendfile(r0, r1, 0x0, 0x80000000000e) [ 242.694931][T10354] binder: 10341:10354 unknown command 255 20:15:18 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/tcp6\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:15:18 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0x3b, &(0x7f000059dffc), 0x0) [ 242.755394][T10354] binder: 10341:10354 ioctl c0306201 200001c0 returned -22 20:15:18 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:18 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0x3b, &(0x7f000059dffc), 0x0) 20:15:18 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:18 executing program 0: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x8001, 0x0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x484b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ftruncate(r1, 0x2008000) sendfile(r0, r1, 0x0, 0x80000000000e) 20:15:18 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0x0, 0x0, [], @p_u8=0x0}}) [ 242.996701][T10380] binder: 10379:10380 transaction failed 29189/-22, size 24-8 line 2995 [ 243.036609][T10383] binder: 10379:10383 Release 1 refcount change on invalid ref 1 ret -22 20:15:18 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_CPUID(0xffffffffffffffff, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:18 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0x3b, &(0x7f000059dffc), 0x0) [ 243.099807][T10383] binder: 10379:10383 unknown command 255 20:15:18 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0x0, 0x0, [], @p_u8=0x0}}) 20:15:18 executing program 0: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x8001, 0x0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x484b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ftruncate(r1, 0x2008000) sendfile(r0, r1, 0x0, 0x80000000000e) [ 243.180416][T10383] binder: 10379:10383 ioctl c0306201 200001c0 returned -22 20:15:18 executing program 2: r0 = socket$inet(0x10, 0x3, 0x0) ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, 0x0) ioctl$sock_inet_udp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000300001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) [ 243.351368][T10407] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'. 20:15:19 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/tcp6\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:15:19 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:19 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_CPUID(0xffffffffffffffff, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:19 executing program 2: r0 = socket$rxrpc(0x21, 0x2, 0xa) connect$rxrpc(r0, &(0x7f0000000040)=@in4={0x21, 0x0, 0x2, 0xf, {0xa, 0x0, @broadcast}}, 0x24) 20:15:19 executing program 0: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)) 20:15:19 executing program 4: 20:15:19 executing program 4: [ 244.228089][T10415] binder: 10414:10415 transaction failed 29189/-22, size 24-8 line 2995 [ 244.268230][T10415] binder: 10414:10415 Release 1 refcount change on invalid ref 1 ret -22 20:15:19 executing program 2: [ 244.295969][T10415] binder: 10414:10415 unknown command 255 20:15:19 executing program 0: 20:15:19 executing program 4: r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r0, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="480000000000000014010000010000000000000000000000000000000000000000000000000000006201563401d1b2312e1135c0ac586502cf404481df3c57fa76b45c325ee6db43"], 0x48}, 0x0) 20:15:19 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_CPUID(0xffffffffffffffff, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) [ 244.347785][T10415] binder: 10414:10415 ioctl c0306201 200001c0 returned -22 20:15:19 executing program 2: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000740)='/dev/nullb0\x00', 0x0, 0x0) preadv(r0, 0x0, 0x0, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff8) sched_setscheduler(0x0, 0x0, 0x0) ioctl$EVIOCGBITKEY(0xffffffffffffffff, 0x80404521, 0x0) openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r1, 0x0) write$binfmt_misc(r1, &(0x7f0000000400)=ANY=[@ANYBLOB="000000008e9464a206bd25e188bc0994ddc3d9575e6dec2aa5588b8bff2e1c2222551fbc604e3e3b37d33db65ff8d115168aaccef4eeb7e1eb24c5700ebdff10ece5ca1f61e06965b298c8ce3dd02c68a147a8ec7063e732be04fec951f934879ed74cfde53d9a4f0dd315fd4b8b8ca68aa7d1b08841e555727e8c767ee245828827867edc7a1153576dd34779fce9ab868692959ceba04e576d3c530d6671d7f1e3a0389707d71c3366af65da074ad23cade2cecfaf942b0b4dd95b532479a7c2c73146d1e82cb0b679aa2aafadc8ff"], 0xd0) io_setup(0x101, &(0x7f0000000040)=0x0) io_submit(r2, 0x1, &(0x7f0000001540)=[&(0x7f0000000140)={0x3a000000, 0x2759, 0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}]) 20:15:20 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/tcp6\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:15:20 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:20 executing program 0: 20:15:20 executing program 5: openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r0, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r0, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:20 executing program 4: 20:15:20 executing program 2: 20:15:20 executing program 4: 20:15:20 executing program 2: [ 245.112397][T10457] binder: 10450:10457 Release 1 refcount change on invalid ref 1 ret -22 20:15:20 executing program 0: 20:15:20 executing program 5: openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r0, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r0, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) [ 245.162567][T10457] binder: 10450:10457 unknown command 255 [ 245.205106][T10457] binder: 10450:10457 ioctl c0306201 200001c0 returned -22 20:15:20 executing program 5: openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r0, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r0, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:20 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) [ 245.375862][T10475] binder: 10472:10475 unknown command 255 [ 245.406562][T10475] binder: 10472:10475 ioctl c0306201 200001c0 returned -22 20:15:21 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/tcp6\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:15:21 executing program 4: 20:15:21 executing program 2: 20:15:21 executing program 0: 20:15:21 executing program 5: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r1, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r1, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:21 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:21 executing program 0: 20:15:21 executing program 4: [ 245.938357][T10487] binder_thread_write: 1 callbacks suppressed [ 245.938372][T10487] binder: 10486:10487 Release 1 refcount change on invalid ref 1 ret -22 20:15:21 executing program 5: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r1, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r1, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:21 executing program 2: [ 245.990449][T10487] binder: 10486:10487 unknown command 255 [ 246.009636][T10487] binder: 10486:10487 ioctl c0306201 200001c0 returned -22 20:15:21 executing program 0: 20:15:21 executing program 4: 20:15:22 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:22 executing program 5: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r1, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r1, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:22 executing program 4: 20:15:22 executing program 2: 20:15:22 executing program 0: 20:15:22 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/tcp6\x00') preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:15:22 executing program 0: 20:15:22 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:22 executing program 4: 20:15:22 executing program 2: [ 246.747634][T10515] binder: 10514:10515 ioctl c0306201 0 returned -14 [ 246.768220][T10515] binder: 10514:10515 Release 1 refcount change on invalid ref 1 ret -22 20:15:22 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/tcp6\x00') preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:15:22 executing program 0: [ 246.831069][T10515] binder: 10514:10515 unknown command 255 [ 246.851618][T10515] binder: 10514:10515 ioctl c0306201 200001c0 returned -22 20:15:22 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:22 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:22 executing program 2: 20:15:22 executing program 4: 20:15:22 executing program 0: 20:15:22 executing program 2: 20:15:22 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/tcp6\x00') preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:15:22 executing program 4: 20:15:22 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) [ 247.107416][T10540] binder: 10537:10540 ioctl c0306201 0 returned -14 [ 247.131524][T10540] binder: 10537:10540 Release 1 refcount change on invalid ref 1 ret -22 [ 247.139989][T10540] binder: 10537:10540 unknown command 255 20:15:22 executing program 4: 20:15:22 executing program 2: 20:15:22 executing program 0: [ 247.230661][T10540] binder: 10537:10540 ioctl c0306201 200001c0 returned -22 20:15:22 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:22 executing program 5: openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r1, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r1, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:22 executing program 1: sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[]}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:15:22 executing program 0: 20:15:22 executing program 4: [ 247.417139][T10565] binder: 10564:10565 ioctl c0306201 0 returned -14 20:15:22 executing program 2: 20:15:22 executing program 5: openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r1, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r1, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:22 executing program 1: sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[]}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 247.465977][T10572] binder: 10564:10572 Release 1 refcount change on invalid ref 1 ret -22 20:15:22 executing program 0: 20:15:22 executing program 4: 20:15:23 executing program 2: [ 247.540113][T10572] binder: 10564:10572 unknown command 255 [ 247.560940][T10572] binder: 10564:10572 ioctl c0306201 200001c0 returned -22 20:15:23 executing program 5: openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r1, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r1, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:23 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:23 executing program 1: sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[]}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:15:23 executing program 0: 20:15:23 executing program 4: 20:15:23 executing program 2: 20:15:23 executing program 4: 20:15:23 executing program 1: r0 = syz_open_procfs(0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 247.819327][T10597] binder: 10596:10597 Release 1 refcount change on invalid ref 1 ret -22 20:15:23 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r1, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r1, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:23 executing program 0: [ 247.890562][T10597] binder: 10596:10597 unknown command 255 20:15:23 executing program 2: [ 247.935051][T10597] binder: 10596:10597 ioctl c0306201 200001c0 returned -22 20:15:23 executing program 1: r0 = syz_open_procfs(0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:15:23 executing program 0: 20:15:23 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:23 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r1, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r1, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:23 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = dup2(r0, r0) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0x14, "eda81e570182f74c02e2ca5ce82c52eb12c00f61"}, 0x20) 20:15:23 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:23 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000300)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) mknod$loop(&(0x7f0000000000)='./file0/file0/file0\x00', 0x0, 0xffffffffffffffff) llistxattr(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)=""/43, 0x2b) 20:15:23 executing program 1: r0 = syz_open_procfs(0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 248.131751][T10625] binder: 10624:10625 Release 1 refcount change on invalid ref 1 ret -22 [ 248.161284][T10625] binder: 10624:10625 unknown command 255 [ 248.174613][T10625] binder: 10624:10625 ioctl c0306201 200001c0 returned -22 20:15:23 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r1, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r1, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:23 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = dup2(r0, r0) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0x14, "eda81e570182f74c02e2ca5ce82c52eb12c00f61"}, 0x20) 20:15:23 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:23 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:23 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/tcp6\x00') sendmsg(0xffffffffffffffff, 0x0, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 248.381889][T10650] overlayfs: filesystem on './file0' not supported as upperdir [ 248.408826][T10653] binder: 10652:10653 Release 1 refcount change on invalid ref 1 ret -22 20:15:23 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = dup2(r0, r0) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0x14, "eda81e570182f74c02e2ca5ce82c52eb12c00f61"}, 0x20) 20:15:23 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(0xffffffffffffffff, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) [ 248.452067][T10653] binder: 10652:10653 unknown command 255 [ 248.470585][T10653] binder: 10652:10653 ioctl c0306201 200001c0 returned -22 20:15:23 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r1, &(0x7f0000000380)=ANY=[@ANYBLOB='|'], 0x1) write$binfmt_elf32(r1, &(0x7f00000003c0)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38}, [{}]}, 0x58) setsockopt$sock_int(r2, 0x1, 0x200000010, &(0x7f0000000040)=0x1, 0x4) recvmmsg(r2, &(0x7f0000002bc0)=[{{0x0, 0x0, &(0x7f0000002b00)=[{&(0x7f0000002a80)=""/95, 0x5f}], 0x1, &(0x7f0000000080)=""/62, 0x3e}}], 0x251, 0x0, 0x0) 20:15:23 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:23 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/tcp6\x00') sendmsg(0xffffffffffffffff, 0x0, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:15:24 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = dup2(r0, r0) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0x14, "eda81e570182f74c02e2ca5ce82c52eb12c00f61"}, 0x20) 20:15:24 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:24 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(0xffffffffffffffff, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:24 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/tcp6\x00') sendmsg(0xffffffffffffffff, 0x0, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 248.746414][T10678] binder: 10674:10678 Release 1 refcount change on invalid ref 1 ret -22 20:15:24 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/tcp6\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:15:24 executing program 4: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$UHID_SET_REPORT_REPLY(0xffffffffffffffff, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0x14, "eda81e570182f74c02e2ca5ce82c52eb12c00f61"}, 0x20) [ 248.806714][T10678] binder: 10674:10678 unknown command 255 [ 248.825715][T10678] binder: 10674:10678 ioctl c0306201 200001c0 returned -22 20:15:24 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(0xffffffffffffffff, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:24 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:24 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) [ 249.047835][T10708] binder: 10705:10708 Release 1 refcount change on invalid ref 1 ret -22 [ 249.084868][T10708] binder: 10705:10708 unknown command 255 [ 249.109541][T10708] binder: 10705:10708 ioctl c0306201 200001c0 returned -22 20:15:25 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r1, 0x40085511, 0x0) 20:15:25 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/tcp6\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:15:25 executing program 4: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$UHID_SET_REPORT_REPLY(0xffffffffffffffff, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0x14, "eda81e570182f74c02e2ca5ce82c52eb12c00f61"}, 0x20) 20:15:25 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, 0x0) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:25 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:25 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) [ 249.671466][T10722] binder: 10721:10722 Release 1 refcount change on invalid ref 1 ret -22 [ 249.679927][T10722] binder: 10721:10722 unknown command 255 20:15:25 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/tcp6\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 249.724076][T10722] binder: 10721:10722 ioctl c0306201 200001c0 returned -22 20:15:25 executing program 4: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$UHID_SET_REPORT_REPLY(0xffffffffffffffff, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0x14, "eda81e570182f74c02e2ca5ce82c52eb12c00f61"}, 0x20) 20:15:25 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r1, 0x4004551e, 0x0) 20:15:25 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, 0x0) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:25 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:25 executing program 1: syz_open_procfs(0x0, &(0x7f0000000000)='net/tcp6\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[]}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:15:25 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:25 executing program 4: r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) write$UHID_SET_REPORT_REPLY(r0, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0x14, "eda81e570182f74c02e2ca5ce82c52eb12c00f61"}, 0x20) 20:15:25 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r1, 0x4004551e, 0x0) [ 249.999706][T10752] binder: 10751:10752 got transaction with invalid offset (0, min 0 max 0) or object. 20:15:25 executing program 1: syz_open_procfs(0x0, &(0x7f0000000000)='net/tcp6\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[]}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:15:25 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, 0x0) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:25 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) [ 250.040507][T10752] binder: 10751:10752 transaction failed 29201/-22, size 0-8 line 3242 [ 250.065722][T10759] binder: 10751:10759 unknown command 255 20:15:25 executing program 4: r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) write$UHID_SET_REPORT_REPLY(r0, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0x14, "eda81e570182f74c02e2ca5ce82c52eb12c00f61"}, 0x20) [ 250.115791][T10759] binder: 10751:10759 ioctl c0306201 200001c0 returned -22 20:15:25 executing program 1: syz_open_procfs(0x0, &(0x7f0000000000)='net/tcp6\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[]}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:15:25 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r1, 0x4004551e, 0x0) [ 250.199397][ T7752] binder: undelivered TRANSACTION_ERROR: 29201 20:15:25 executing program 4: r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) write$UHID_SET_REPORT_REPLY(r0, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0x14, "eda81e570182f74c02e2ca5ce82c52eb12c00f61"}, 0x20) 20:15:25 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_CPUID(0xffffffffffffffff, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:25 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:25 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:25 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = dup2(r0, r0) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0x14, "eda81e570182f74c02e2ca5ce82c52eb12c00f61"}, 0x20) 20:15:25 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/tcp6\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[]}, 0x0) preadv(r0, 0x0, 0x0, 0x400000000000) 20:15:25 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r1, 0x4004551e, 0x0) [ 250.391949][T10785] binder: 10783:10785 got transaction with invalid offset (0, min 0 max 0) or object. [ 250.425358][T10785] binder: 10783:10785 transaction failed 29201/-22, size 0-8 line 3242 20:15:25 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_CPUID(0xffffffffffffffff, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:25 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/tcp6\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[]}, 0x0) preadv(r0, 0x0, 0x0, 0x400000000000) 20:15:25 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = dup2(r0, r0) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0x14, "eda81e570182f74c02e2ca5ce82c52eb12c00f61"}, 0x20) [ 250.542675][T10785] binder: 10783:10785 unknown command 255 20:15:26 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0x4004551e, 0x0) 20:15:26 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) [ 250.615239][T10785] binder: 10783:10785 ioctl c0306201 200001c0 returned -22 20:15:26 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_CPUID(0xffffffffffffffff, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:26 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = dup2(r0, r0) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0x14, "eda81e570182f74c02e2ca5ce82c52eb12c00f61"}, 0x20) [ 250.702342][ T7752] binder: undelivered TRANSACTION_ERROR: 29201 20:15:26 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:26 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/tcp6\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[]}, 0x0) preadv(r0, 0x0, 0x0, 0x400000000000) 20:15:26 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0x4004551e, 0x0) 20:15:26 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:26 executing program 2: openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r0, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r0, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:26 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = dup2(0xffffffffffffffff, r0) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0x14, "eda81e570182f74c02e2ca5ce82c52eb12c00f61"}, 0x20) 20:15:26 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/tcp6\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:15:26 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0x4004551e, 0x0) [ 250.930915][T10826] binder: 10823:10826 got transaction with invalid offset (0, min 0 max 0) or object. 20:15:26 executing program 2: openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r0, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r0, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) [ 250.997051][T10826] binder: 10823:10826 transaction failed 29201/-22, size 0-8 line 3242 [ 251.030372][T10835] binder_thread_write: 2 callbacks suppressed [ 251.030388][T10835] binder: 10823:10835 Release 1 refcount change on invalid ref 1 ret -22 20:15:26 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r0, 0x4004551e, 0x0) 20:15:26 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = dup2(0xffffffffffffffff, r0) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0x14, "eda81e570182f74c02e2ca5ce82c52eb12c00f61"}, 0x20) 20:15:26 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) [ 251.211820][T10835] binder: 10823:10835 unknown command 255 [ 251.224167][T10835] binder: 10823:10835 ioctl c0306201 200001c0 returned -22 20:15:26 executing program 2: openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r0, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r0, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:26 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0xd71a, 0x0) ioctl$VIDIOC_CROPCAP(r0, 0xc0cc5640, &(0x7f0000000040)={0xa}) 20:15:26 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r0, 0x4004551e, 0x0) [ 251.284441][ T3759] binder: undelivered TRANSACTION_ERROR: 29201 20:15:26 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:26 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = dup2(0xffffffffffffffff, r0) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0x14, "eda81e570182f74c02e2ca5ce82c52eb12c00f61"}, 0x20) 20:15:26 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:26 executing program 1: r0 = socket$vsock_dgram(0x28, 0x2, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x20000000000000e6, 0x0) 20:15:26 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r0, 0x4004551e, 0x0) 20:15:26 executing program 2: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r1, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r1, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) [ 251.404339][T10869] binder: 10868:10869 got transaction with invalid offset (0, min 0 max 0) or object. [ 251.420458][T10869] binder: 10868:10869 transaction failed 29201/-22, size 0-8 line 3242 [ 251.451708][T10879] binder: 10868:10879 Release 1 refcount change on invalid ref 1 ret -22 20:15:26 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = dup2(r0, 0xffffffffffffffff) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0x14, "eda81e570182f74c02e2ca5ce82c52eb12c00f61"}, 0x20) [ 251.519602][T10879] binder: 10868:10879 unknown command 255 [ 251.548891][T10879] binder: 10868:10879 ioctl c0306201 200001c0 returned -22 20:15:26 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:27 executing program 2: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r1, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r1, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:27 executing program 0: ioctl(0xffffffffffffffff, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r0 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r0, 0x4004551e, 0x0) [ 251.584827][ T2997] binder: undelivered TRANSACTION_ERROR: 29201 20:15:27 executing program 1: r0 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0xa, &(0x7f0000000080)=0xffffefffffffffff, 0x4) 20:15:27 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:27 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = dup2(r0, 0xffffffffffffffff) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0x14, "eda81e570182f74c02e2ca5ce82c52eb12c00f61"}, 0x20) 20:15:27 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa00"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:27 executing program 2: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r1, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r1, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:27 executing program 1: r0 = socket$rxrpc(0x21, 0x2, 0xa) connect$rxrpc(r0, &(0x7f0000000100)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @ipv4={[], [], @remote}}}, 0x24) sendto$rxrpc(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 20:15:27 executing program 0: ioctl(0xffffffffffffffff, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r0 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r0, 0x4004551e, 0x0) [ 251.781716][T10909] binder: 10907:10909 got transaction with invalid offset (0, min 0 max 0) or object. [ 251.847598][T10909] binder: 10907:10909 transaction failed 29201/-22, size 0-8 line 3242 [ 251.883298][T10922] binder: 10907:10922 Release 1 refcount change on invalid ref 1 ret -22 20:15:27 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:27 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = dup2(r0, 0xffffffffffffffff) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0x14, "eda81e570182f74c02e2ca5ce82c52eb12c00f61"}, 0x20) 20:15:27 executing program 1: r0 = socket$rxrpc(0x21, 0x2, 0xa) connect$rxrpc(r0, &(0x7f0000000100)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @ipv4={[], [], @remote}}}, 0x24) sendto$rxrpc(r0, 0x0, 0x0, 0x0, 0x0, 0x0) [ 251.925623][T10922] binder: 10907:10922 unknown command 255 [ 251.951005][T10922] binder: 10907:10922 ioctl c0306201 200001c0 returned -22 20:15:27 executing program 0: ioctl(0xffffffffffffffff, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r0 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r0, 0x4004551e, 0x0) 20:15:27 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa00"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) [ 252.002586][ T2997] binder: undelivered TRANSACTION_ERROR: 29201 20:15:27 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:27 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:27 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) dup2(r0, r0) write$UHID_SET_REPORT_REPLY(0xffffffffffffffff, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0x14, "eda81e570182f74c02e2ca5ce82c52eb12c00f61"}, 0x20) 20:15:27 executing program 1: r0 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_FREE_MR(r0, 0x114, 0x3, &(0x7f0000000080)={{0x0, 0x6}}, 0x10) [ 252.154708][T10945] binder: 10944:10945 got transaction with invalid offset (0, min 0 max 0) or object. [ 252.171309][T10945] binder: 10944:10945 transaction failed 29201/-22, size 0-8 line 3242 20:15:27 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r0 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r0, 0x4004551e, 0x0) [ 252.200373][T10950] binder: 10944:10950 Release 1 refcount change on invalid ref 1 ret -22 [ 252.261860][T10950] binder: 10944:10950 unknown command 255 20:15:27 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa00"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:27 executing program 1: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ftruncate(r0, 0x9e) semget$private(0x0, 0x3ffffffffffffd, 0x803fe) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000680)='/dev/vcs\x00', 0x2000, 0x0) openat$cgroup_type(r1, &(0x7f00000006c0)='cgroup.type\x00', 0x2, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000140)='./file1\x00', 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e23, 0x0, @empty, 0x2000000000}, 0x1c) getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(r3, 0x84, 0x74, &(0x7f0000000500)=""/177, &(0x7f00000003c0)=0xb1) setxattr$trusted_overlay_redirect(&(0x7f0000000600)='./file1\x00', &(0x7f0000000240)='trusted.overlay.redirect\x00', &(0x7f0000000380)='./file1/../file0\x00', 0xfffffffffffffc59, 0x1) r4 = syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x6) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000340)={0x0, r2, 0x0, 0xb, &(0x7f0000000300)='/dev/midi#\x00'}, 0x30) listen(r3, 0x200000000002) r6 = socket$inet6(0xa, 0x5, 0x0) mkdir(&(0x7f0000001000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000343ff8)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x0, &(0x7f0000000100)='M\x06\xc4\x06\xbac\xb8\x83\x8b\xc9\x14\n\x82\xf2\xd5\x9a\xe6\xcb\xabo]\x8d\xee\xe0\xdd\xed\xf1s\r\'\xef,v') setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f00000000c0)={0x43, 0x4}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)={0x0, 0xe769, 0xfffffffffffffff9, 0x8, 0x12, r6, 0x3}, 0x2c) bind$inet6(r6, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}, 0x7ff}, 0x1c) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000400)={{{@in=@multicast1, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000080)=0xe8) r8 = syz_open_procfs(r5, &(0x7f0000000640)='n\b\x00\x00\x00\x00\x00\x00\x00') pread64(r8, 0x0, 0x0, 0xfffffffffffffffc) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f0000000100)={'team0\x00', r7}) ioctl$BINDER_SET_MAX_THREADS(r4, 0x40046205, 0x531) lsetxattr$security_smack_entry(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='security.SMACK64IPIN\x00', &(0x7f0000000180)='/dev/midi#\x00', 0xb, 0x3fffffffffffffff) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r6, 0x84, 0x6b, &(0x7f0000000000)=[@in={0x2, 0x4e23, @local}], 0x10) getsockopt$inet_sctp_SCTP_RTOINFO(r4, 0x84, 0x0, 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) renameat2(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0) 20:15:27 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) [ 252.308553][T10950] binder: 10944:10950 ioctl c0306201 200001c0 returned -22 [ 252.336734][ T7752] binder: undelivered TRANSACTION_ERROR: 29201 20:15:27 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) dup2(r0, r0) write$UHID_SET_REPORT_REPLY(0xffffffffffffffff, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0x14, "eda81e570182f74c02e2ca5ce82c52eb12c00f61"}, 0x20) 20:15:27 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:27 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa000000000040000300000100"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:27 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r0 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r0, 0x4004551e, 0x0) 20:15:27 executing program 2: openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r1, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r1, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:27 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) dup2(r0, r0) write$UHID_SET_REPORT_REPLY(0xffffffffffffffff, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0x14, "eda81e570182f74c02e2ca5ce82c52eb12c00f61"}, 0x20) [ 252.537659][T10978] binder: 10977:10978 got transaction with invalid offset (0, min 0 max 24) or object. [ 252.618876][T10978] binder: 10977:10978 transaction failed 29201/-22, size 24-8 line 3242 20:15:28 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r0 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r0, 0x4004551e, 0x0) 20:15:28 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa000000000040000300000100"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) [ 252.681344][T10990] binder: 10977:10990 Release 1 refcount change on invalid ref 1 ret -22 20:15:28 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = dup2(r0, r0) write$UHID_SET_REPORT_REPLY(r1, 0x0, 0x0) 20:15:28 executing program 2: openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r1, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r1, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) [ 252.729840][T10990] binder: 10977:10990 unknown command 255 [ 252.762615][T10990] binder: 10977:10990 ioctl c0306201 200001c0 returned -22 20:15:28 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$kcm(0x2b, 0x200000000000001, 0x0) setsockopt$sock_attach_bpf(r1, 0x6, 0xd, &(0x7f00000000c0), 0x3d9) 20:15:28 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = dup2(r0, r0) write$UHID_SET_REPORT_REPLY(r1, 0x0, 0x0) 20:15:28 executing program 2: openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r1, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r1, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:28 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r1, 0x4004551e, 0x0) 20:15:28 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:28 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa000000000040000300000100"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) [ 253.206295][T11016] binder: 11015:11016 got transaction with invalid offset (0, min 0 max 24) or object. [ 253.237030][T11016] binder: 11015:11016 transaction failed 29201/-22, size 24-8 line 3242 20:15:28 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r1, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r1, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:28 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = dup2(r0, r0) write$UHID_SET_REPORT_REPLY(r1, 0x0, 0x0) [ 253.264662][T11028] binder: 11015:11028 Release 1 refcount change on invalid ref 1 ret -22 [ 253.285627][T11028] binder: 11015:11028 unknown command 255 20:15:28 executing program 1: pipe(0x0) bind(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) getpgrp(0x0) ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f0000000000)) [ 253.340329][T11028] binder: 11015:11028 ioctl c0306201 200001c0 returned -22 20:15:28 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r1, 0x4004551e, 0x0) 20:15:28 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa000000000040000300000100000005000000"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:28 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = dup2(r0, r0) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000080), 0xc) 20:15:28 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:28 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r1, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r1, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) [ 253.537943][T11054] binder: 11052:11054 got transaction with invalid offset (0, min 0 max 24) or object. 20:15:29 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r1, 0x4004551e, 0x0) 20:15:29 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='io\x00') write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) sendto$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) fsetxattr$security_selinux(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) write$P9_RSTATFS(r0, 0x0, 0x0) 20:15:29 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = dup2(r0, r0) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000080), 0xc) [ 253.584668][T11054] binder: 11052:11054 transaction failed 29201/-22, size 24-8 line 3242 [ 253.600560][T11059] binder: 11052:11059 Release 1 refcount change on invalid ref 1 ret -22 [ 253.647575][T11059] binder: 11052:11059 unknown command 255 [ 253.659083][T11059] binder: 11052:11059 ioctl c0306201 200001c0 returned -22 20:15:29 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa000000000040000300000100000005000000"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:29 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x10000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000100)={r0, 0x18000000000002a0, 0x3a, 0x0, &(0x7f0000000040)="b90703e6680d698cb89e40f02cead5dc57ee41dea43e63a377fb8a1d1788e8ad30d84648a27f11c72be949eb4be1977d486a72d7363417ef6c90", 0x0, 0xfc}, 0x28) 20:15:29 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r1, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r1, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:29 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:29 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, 0x0) r1 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r1, 0x4004551e, 0x0) 20:15:29 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = dup2(r0, r0) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000080), 0xc) 20:15:29 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @empty}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='lo\x00', 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f0000000500)=0x8000, 0x4) sendto$inet(r0, 0x0, 0x0, 0x1000000020000000, &(0x7f0000000080)={0x2, 0x4e20}, 0x10) 20:15:29 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa000000000040000300000100000005000000"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) [ 253.896770][T11085] binder: 11084:11085 Release 1 refcount change on invalid ref 1 ret -22 [ 253.926164][T11085] binder: 11084:11085 unknown command 255 [ 253.939758][T11085] binder: 11084:11085 ioctl c0306201 200001c0 returned -22 20:15:29 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, 0x0) r1 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r1, 0x4004551e, 0x0) 20:15:29 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(0xffffffffffffffff, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) [ 253.976102][ T7760] binder: release 11084:11085 transaction 208 out, still active [ 253.998404][ T7760] binder: undelivered TRANSACTION_COMPLETE 20:15:29 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = dup2(r0, r0) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0xa, "eda81e570182f74c02e2"}, 0x16) 20:15:29 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) [ 254.024391][T11100] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 254.065039][ T7760] binder: send failed reply for transaction 208, target dead 20:15:29 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, 0x0) r1 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r1, 0x4004551e, 0x0) 20:15:29 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = dup2(r0, r0) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0xa, "eda81e570182f74c02e2"}, 0x16) [ 254.164131][T11112] binder: 11110:11112 Release 1 refcount change on invalid ref 1 ret -22 20:15:29 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b7"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:29 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(0xffffffffffffffff, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) [ 254.228206][T11112] binder: 11110:11112 unknown command 255 20:15:29 executing program 1: r0 = socket$inet6(0xa, 0x80002, 0x0) sendmmsg(r0, &(0x7f0000008a40)=[{{&(0x7f00000000c0)=@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0xc}}, 0x80, &(0x7f0000000140)=[{&(0x7f00000002c0)="9af1ccfd1b7bcda2b51d60b73b0a006eacc7098d30cd", 0x16}], 0x1}, 0x40a3}], 0x1, 0x800) [ 254.276284][T11112] binder: 11110:11112 ioctl c0306201 200001c0 returned -22 [ 254.315227][ T7752] binder: release 11110:11112 transaction 210 out, still active 20:15:29 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)) r1 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r1, 0x4004551e, 0x0) 20:15:29 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = dup2(r0, r0) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0xa, "eda81e570182f74c02e2"}, 0x16) [ 254.331222][ T7752] binder: undelivered TRANSACTION_COMPLETE 20:15:29 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) [ 254.410931][ T7752] binder: send failed reply for transaction 210, target dead 20:15:29 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b7"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:29 executing program 1: openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) fcntl$F_GET_RW_HINT(0xffffffffffffffff, 0x40b, &(0x7f0000000080)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000880)={0xa, 0x4e24, 0x0, @loopback}, 0xffffffffffffff33) fremovexattr(0xffffffffffffffff, &(0x7f0000000340)=@known='system.sockprotoname\x00') sched_setattr(0x0, 0x0, 0x0) r0 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'sit0\x00', 0x0}) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) ioctl$UI_SET_FFBIT(0xffffffffffffffff, 0x4004556b, 0x0) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r0, &(0x7f0000000d00), 0x400004e, 0x0) 20:15:29 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(0xffffffffffffffff, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:29 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)) r1 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r1, 0x4004551e, 0x0) [ 254.543631][T11137] binder: 11134:11137 Release 1 refcount change on invalid ref 1 ret -22 20:15:30 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = dup2(r0, r0) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0xf, "eda81e570182f74c02e2ca5ce82c52"}, 0x1b) [ 254.599971][T11137] binder: 11134:11137 unknown command 255 [ 254.627995][T11137] binder: 11134:11137 ioctl c0306201 200001c0 returned -22 [ 254.670551][ T7760] binder: release 11134:11137 transaction 212 out, still active [ 254.684017][ T7760] binder: undelivered TRANSACTION_COMPLETE 20:15:30 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:30 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)) r1 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r1, 0x4004551e, 0x0) [ 254.722290][ T7760] binder: send failed reply for transaction 212, target dead 20:15:30 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, 0x0) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:30 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b7"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) [ 254.896991][T11160] binder: 11157:11160 unknown command 255 [ 254.927631][T11160] binder: 11157:11160 ioctl c0306201 200001c0 returned -22 20:15:30 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, 0x0) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:30 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = dup2(r0, r0) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0xf, "eda81e570182f74c02e2ca5ce82c52"}, 0x1b) [ 254.957241][ T7752] binder: release 11157:11160 transaction 214 out, still active [ 254.985412][ T7752] binder: undelivered TRANSACTION_COMPLETE 20:15:30 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c12") r1 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r1, 0x4004551e, 0x0) 20:15:30 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) [ 255.022847][ T7752] binder: send failed reply for transaction 214, target dead 20:15:30 executing program 1: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)) sync() r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_ADD(r1, 0x4c80, 0x0) pwritev(r0, &(0x7f0000001b40)=[{&(0x7f0000001ac0)="1767e69e73c5f75490930dc386445da9bda15ba87b5315a72718188b4d6ca69b692b139be6d40d40b392d9991d403b3c4bb635432f6dbf69808a31ac75ea6ff1e3", 0x41}], 0x1, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) r2 = socket(0x11, 0x3, 0x81) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'sit0\x00', 0x0}) bind$packet(r2, &(0x7f0000000040)={0x11, 0xfffffffffffffffd, r3, 0x1, 0x0, 0x6, @broadcast}, 0x14) 20:15:30 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:30 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = dup2(r0, r0) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0xf, "eda81e570182f74c02e2ca5ce82c52"}, 0x1b) [ 255.119577][T11177] binder: 11176:11177 unknown command 255 [ 255.147413][T11177] binder: 11176:11177 ioctl c0306201 200001c0 returned -22 20:15:30 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, 0x0) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) [ 255.234094][ T7752] binder: release 11176:11177 transaction 216 out, still active 20:15:30 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c12") r1 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r1, 0x4004551e, 0x0) 20:15:30 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:30 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = dup2(r0, r0) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0x12, "eda81e570182f74c02e2ca5ce82c52eb12c0"}, 0x1e) [ 255.298243][ T7752] binder: undelivered TRANSACTION_COMPLETE [ 255.323897][ T7752] binder: send failed reply for transaction 216, target dead [ 255.398962][T11201] binder: 11200:11201 unknown command 255 20:15:30 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:30 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c12") r1 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r1, 0x4004551e, 0x0) 20:15:30 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:30 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = dup2(r0, r0) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0x12, "eda81e570182f74c02e2ca5ce82c52eb12c0"}, 0x1e) [ 255.439585][T11201] binder: 11200:11201 ioctl c0306201 200001c0 returned -22 [ 255.472712][ T2997] binder: release 11200:11201 transaction 218 out, still active 20:15:30 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188") r1 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r1, 0x4004551e, 0x0) [ 255.491434][ T2997] binder: undelivered TRANSACTION_COMPLETE [ 255.526820][ T2997] binder: send failed reply for transaction 218, target dead 20:15:31 executing program 1: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)) sync() r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_ADD(r1, 0x4c80, 0x0) pwritev(r0, &(0x7f0000001b40)=[{&(0x7f0000001ac0)="1767e69e73c5f75490930dc386445da9bda15ba87b5315a72718188b4d6ca69b692b139be6d40d40b392d9991d403b3c4bb635432f6dbf69808a31ac75ea6ff1e3", 0x41}], 0x1, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) r2 = socket(0x11, 0x3, 0x81) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'sit0\x00', 0x0}) bind$packet(r2, &(0x7f0000000040)={0x11, 0xfffffffffffffffd, r3, 0x1, 0x0, 0x6, @broadcast}, 0x14) 20:15:31 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:31 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = dup2(r0, r0) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0x12, "eda81e570182f74c02e2ca5ce82c52eb12c0"}, 0x1e) 20:15:31 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188") r1 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r1, 0x4004551e, 0x0) 20:15:31 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:31 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) [ 255.905355][T11234] binder: 11225:11234 unknown command 255 [ 255.948074][T11234] binder: 11225:11234 ioctl c0306201 200001c0 returned -22 [ 255.973171][ T2997] binder: release 11225:11234 transaction 220 out, still active 20:15:31 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = dup2(r0, r0) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0x13, "eda81e570182f74c02e2ca5ce82c52eb12c00f"}, 0x1f) 20:15:31 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:31 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188") r1 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r1, 0x4004551e, 0x0) 20:15:31 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:31 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) [ 256.006130][ T2997] binder: undelivered TRANSACTION_COMPLETE [ 256.045153][ T2997] binder: send failed reply for transaction 220, target dead 20:15:31 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = dup2(r0, r0) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0x13, "eda81e570182f74c02e2ca5ce82c52eb12c00f"}, 0x1f) [ 256.246327][ T2997] binder: release 11252:11256 transaction 224 out, still active [ 256.262519][ T2997] binder: unexpected work type, 4, not freed [ 256.288269][ T2997] binder: undelivered TRANSACTION_COMPLETE 20:15:31 executing program 1: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)) sync() r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_ADD(r1, 0x4c80, 0x0) pwritev(r0, &(0x7f0000001b40)=[{&(0x7f0000001ac0)="1767e69e73c5f75490930dc386445da9bda15ba87b5315a72718188b4d6ca69b692b139be6d40d40b392d9991d403b3c4bb635432f6dbf69808a31ac75ea6ff1e3", 0x41}], 0x1, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) r2 = socket(0x11, 0x3, 0x81) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'sit0\x00', 0x0}) bind$packet(r2, &(0x7f0000000040)={0x11, 0xfffffffffffffffd, r3, 0x1, 0x0, 0x6, @broadcast}, 0x14) 20:15:31 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:31 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:31 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:31 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b0") r1 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r1, 0x4004551e, 0x0) 20:15:31 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = dup2(r0, r0) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000080)={0xe, 0x0, 0x0, 0x0, 0x13, "eda81e570182f74c02e2ca5ce82c52eb12c00f"}, 0x1f) [ 256.329054][ T2997] binder: send failed reply for transaction 224, target dead [ 256.440522][ T7760] binder: release 11266:11267 transaction 228 out, still active [ 256.448222][ T7760] binder: unexpected work type, 4, not freed [ 256.477375][ T7760] binder: undelivered TRANSACTION_COMPLETE 20:15:31 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:31 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b0") r1 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r1, 0x4004551e, 0x0) 20:15:31 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) [ 256.490466][ T7760] binder: send failed reply for transaction 228, target dead 20:15:31 executing program 4: r0 = open(&(0x7f0000000600)='./bus\x00', 0x800, 0x35) ioctl$KDSKBMETA(r0, 0x4b63, &(0x7f0000000200)=0x7) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xed}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) rmdir(&(0x7f00000008c0)='./bus\x00') r2 = socket$inet6(0xa, 0xffffffffffffffff, 0x1) r3 = fcntl$getown(r2, 0x9) ptrace$pokeuser(0x6, r3, 0x7fe, 0x2) ioctl(r2, 0x8912, &(0x7f00000005c0)='\x00\x00\x00') remap_file_pages(&(0x7f0000fee000/0xf000)=nil, 0xf000, 0x0, 0x74f, 0x0) r4 = creat(&(0x7f00000002c0)='./bus\x00', 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f00000006c0)=ANY=[@ANYBLOB="4edc9825dab8a2dab9f640724a7b3ac3df64b0a8003a5beb9932eaef73d561c61bd54ce5544f622b992b3a88ff5e6de0cfc82d6f51da2f24070a6d41f542cea210168ebbf71369865951bc2f60c24425f5ffc44289f04aa55ccdf4368029f5a526a4413788ed8f2e7a2d19028fe94bb33919b6b42c76ad9d9df88a72ead92bfadf4cfdd2074927fb04924b2e654e1156f6dbbe241ee08de28851ed9381971e16c9b85df4e1f97f103ce8ff5a01f5eadd9e504598f86e056e0b9064cad904b147c2e6404d0f867e9607c93e23f6"], 0xcd) mkdir(&(0x7f0000000680)='./bus\x00', 0x22) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000440)={0x2}, 0x8) r5 = socket$inet6(0xa, 0x3, 0x6) syz_genetlink_get_family_id$tipc2(0x0) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x801) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xcf, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000880)={@remote, 0x800, 0x0, 0x3, 0x1, 0x0, 0x10001}, 0x20) fcntl$setownex(r4, 0xf, &(0x7f0000000180)={0x2, r3}) fsetxattr$trusted_overlay_redirect(r2, &(0x7f00000007c0)='trusted.overlay.redirect\x00', &(0x7f0000000400)='./bus\x00', 0xffffffffffffff69, 0x2) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) ioctl$TIOCLINUX5(r1, 0x541c, 0x0) socket$inet6(0xa, 0x0, 0x3ff) clock_nanosleep(0x0, 0x0, 0x0, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') sendfile(r5, r6, &(0x7f00000000c0)=0x202, 0x8) [ 256.558504][ T7760] binder: release 11281:11283 transaction 232 out, still active [ 256.591052][ T7760] binder: unexpected work type, 4, not freed [ 256.597067][ T7760] binder: undelivered TRANSACTION_COMPLETE 20:15:32 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:32 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) [ 256.635579][T11291] mmap: syz-executor.4 (11291) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. [ 256.673831][ T7760] binder: send failed reply for transaction 232, target dead [ 256.771377][T11300] binder: 11299:11300 ioctl c0306201 0 returned -14 [ 256.795738][ T26] audit: type=1804 audit(1554754532.182:35): pid=11291 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir578806771/syzkaller.B0xS3i/172/bus" dev="sda1" ino=16520 res=1 [ 256.820505][ T7760] binder: unexpected work type, 4, not freed [ 256.876352][ T26] audit: type=1804 audit(1554754532.182:36): pid=11291 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir578806771/syzkaller.B0xS3i/172/bus" dev="sda1" ino=16520 res=1 20:15:32 executing program 1: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'sit0\x00'}) 20:15:32 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b0") r1 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r1, 0x4004551e, 0x0) 20:15:32 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) 20:15:32 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, 0x0) 20:15:32 executing program 4: r0 = open(&(0x7f0000000600)='./bus\x00', 0x800, 0x35) ioctl$KDSKBMETA(r0, 0x4b63, &(0x7f0000000200)=0x7) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xed}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) rmdir(&(0x7f00000008c0)='./bus\x00') r2 = socket$inet6(0xa, 0xffffffffffffffff, 0x1) r3 = fcntl$getown(r2, 0x9) ptrace$pokeuser(0x6, r3, 0x7fe, 0x2) ioctl(r2, 0x8912, &(0x7f00000005c0)='\x00\x00\x00') remap_file_pages(&(0x7f0000fee000/0xf000)=nil, 0xf000, 0x0, 0x74f, 0x0) r4 = creat(&(0x7f00000002c0)='./bus\x00', 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f00000006c0)=ANY=[@ANYBLOB="4edc9825dab8a2dab9f640724a7b3ac3df64b0a8003a5beb9932eaef73d561c61bd54ce5544f622b992b3a88ff5e6de0cfc82d6f51da2f24070a6d41f542cea210168ebbf71369865951bc2f60c24425f5ffc44289f04aa55ccdf4368029f5a526a4413788ed8f2e7a2d19028fe94bb33919b6b42c76ad9d9df88a72ead92bfadf4cfdd2074927fb04924b2e654e1156f6dbbe241ee08de28851ed9381971e16c9b85df4e1f97f103ce8ff5a01f5eadd9e504598f86e056e0b9064cad904b147c2e6404d0f867e9607c93e23f6"], 0xcd) mkdir(&(0x7f0000000680)='./bus\x00', 0x22) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000440)={0x2}, 0x8) r5 = socket$inet6(0xa, 0x3, 0x6) syz_genetlink_get_family_id$tipc2(0x0) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x801) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xcf, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000880)={@remote, 0x800, 0x0, 0x3, 0x1, 0x0, 0x10001}, 0x20) fcntl$setownex(r4, 0xf, &(0x7f0000000180)={0x2, r3}) fsetxattr$trusted_overlay_redirect(r2, &(0x7f00000007c0)='trusted.overlay.redirect\x00', &(0x7f0000000400)='./bus\x00', 0xffffffffffffff69, 0x2) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) ioctl$TIOCLINUX5(r1, 0x541c, 0x0) socket$inet6(0xa, 0x0, 0x3ff) clock_nanosleep(0x0, 0x0, 0x0, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') sendfile(r5, r6, &(0x7f00000000c0)=0x202, 0x8) 20:15:32 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) [ 257.037870][T11321] binder: 11320:11321 ioctl c0306201 0 returned -14 20:15:32 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = syz_open_dev$usb(0x0, 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r1, 0x4004551e, 0x0) 20:15:32 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, 0x0) 20:15:32 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa00"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) [ 257.081555][ T3759] binder: unexpected work type, 4, not freed 20:15:32 executing program 4: r0 = open(&(0x7f0000000600)='./bus\x00', 0x800, 0x35) ioctl$KDSKBMETA(r0, 0x4b63, &(0x7f0000000200)=0x7) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xed}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) rmdir(&(0x7f00000008c0)='./bus\x00') r2 = socket$inet6(0xa, 0xffffffffffffffff, 0x1) r3 = fcntl$getown(r2, 0x9) ptrace$pokeuser(0x6, r3, 0x7fe, 0x2) ioctl(r2, 0x8912, &(0x7f00000005c0)='\x00\x00\x00') remap_file_pages(&(0x7f0000fee000/0xf000)=nil, 0xf000, 0x0, 0x74f, 0x0) r4 = creat(&(0x7f00000002c0)='./bus\x00', 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f00000006c0)=ANY=[@ANYBLOB="4edc9825dab8a2dab9f640724a7b3ac3df64b0a8003a5beb9932eaef73d561c61bd54ce5544f622b992b3a88ff5e6de0cfc82d6f51da2f24070a6d41f542cea210168ebbf71369865951bc2f60c24425f5ffc44289f04aa55ccdf4368029f5a526a4413788ed8f2e7a2d19028fe94bb33919b6b42c76ad9d9df88a72ead92bfadf4cfdd2074927fb04924b2e654e1156f6dbbe241ee08de28851ed9381971e16c9b85df4e1f97f103ce8ff5a01f5eadd9e504598f86e056e0b9064cad904b147c2e6404d0f867e9607c93e23f6"], 0xcd) mkdir(&(0x7f0000000680)='./bus\x00', 0x22) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000440)={0x2}, 0x8) r5 = socket$inet6(0xa, 0x3, 0x6) syz_genetlink_get_family_id$tipc2(0x0) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x801) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xcf, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000880)={@remote, 0x800, 0x0, 0x3, 0x1, 0x0, 0x10001}, 0x20) fcntl$setownex(r4, 0xf, &(0x7f0000000180)={0x2, r3}) fsetxattr$trusted_overlay_redirect(r2, &(0x7f00000007c0)='trusted.overlay.redirect\x00', &(0x7f0000000400)='./bus\x00', 0xffffffffffffff69, 0x2) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) ioctl$TIOCLINUX5(r1, 0x541c, 0x0) socket$inet6(0xa, 0x0, 0x3ff) clock_nanosleep(0x0, 0x0, 0x0, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') sendfile(r5, r6, &(0x7f00000000c0)=0x202, 0x8) 20:15:32 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) 20:15:32 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = syz_open_dev$usb(0x0, 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r1, 0x4004551e, 0x0) 20:15:32 executing program 1: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r0 = gettid() syz_open_procfs(r0, 0x0) r1 = gettid() tkill(r1, 0x38) [ 257.380872][T11338] binder: 11337:11338 ioctl c0306201 0 returned -14 [ 257.420545][ T7760] binder: unexpected work type, 4, not freed 20:15:32 executing program 1: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x1, &(0x7f0000000000)=ANY=[@ANYBLOB="5000000090780000"], 0x0) 20:15:32 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 20:15:32 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa00"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:32 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, 0x0) 20:15:33 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = syz_open_dev$usb(0x0, 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r1, 0x4004551e, 0x0) 20:15:33 executing program 4: r0 = open(&(0x7f0000000600)='./bus\x00', 0x800, 0x35) ioctl$KDSKBMETA(r0, 0x4b63, &(0x7f0000000200)=0x7) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xed}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) rmdir(&(0x7f00000008c0)='./bus\x00') r2 = socket$inet6(0xa, 0xffffffffffffffff, 0x1) r3 = fcntl$getown(r2, 0x9) ptrace$pokeuser(0x6, r3, 0x7fe, 0x2) ioctl(r2, 0x8912, &(0x7f00000005c0)='\x00\x00\x00') remap_file_pages(&(0x7f0000fee000/0xf000)=nil, 0xf000, 0x0, 0x74f, 0x0) r4 = creat(&(0x7f00000002c0)='./bus\x00', 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f00000006c0)=ANY=[@ANYBLOB="4edc9825dab8a2dab9f640724a7b3ac3df64b0a8003a5beb9932eaef73d561c61bd54ce5544f622b992b3a88ff5e6de0cfc82d6f51da2f24070a6d41f542cea210168ebbf71369865951bc2f60c24425f5ffc44289f04aa55ccdf4368029f5a526a4413788ed8f2e7a2d19028fe94bb33919b6b42c76ad9d9df88a72ead92bfadf4cfdd2074927fb04924b2e654e1156f6dbbe241ee08de28851ed9381971e16c9b85df4e1f97f103ce8ff5a01f5eadd9e504598f86e056e0b9064cad904b147c2e6404d0f867e9607c93e23f6"], 0xcd) mkdir(&(0x7f0000000680)='./bus\x00', 0x22) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000440)={0x2}, 0x8) r5 = socket$inet6(0xa, 0x3, 0x6) syz_genetlink_get_family_id$tipc2(0x0) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x801) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xcf, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000880)={@remote, 0x800, 0x0, 0x3, 0x1, 0x0, 0x10001}, 0x20) fcntl$setownex(r4, 0xf, &(0x7f0000000180)={0x2, r3}) fsetxattr$trusted_overlay_redirect(r2, &(0x7f00000007c0)='trusted.overlay.redirect\x00', &(0x7f0000000400)='./bus\x00', 0xffffffffffffff69, 0x2) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) ioctl$TIOCLINUX5(r1, 0x541c, 0x0) socket$inet6(0xa, 0x0, 0x3ff) clock_nanosleep(0x0, 0x0, 0x0, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') sendfile(r5, r6, &(0x7f00000000c0)=0x202, 0x8) [ 257.687102][ T7760] binder: unexpected work type, 4, not freed 20:15:33 executing program 1: 20:15:33 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x0, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r1, 0x4004551e, 0x0) 20:15:33 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 20:15:33 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa00"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:33 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[]) 20:15:33 executing program 1: [ 257.884367][ T3759] binder: unexpected work type, 4, not freed 20:15:33 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x0, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r1, 0x4004551e, 0x0) 20:15:33 executing program 4: 20:15:33 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 20:15:33 executing program 1: 20:15:33 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa000000000040000300000100"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:33 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[]) [ 258.098935][ T3759] binder: unexpected work type, 4, not freed 20:15:33 executing program 4: 20:15:33 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x0, 0x8000000100079) ioctl$KVM_CREATE_VCPU(r1, 0x4004551e, 0x0) 20:15:33 executing program 1: 20:15:33 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000b80)=ANY=[], 0x0, 0x0, 0x0}) 20:15:33 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[]) 20:15:33 executing program 4: 20:15:33 executing program 1: 20:15:33 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0x4004551e, 0x0) 20:15:33 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa000000000040000300000100"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) [ 258.294172][ T7760] binder: unexpected work type, 4, not freed 20:15:33 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000b80)=ANY=[], 0x0, 0x0, 0x0}) 20:15:33 executing program 1: 20:15:33 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0x4004551e, 0x0) 20:15:33 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB]) [ 258.492292][ T7760] binder: unexpected work type, 4, not freed 20:15:33 executing program 4: 20:15:34 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000b80)=ANY=[], 0x0, 0x0, 0x0}) 20:15:34 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa000000000040000300000100"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:34 executing program 1: 20:15:34 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0x4004551e, 0x0) 20:15:34 executing program 4: 20:15:34 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB]) [ 258.756803][ T3759] binder: unexpected work type, 4, not freed 20:15:34 executing program 4: 20:15:34 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 20:15:34 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa000000000040000300000100000005000000"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:34 executing program 1: r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0xffffffffffffffff, 0x2) ioctl$VIDIOC_G_FREQUENCY(r0, 0xc02c5638, &(0x7f0000000040)={0x1ff}) 20:15:34 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0x4004551e, 0x0) 20:15:34 executing program 4: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, 0x0, 0xfffffe8a, 0x20000000, &(0x7f0000000000)={0xa, 0x4e22}, 0x26) close(r1) accept4(r2, 0x0, 0x0, 0x800) splice(r1, 0x0, r0, 0x0, 0xd51, 0x0) [ 258.930984][ T7760] binder: unexpected work type, 4, not freed 20:15:34 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 20:15:34 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB]) [ 259.054886][ C0] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 20:15:34 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r1, 0x5411, &(0x7f0000000000)) 20:15:34 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa000000000040000300000100000005000000"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:34 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0x4004551e, 0x0) 20:15:34 executing program 4: syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0xffffffffffffffff, 0x2) r0 = dup2(0xffffffffffffff9c, 0xffffffffffffffff) ioctl$KDSKBMETA(0xffffffffffffffff, 0x4b63, 0x0) socket$unix(0x1, 0x5, 0x0) semget$private(0x0, 0x2, 0x244) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(0xffffffffffffffff, 0xc4c85513, &(0x7f0000000e40)={{0x0, 0x0, 0x0, 0x0, '\x00', 0x5ba78a22}, 0x0, [0xbbe, 0x4, 0x8, 0x401, 0x1000, 0x2, 0x2, 0xffffffff, 0x2, 0x80000001, 0xfffffffffffff001, 0x2, 0x5, 0x200, 0x0, 0x6, 0x3, 0x8000, 0x4, 0x1, 0x3, 0x3d58, 0xfffffffffffffffb, 0x9, 0x1ff, 0x800, 0x6, 0x0, 0x5, 0x5, 0x7f, 0x1, 0x1000, 0x7ff, 0x3f, 0x8, 0x0, 0x4, 0x1c26000000, 0xf0, 0x3, 0x7, 0x7f, 0x2, 0x400, 0x9, 0xe24, 0x3fffc00000, 0x5, 0x80, 0x401, 0x9, 0x1ff, 0x10001, 0x3, 0x1, 0x4, 0x9, 0xfffffffffffff37c, 0x8, 0x1, 0xb6, 0x6, 0x9, 0x1, 0x81, 0x7fffffff, 0x2, 0x6, 0x40, 0x9, 0x3, 0xc04, 0x2, 0x5, 0x6, 0x6b, 0x1, 0x40, 0x0, 0xf9dc, 0x0, 0x9, 0x9, 0x400000000, 0x0, 0x0, 0xac, 0xffffffff, 0xfffffffffffffffa, 0xc6, 0xe32, 0xc7a, 0x0, 0x8, 0x7, 0x8, 0x8000, 0xa5, 0x76, 0x1b58, 0x4, 0x0, 0x2, 0x0, 0x95, 0x0, 0x0, 0x0, 0x5, 0x10001, 0x9, 0xffffffffffffe2ed, 0x7, 0x7, 0xf6d, 0x9, 0x1, 0xffffffffffffff00, 0x2, 0x9, 0x2, 0x0, 0x6, 0x5, 0x7, 0x0, 0x96b7], {0x0, 0x1c9c380}}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$UI_GET_VERSION(0xffffffffffffffff, 0x8004552d, &(0x7f00000002c0)) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffff9c, 0x84, 0x11, 0x0, &(0x7f0000000340)) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f00000003c0)=@assoc_value, 0x0) ioctl$UI_GET_VERSION(r0, 0x8004552d, &(0x7f0000000300)) ioctl$EVIOCGNAME(0xffffffffffffffff, 0x80404506, 0x0) socket$pppoe(0x18, 0x1, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x1, 0x0) write$sndseq(r1, &(0x7f0000000040)=[{0x300, 0x0, 0x0, 0x0, @tick, {}, {}, @quote}], 0xff33) [ 259.147952][ T7760] binder_thread_release: 10 callbacks suppressed [ 259.147964][ T7760] binder: release 11480:11481 transaction 276 out, still active [ 259.166218][ T7760] binder: unexpected work type, 4, not freed 20:15:34 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) [ 259.230308][ T7760] binder_release_work: 10 callbacks suppressed [ 259.230313][ T7760] binder: undelivered TRANSACTION_COMPLETE 20:15:34 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r1, 0x5411, &(0x7f0000000000)) [ 259.292364][ T7760] binder_send_failed_reply: 10 callbacks suppressed [ 259.292371][ T7760] binder: send failed reply for transaction 276, target dead 20:15:34 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x205, 0x8000000100079) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0x4004551e, 0x0) 20:15:34 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa000000000040000300000100000005000000"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:34 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="0100000000"]) [ 259.431840][ T3759] binder: release 11502:11504 transaction 280 out, still active [ 259.456242][ T3759] binder: unexpected work type, 4, not freed 20:15:34 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x5, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001"], 0x0, 0x0, 0x0}) 20:15:34 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:34 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r1, 0x5411, &(0x7f0000000000)) [ 259.506889][ T3759] binder: undelivered TRANSACTION_COMPLETE [ 259.535577][ T3759] binder: send failed reply for transaction 280, target dead [ 259.608566][ T3759] binder: release 11514:11515 transaction 284 out, still active 20:15:35 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x5, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001"], 0x0, 0x0, 0x0}) [ 259.656276][ T3759] binder: undelivered TRANSACTION_COMPLETE [ 259.672699][T11521] binder: BINDER_SET_CONTEXT_MGR already set 20:15:35 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="0100000000"]) 20:15:35 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r1, 0x5411, &(0x7f0000000000)) [ 259.713099][T11521] binder: 11518:11521 ioctl 40046207 0 returned -16 [ 259.716275][ T3759] binder: send failed reply for transaction 284, target dead [ 259.734582][T11524] binder: 11518:11524 transaction failed 29189/-22, size 0-8 line 2995 [ 259.791561][ T3759] binder: release 11525:11526 transaction 289 out, still active [ 259.843952][ T3759] binder: undelivered TRANSACTION_COMPLETE [ 259.887038][T11521] binder_thread_write: 3 callbacks suppressed [ 259.887053][T11521] binder: 11518:11521 Release 1 refcount change on invalid ref 1 ret -22 [ 259.898098][ T3759] binder: send failed reply for transaction 289, target dead [ 259.970590][T11521] binder: 11518:11521 unknown command 255 [ 259.977692][T11521] binder: 11518:11521 ioctl c0306201 200001c0 returned -22 [ 260.057288][ T3759] binder: undelivered TRANSACTION_ERROR: 29189 20:15:35 executing program 4: syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0xffffffffffffffff, 0x2) r0 = dup2(0xffffffffffffff9c, 0xffffffffffffffff) ioctl$KDSKBMETA(0xffffffffffffffff, 0x4b63, 0x0) socket$unix(0x1, 0x5, 0x0) semget$private(0x0, 0x2, 0x244) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(0xffffffffffffffff, 0xc4c85513, &(0x7f0000000e40)={{0x0, 0x0, 0x0, 0x0, '\x00', 0x5ba78a22}, 0x0, [0xbbe, 0x4, 0x8, 0x401, 0x1000, 0x2, 0x2, 0xffffffff, 0x2, 0x80000001, 0xfffffffffffff001, 0x2, 0x5, 0x200, 0x0, 0x6, 0x3, 0x8000, 0x4, 0x1, 0x3, 0x3d58, 0xfffffffffffffffb, 0x9, 0x1ff, 0x800, 0x6, 0x0, 0x5, 0x5, 0x7f, 0x1, 0x1000, 0x7ff, 0x3f, 0x8, 0x0, 0x4, 0x1c26000000, 0xf0, 0x3, 0x7, 0x7f, 0x2, 0x400, 0x9, 0xe24, 0x3fffc00000, 0x5, 0x80, 0x401, 0x9, 0x1ff, 0x10001, 0x3, 0x1, 0x4, 0x9, 0xfffffffffffff37c, 0x8, 0x1, 0xb6, 0x6, 0x9, 0x1, 0x81, 0x7fffffff, 0x2, 0x6, 0x40, 0x9, 0x3, 0xc04, 0x2, 0x5, 0x6, 0x6b, 0x1, 0x40, 0x0, 0xf9dc, 0x0, 0x9, 0x9, 0x400000000, 0x0, 0x0, 0xac, 0xffffffff, 0xfffffffffffffffa, 0xc6, 0xe32, 0xc7a, 0x0, 0x8, 0x7, 0x8, 0x8000, 0xa5, 0x76, 0x1b58, 0x4, 0x0, 0x2, 0x0, 0x95, 0x0, 0x0, 0x0, 0x5, 0x10001, 0x9, 0xffffffffffffe2ed, 0x7, 0x7, 0xf6d, 0x9, 0x1, 0xffffffffffffff00, 0x2, 0x9, 0x2, 0x0, 0x6, 0x5, 0x7, 0x0, 0x96b7], {0x0, 0x1c9c380}}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$UI_GET_VERSION(0xffffffffffffffff, 0x8004552d, &(0x7f00000002c0)) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffff9c, 0x84, 0x11, 0x0, &(0x7f0000000340)) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f00000003c0)=@assoc_value, 0x0) ioctl$UI_GET_VERSION(r0, 0x8004552d, &(0x7f0000000300)) ioctl$EVIOCGNAME(0xffffffffffffffff, 0x80404506, 0x0) socket$pppoe(0x18, 0x1, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x1, 0x0) write$sndseq(r1, &(0x7f0000000040)=[{0x300, 0x0, 0x0, 0x0, @tick, {}, {}, @quote}], 0xff33) 20:15:35 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b7"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:35 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x5, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001"], 0x0, 0x0, 0x0}) 20:15:35 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$TIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) 20:15:35 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="0100000000"]) 20:15:35 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x5, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001"], 0x0, 0x0, 0x0}) 20:15:35 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$TIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) [ 260.274074][ T7760] binder: release 11548:11549 transaction 293 out, still active [ 260.294481][T11547] binder: BINDER_SET_CONTEXT_MGR already set [ 260.300782][ T7760] binder: undelivered TRANSACTION_COMPLETE [ 260.310440][T11547] binder: 11546:11547 ioctl 40046207 0 returned -16 20:15:35 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="06630440010000"], 0x0, 0x0, 0x0}) 20:15:35 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b7"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) [ 260.353699][T11547] binder: 11546:11547 Release 1 refcount change on invalid ref 1 ret -22 [ 260.382293][ T7760] binder: send failed reply for transaction 293, target dead [ 260.390395][ T7760] binder: send failed reply for transaction 296 to 11546:11547 20:15:35 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$TIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) [ 260.454958][ T7760] binder: undelivered TRANSACTION_COMPLETE 20:15:35 executing program 0: syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0xffffffffffffffff, 0x2) r0 = dup2(0xffffffffffffff9c, 0xffffffffffffffff) ioctl$KDSKBMETA(0xffffffffffffffff, 0x4b63, 0x0) socket$unix(0x1, 0x5, 0x0) semget$private(0x0, 0x2, 0x244) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(0xffffffffffffffff, 0xc4c85513, &(0x7f0000000e40)={{0x0, 0x0, 0x0, 0x0, '\x00', 0x5ba78a22}, 0x0, [0xbbe, 0x4, 0x8, 0x401, 0x1000, 0x2, 0x2, 0xffffffff, 0x2, 0x80000001, 0xfffffffffffff001, 0x2, 0x5, 0x200, 0x0, 0x6, 0x3, 0x8000, 0x4, 0x1, 0x3, 0x3d58, 0xfffffffffffffffb, 0x9, 0x1ff, 0x800, 0x6, 0x0, 0x5, 0x5, 0x7f, 0x1, 0x1000, 0x7ff, 0x3f, 0x8, 0x0, 0x4, 0x1c26000000, 0xf0, 0x3, 0x7, 0x7f, 0x2, 0x400, 0x9, 0xe24, 0x3fffc00000, 0x5, 0x80, 0x401, 0x9, 0x1ff, 0x10001, 0x3, 0x1, 0x4, 0x9, 0xfffffffffffff37c, 0x8, 0x1, 0xb6, 0x6, 0x9, 0x1, 0x81, 0x7fffffff, 0x2, 0x6, 0x40, 0x9, 0x3, 0xc04, 0x2, 0x5, 0x6, 0x6b, 0x1, 0x40, 0x0, 0xf9dc, 0x0, 0x9, 0x9, 0x400000000, 0x0, 0x0, 0xac, 0xffffffff, 0xfffffffffffffffa, 0xc6, 0xe32, 0xc7a, 0x0, 0x8, 0x7, 0x8, 0x8000, 0xa5, 0x76, 0x1b58, 0x4, 0x0, 0x2, 0x0, 0x95, 0x0, 0x0, 0x0, 0x5, 0x10001, 0x9, 0xffffffffffffe2ed, 0x7, 0x7, 0xf6d, 0x9, 0x1, 0xffffffffffffff00, 0x2, 0x9, 0x2, 0x0, 0x6, 0x5, 0x7, 0x0, 0x96b7], {0x0, 0x1c9c380}}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$UI_GET_VERSION(0xffffffffffffffff, 0x8004552d, &(0x7f00000002c0)) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffff9c, 0x84, 0x11, 0x0, &(0x7f0000000340)) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f00000003c0)=@assoc_value, 0x0) ioctl$UI_GET_VERSION(r0, 0x8004552d, &(0x7f0000000300)) ioctl$EVIOCGNAME(0xffffffffffffffff, 0x80404506, 0x0) socket$pppoe(0x18, 0x1, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x1, 0x0) write$sndseq(r1, &(0x7f0000000040)=[{0x300, 0x0, 0x0, 0x0, @tick, {}, {}, @quote}], 0xff33) 20:15:35 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="06630440010000"], 0x0, 0x0, 0x0}) [ 260.512820][ T7760] binder: undelivered TRANSACTION_ERROR: 29189 [ 260.519053][ T7760] binder: release 11559:11560 transaction 300 out, still active [ 260.584996][ T7760] binder: undelivered TRANSACTION_COMPLETE [ 260.603361][ T7760] binder: send failed reply for transaction 300, target dead [ 260.637040][ T7760] binder: release 11569:11570 transaction 304 out, still active [ 260.659000][ T7760] binder: undelivered TRANSACTION_COMPLETE [ 260.728399][ T3759] binder: send failed reply for transaction 304, target dead 20:15:36 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="06630440010000"], 0x0, 0x0, 0x0}) 20:15:36 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b04"]) 20:15:36 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="0100000000000000"]) 20:15:36 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="06630440010000"], 0x0, 0x0, 0x0}) 20:15:36 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b7"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:36 executing program 1: socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r0, 0x5411, &(0x7f0000000000)) [ 260.993264][ T3759] binder: release 11582:11588 transaction 308 out, still active [ 261.001259][T11580] binder: BINDER_SET_CONTEXT_MGR already set [ 261.005268][ T3759] binder: undelivered TRANSACTION_COMPLETE [ 261.025002][T11580] binder: 11579:11580 ioctl 40046207 0 returned -16 20:15:36 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:36 executing program 1: socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r0, 0x5411, &(0x7f0000000000)) 20:15:36 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) [ 261.054781][ T3759] binder: send failed reply for transaction 308, target dead [ 261.059888][T11593] binder: 11579:11593 transaction failed 29189/-22, size 24-8 line 2995 [ 261.100005][T11580] binder: 11579:11580 Release 1 refcount change on invalid ref 1 ret -22 [ 261.144897][T11596] binder: 11595:11596 Release 1 refcount change on invalid ref 1 ret -22 [ 261.161563][ T3759] binder: undelivered TRANSACTION_ERROR: 29189 20:15:36 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="0100000000000000"]) 20:15:36 executing program 4: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 261.188224][T11596] binder: 11595:11596 unknown command 255 20:15:36 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000"], 0x0, 0x0, 0x0}) [ 261.232346][T11596] binder: 11595:11596 ioctl c0306201 200001c0 returned -22 20:15:36 executing program 1: socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r0, 0x5411, &(0x7f0000000000)) 20:15:36 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="06630440010000"], 0x0, 0x0, 0x0}) 20:15:36 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:36 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r3, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r3, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:36 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="0100000000000000"]) [ 261.369815][T11612] binder: BINDER_SET_CONTEXT_MGR already set [ 261.397100][T11612] binder: 11611:11612 ioctl 40046207 0 returned -16 [ 261.465719][T11626] binder: 11611:11626 transaction failed 29189/-22, size 24-8 line 2995 [ 261.502648][ T7760] binder: release 11620:11622 transaction 315 out, still active 20:15:36 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:36 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r0, 0x5411, &(0x7f0000000000)) [ 261.515025][T11612] binder: 11611:11612 Release 1 refcount change on invalid ref 1 ret -22 [ 261.549521][ T7760] binder: undelivered TRANSACTION_COMPLETE [ 261.583736][ T7760] binder: undelivered TRANSACTION_ERROR: 29189 20:15:37 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000"], 0x0, 0x0, 0x0}) 20:15:37 executing program 4: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r5, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r5, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 261.626043][ T7760] binder: send failed reply for transaction 315, target dead 20:15:37 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r3, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r3, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:37 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b"]) 20:15:37 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r0, 0x5411, &(0x7f0000000000)) [ 261.735214][ T7760] binder: release 11639:11640 transaction 319 out, still active 20:15:37 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:37 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000"], 0x0, 0x0, 0x0}) [ 261.808712][ T7760] binder: send failed reply for transaction 319, target dead 20:15:37 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:37 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b"]) 20:15:37 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r0, 0x5411, &(0x7f0000000000)) 20:15:37 executing program 4: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r5, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r5, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:37 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:37 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:37 executing program 1: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r0, 0x5411, &(0x7f0000000000)) 20:15:37 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000008b"]) 20:15:37 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:37 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000009004"]) 20:15:37 executing program 4: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:37 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) keyctl$join(0x1, 0x0) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:37 executing program 1: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r0, 0x5411, &(0x7f0000000000)) 20:15:37 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:37 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:38 executing program 1: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r0, 0x5411, &(0x7f0000000000)) 20:15:38 executing program 4: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:38 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, 0x0) 20:15:38 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) keyctl$join(0x1, 0x0) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:38 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r1, 0x5411, &(0x7f0000000000)) 20:15:38 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) keyctl$join(0x1, 0x0) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:38 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, 0x0) 20:15:38 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:38 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r1, 0x5411, &(0x7f0000000000)) 20:15:38 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) keyctl$join(0x1, 0x0) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:38 executing program 4: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000980)={r3, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r4 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r5 = shmat(r4, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r5) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r6 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r6, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r6, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) keyctl$join(0x1, 0x0) accept$packet(r1, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000003c0)={@empty, @remote, @mcast1, 0x21, 0x800005, 0x80, 0x500, 0x1, 0x10000, r7}) r8 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r8, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r8, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:38 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, 0x0) 20:15:38 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r1, 0x5411, &(0x7f0000000000)) 20:15:38 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) keyctl$join(0x1, 0x0) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:38 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:38 executing program 4: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000980)={r3, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r4 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r5 = shmat(r4, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r5) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r6 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r6, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r6, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) keyctl$join(0x1, 0x0) accept$packet(r1, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000003c0)={@empty, @remote, @mcast1, 0x21, 0x800005, 0x80, 0x500, 0x1, 0x10000, r7}) r8 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r8, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r8, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:38 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[]) 20:15:38 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) keyctl$join(0x1, 0x0) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:38 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCOUTQ(r1, 0x5411, &(0x7f0000000000)) 20:15:38 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:39 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCOUTQ(r1, 0x5411, &(0x7f0000000000)) 20:15:39 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) keyctl$join(0x1, 0x0) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:39 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) keyctl$join(0x1, 0x0) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:39 executing program 4: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:39 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[]) 20:15:39 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) read(0xffffffffffffffff, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:39 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCOUTQ(r1, 0x5411, &(0x7f0000000000)) 20:15:39 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) 20:15:39 executing program 4: r0 = socket$inet(0x2, 0x4020000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f00000001c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) shutdown(r0, 0x1) shutdown(r0, 0x1) 20:15:39 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[]) 20:15:39 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) keyctl$join(0x1, 0x0) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:39 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000980)={r3, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r4 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r5 = shmat(r4, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r5) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r6 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r6, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r6, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) keyctl$join(0x1, 0x0) accept$packet(r1, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000003c0)={@empty, @remote, @mcast1, 0x21, 0x800005, 0x80, 0x500, 0x1, 0x10000, r7}) setsockopt$l2tp_PPPOL2TP_SO_LNSMODE(0xffffffffffffffff, 0x111, 0x4, 0x0, 0x4) r8 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r8, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r8, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:39 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) read(0xffffffffffffffff, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:39 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) 20:15:39 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) read(0xffffffffffffffff, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:39 executing program 4: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:39 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB]) 20:15:39 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) 20:15:39 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) keyctl$join(0x1, 0x0) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 264.412854][T11840] binder: 11836:11840 ioctl c018620b 0 returned -14 20:15:39 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000980)={r3, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r4 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r5 = shmat(r4, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r5) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r6 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r6, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r6, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) keyctl$join(0x1, 0x0) accept$packet(r1, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000003c0)={@empty, @remote, @mcast1, 0x21, 0x800005, 0x80, 0x500, 0x1, 0x10000, r7}) setsockopt$l2tp_PPPOL2TP_SO_LNSMODE(0xffffffffffffffff, 0x111, 0x4, 0x0, 0x4) r8 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r8, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r8, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:39 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r1, 0x5411, 0x0) 20:15:39 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) socket$inet6(0xa, 0x2, 0x0) r5 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r5, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r5, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 264.501465][T11849] binder: 11836:11849 unknown command 255 [ 264.540288][T11849] binder: 11836:11849 ioctl c0306201 200001c0 returned -22 20:15:40 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB]) 20:15:40 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) keyctl$join(0x1, 0x0) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:40 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r1, 0x5411, 0x0) 20:15:40 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000980)={r3, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r4 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r5 = shmat(r4, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r5) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r6 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r6, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r6, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) keyctl$join(0x1, 0x0) accept$packet(r1, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000003c0)={@empty, @remote, @mcast1, 0x21, 0x800005, 0x80, 0x500, 0x1, 0x10000, r7}) setsockopt$l2tp_PPPOL2TP_SO_LNSMODE(0xffffffffffffffff, 0x111, 0x4, 0x0, 0x4) r8 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r8, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r8, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:40 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) keyctl$join(0x1, 0x0) read(0xffffffffffffffff, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:40 executing program 4: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:40 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB]) 20:15:40 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r5, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r5, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:40 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r1, 0x5411, 0x0) 20:15:40 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) keyctl$join(0x1, 0x0) read(0xffffffffffffffff, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:40 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) socket$inet6(0xa, 0x2, 0x0) r5 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r5, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r5, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 265.193146][ T2997] binder_thread_release: 1 callbacks suppressed [ 265.193158][ T2997] binder: release 11836:11840 transaction 327 out, still active [ 265.207305][ T2997] binder_release_work: 2 callbacks suppressed [ 265.207310][ T2997] binder: undelivered TRANSACTION_COMPLETE [ 265.223814][ T3759] binder_send_failed_reply: 1 callbacks suppressed [ 265.223822][ T3759] binder: send failed reply for transaction 327, target dead [ 265.339459][T11891] binder: 11890:11891 ioctl c018620b 0 returned -14 20:15:40 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) keyctl$join(0x1, 0x0) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:40 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="0100000000"]) 20:15:40 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) keyctl$join(0x1, 0x0) read(0xffffffffffffffff, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 265.435270][T11896] binder: 11890:11896 unknown command 255 [ 265.459632][T11896] binder: 11890:11896 ioctl c0306201 200001c0 returned -22 20:15:40 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:41 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="0100000000"]) 20:15:41 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) keyctl$join(0x1, 0x0) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:41 executing program 4: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:41 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000980)={r3, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r4 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r5 = shmat(r4, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r5) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r6 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r6, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r6, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) keyctl$join(0x1, 0x0) accept$packet(r1, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000003c0)={@empty, @remote, @mcast1, 0x21, 0x800005, 0x80, 0x500, 0x1, 0x10000, r7}) setsockopt$l2tp_PPPOL2TP_SO_LNSMODE(0xffffffffffffffff, 0x111, 0x4, 0x0, 0x4) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhost-vsock\x00', 0x2, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x101003, 0x0) r8 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r8, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r8, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:41 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) r5 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r5, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r5, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:41 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:41 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:41 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="0100000000"]) [ 266.079263][ T2997] binder: release 11890:11891 transaction 331 out, still active [ 266.087014][ T2997] binder: undelivered TRANSACTION_COMPLETE [ 266.096419][ T2997] binder: send failed reply for transaction 331, target dead 20:15:41 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="0100000000000000"]) [ 266.233214][T11934] binder: 11933:11934 ioctl c018620b 0 returned -14 20:15:41 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:41 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) r4 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r4, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r4, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:41 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:41 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 266.364387][T11947] binder: 11933:11947 unknown command 255 [ 266.390373][T11947] binder: 11933:11947 ioctl c0306201 200001c0 returned -22 20:15:41 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:42 executing program 4: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:42 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="0100000000000000"]) 20:15:42 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) socket$inet6(0xa, 0x2, 0x0) r5 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r5, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r5, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:42 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:42 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:42 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r3 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r3, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r3, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 267.010383][ T2997] binder: release 11933:11934 transaction 335 out, still active [ 267.018056][ T2997] binder: undelivered TRANSACTION_COMPLETE [ 267.050425][ T2997] binder: send failed reply for transaction 335, target dead [ 267.130960][T11978] binder: 11977:11978 ioctl c018620b 0 returned -14 [ 267.169966][T11978] binder: 11977:11978 Release 1 refcount change on invalid ref 1 ret -22 20:15:42 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="0100000000000000"]) [ 267.188680][T11978] binder: 11977:11978 unknown command 255 20:15:42 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r5, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r5, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:42 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) 20:15:42 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:42 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r3, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r3, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 267.229058][T11978] binder: 11977:11978 ioctl c0306201 200001c0 returned -22 20:15:42 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="010000000000000090"]) 20:15:42 executing program 4: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:42 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) read(0xffffffffffffffff, &(0x7f0000000540)=""/82, 0x52) 20:15:42 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) r5 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r5, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r5, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 267.486893][T12004] binder: 12001:12004 ioctl c018620b 0 returned -14 20:15:42 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) r3 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r3, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r3, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:42 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 267.548918][T12004] binder: 12001:12004 Release 1 refcount change on invalid ref 1 ret -22 20:15:43 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="010000000000000090"]) [ 267.640695][T12004] binder: 12001:12004 unknown command 255 [ 267.647768][T12004] binder: 12001:12004 ioctl c0306201 200001c0 returned -22 20:15:43 executing program 4: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:43 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) r4 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r4, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r4, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:43 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) r3 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r3, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r3, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:43 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) read(0xffffffffffffffff, &(0x7f0000000540)=""/82, 0x52) 20:15:43 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000050000002560b700ff"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="010000000000000090"]) [ 267.853499][T12032] binder: 12031:12032 ioctl c018620b 0 returned -14 20:15:43 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 267.962898][T12032] binder: 12031:12032 Release 1 refcount change on invalid ref 1 ret -22 20:15:43 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) ioctl$NBD_DO_IT(r0, 0xab03) read(0xffffffffffffffff, &(0x7f0000000540)=""/82, 0x52) [ 268.031633][T12032] binder: 12031:12032 unknown command 255 [ 268.055772][T12032] binder: 12031:12032 ioctl c0306201 200001c0 returned -22 20:15:43 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) r3 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r3, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r3, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:43 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r3 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r3, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r3, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:43 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) r3 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r3, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r3, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:43 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:43 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) 20:15:43 executing program 4: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:43 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) r3 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r3, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r3, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:43 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r3 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r3, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r3, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 268.367806][T12072] binder: 12068:12072 ioctl c018620b 0 returned -14 [ 268.380117][T12072] binder: 12068:12072 transaction failed 29189/-22, size 24-8 line 2995 20:15:43 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) socket$inet_dccp(0x2, 0x6, 0x0) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 268.417096][T12072] binder: 12068:12072 Release 1 refcount change on invalid ref 1 ret -22 20:15:43 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) 20:15:43 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 268.512749][T12072] binder: 12068:12072 unknown command 255 [ 268.547060][T12072] binder: 12068:12072 ioctl c0306201 200001c0 returned -22 20:15:44 executing program 4: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:44 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r6, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:44 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r3, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r3, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:44 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:44 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:44 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) [ 268.848700][T12112] binder: 12108:12112 ioctl c018620b 0 returned -14 [ 268.876009][T12112] binder: 12108:12112 transaction failed 29189/-22, size 24-8 line 2995 [ 268.887313][T12112] binder: 12108:12112 Release 1 refcount change on invalid ref 1 ret -22 20:15:44 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 268.898198][T12112] binder: 12108:12112 unknown command 255 [ 268.910841][T12112] binder: 12108:12112 ioctl c0306201 200001c0 returned -22 20:15:44 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r3, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r3, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:44 executing program 4: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:44 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:44 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:44 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) [ 269.152060][T12131] binder: 12130:12131 ioctl c018620b 0 returned -14 [ 269.175390][T12131] binder: 12130:12131 transaction failed 29189/-22, size 24-8 line 2995 20:15:44 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) 20:15:44 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) socket$inet6(0xa, 0x2, 0x0) r5 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r5, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 269.227681][T12136] binder: 12130:12136 Release 1 refcount change on invalid ref 1 ret -22 [ 269.256418][T12136] binder: 12130:12136 unknown command 255 [ 269.262627][T12136] binder: 12130:12136 ioctl c0306201 200001c0 returned -22 20:15:44 executing program 4: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:44 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) r3 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r3, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r3, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:44 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:44 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) socket$inet6(0xa, 0x2, 0x0) ioctl$NBD_DO_IT(r0, 0xab03) r5 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r5, &(0x7f0000000540)=""/82, 0x52) [ 269.444570][T12147] binder: 12146:12147 unknown command 255 20:15:44 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) 20:15:44 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r5, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 269.494276][T12147] binder: 12146:12147 ioctl c0306201 200001c0 returned -22 20:15:44 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:45 executing program 4: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) [ 269.552031][ T2997] binder: release 12146:12147 transaction 345 out, still active 20:15:45 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 269.628878][ T2997] binder: send failed reply for transaction 345, target dead 20:15:45 executing program 4: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) [ 269.735219][T12174] binder: 12168:12174 unknown command 255 [ 269.741849][T12174] binder: 12168:12174 ioctl c0306201 200001c0 returned -22 [ 269.749832][ T3759] binder: release 12168:12174 transaction 349 out, still active [ 269.768401][ T2997] binder: send failed reply for transaction 349, target dead 20:15:45 executing program 4: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) [ 269.799489][T12177] binder: 12176:12177 unknown command 255 [ 269.808171][T12177] binder: 12176:12177 ioctl c0306201 200001c0 returned -22 [ 269.820426][ T3759] binder: release 12176:12177 transaction 353 out, still active [ 269.833823][ T3759] binder: send failed reply for transaction 353, target dead 20:15:45 executing program 4: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) [ 269.864964][T12179] binder: 12178:12179 ioctl c018620b 0 returned -14 [ 269.872085][T12179] binder_alloc: 12178: binder_alloc_buf, no vma [ 269.878404][T12179] binder: 12178:12179 transaction failed 29189/-3, size 24-8 line 3148 [ 269.887326][T12179] binder: 12178:12179 Release 1 refcount change on invalid ref 1 ret -22 [ 269.896195][T12179] binder: 12178:12179 unknown command 255 [ 269.902077][T12179] binder: 12178:12179 ioctl c0306201 200001c0 returned -22 20:15:45 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) socket$inet6(0xa, 0x2, 0x0) ioctl$NBD_DO_IT(r0, 0xab03) r5 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r5, &(0x7f0000000540)=""/82, 0x52) 20:15:45 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:45 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) r5 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r5, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:45 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:45 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) getsockopt$sock_cred(r5, 0x1, 0x19, &(0x7f0000000100), &(0x7f00000000c0)=0xc) r6 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r6, &(0x7f0000000540)=""/82, 0x52) [ 270.015415][T12187] binder: 12186:12187 ioctl c018620b 0 returned -14 20:15:45 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) socket$inet6(0xa, 0x2, 0x0) ioctl$NBD_DO_IT(r0, 0xab03) r5 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r5, &(0x7f0000000540)=""/82, 0x52) [ 270.127125][T12187] binder_alloc: 12186: binder_alloc_buf, no vma [ 270.136014][T12187] binder: 12186:12187 transaction failed 29189/-3, size 24-8 line 3148 20:15:45 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) r5 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r5, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:45 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 270.204020][T12187] binder: 12186:12187 Release 1 refcount change on invalid ref 1 ret -22 [ 270.229138][T12187] binder: 12186:12187 unknown command 255 [ 270.240404][T12187] binder: 12186:12187 ioctl c0306201 200001c0 returned -22 20:15:45 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) socket$inet_dccp(0x2, 0x6, 0x0) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:45 executing program 2: syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) r0 = gettid() timer_create(0x0, 0x0, &(0x7f0000000080)) ioprio_get$pid(0x5, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x1c9c380}, {0x0, 0x9}}, 0x0) tkill(r0, 0x16) 20:15:45 executing program 4: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:45 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) r5 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r5, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:45 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r5 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r5, &(0x7f0000000540)=""/82, 0x52) 20:15:45 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r2, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:45 executing program 0: openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 270.528568][T12226] binder: 12225:12226 ioctl c018620b 0 returned -14 20:15:46 executing program 2: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000100)='/proc/thread-self/attr/sockcreate\x00', 0x2, 0x0) write$selinux_attr(r0, &(0x7f0000000080)='system_u:object_r:apm_bios_t:s0\x00', 0x20) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket(0x10, 0x2, 0x0) [ 270.570761][T12226] binder_alloc: 12225: binder_alloc_buf, no vma [ 270.591146][T12226] binder: 12225:12226 transaction failed 29189/-3, size 24-8 line 3148 [ 270.605503][T12226] binder: 12225:12226 Release 1 refcount change on invalid ref 1 ret -22 20:15:46 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) r4 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r4, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 270.615922][T12226] binder: 12225:12226 unknown command 255 [ 270.630324][T12226] binder: 12225:12226 ioctl c0306201 200001c0 returned -22 20:15:46 executing program 0: socket$inet_dccp(0x2, 0x6, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:46 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r5 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r5, &(0x7f0000000540)=""/82, 0x52) 20:15:46 executing program 4: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:46 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:46 executing program 2: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/keycreate\x00', 0x2, 0x0) write$selinux_attr(r0, 0x0, 0x0) [ 270.794820][T12251] binder: 12248:12251 ioctl c018620b 0 returned -14 20:15:46 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) r4 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r4, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:46 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 270.867387][T12251] binder: 12248:12251 transaction failed 29189/-22, size 24-8 line 2995 20:15:46 executing program 2: r0 = add_key$user(&(0x7f0000000180)='user\x00', &(0x7f00000001c0)={'syz'}, 0x0, 0x0, 0xffffffffffffffff) keyctl$revoke(0x3, r0) 20:15:46 executing program 0: socket$inet_dccp(0x2, 0x6, 0x0) r0 = syz_open_dev$video(0x0, 0x3, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:46 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000440)='/dev/rtc0\x00'}, 0x10) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r5 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r5, &(0x7f0000000540)=""/82, 0x52) 20:15:46 executing program 4: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:46 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:46 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) r4 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r4, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:46 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x58, 0x0, &(0x7f0000000480)=[@increfs_done, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 271.112455][T12279] binder: 12276:12279 ioctl c018620b 0 returned -14 20:15:46 executing program 0: socket$inet_dccp(0x2, 0x6, 0x0) r0 = syz_open_dev$video(0x0, 0x3, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 271.156702][T12279] binder: 12276:12279 transaction failed 29189/-22, size 24-8 line 2995 20:15:46 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:46 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r5 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r5, &(0x7f0000000540)=""/82, 0x52) [ 271.199484][T12290] binder: 12289:12290 BC_INCREFS_DONE u0000000000000000 no match 20:15:46 executing program 0: socket$inet_dccp(0x2, 0x6, 0x0) r0 = syz_open_dev$video(0x0, 0x3, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 271.261539][T12290] binder: 12289:12290 got reply transaction with no transaction stack 20:15:46 executing program 4: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) [ 271.318469][T12290] binder: 12289:12290 transaction failed 29201/-71, size 0-0 line 2900 20:15:46 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r3 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r3, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:46 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:46 executing program 0: socket$inet_dccp(0x2, 0x6, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x0, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 271.430116][T12308] binder: 12289:12308 BC_INCREFS_DONE u0000000000000000 no match [ 271.448992][T12307] binder: 12306:12307 ioctl c018620b 0 returned -14 [ 271.481754][T12308] binder: 12289:12308 got reply transaction with no transaction stack [ 271.502473][T12307] binder: 12306:12307 transaction failed 29189/-22, size 24-8 line 2995 20:15:46 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:46 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) r4 = shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) shmdt(r4) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r5 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r5, &(0x7f0000000540)=""/82, 0x52) [ 271.528411][ T3759] binder: undelivered TRANSACTION_ERROR: 29201 [ 271.538526][ T3759] binder: undelivered TRANSACTION_ERROR: 29201 20:15:46 executing program 4: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:47 executing program 2: sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000000c0), 0xc, 0x0}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket(0x10, 0x0, 0xfffffffffffff3dd) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='\x05\x02\x00\x00\x00\x00\x00\x8f\x00') ioctl$KVM_TRANSLATE(0xffffffffffffffff, 0xc018ae85, &(0x7f0000000040)={0x6000, 0x6000, 0x8000, 0xffffffffffff7fff}) socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet6_dccp_int(r0, 0x21, 0x11, &(0x7f0000000000)=0x6, 0x4) getsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) clone(0x2000020002104, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) 20:15:47 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r3 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r3, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:47 executing program 0: socket$inet_dccp(0x2, 0x6, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x0, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:47 executing program 3: openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:47 executing program 0: socket$inet_dccp(0x2, 0x6, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x0, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:47 executing program 4: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:47 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r3 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r3, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:47 executing program 0: socket$inet_dccp(0x2, 0x6, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(0xffffffffffffffff, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:47 executing program 3: setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:47 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) shmdt(0x0) r3 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r3, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:47 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r4 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r4, &(0x7f0000000540)=""/82, 0x52) 20:15:47 executing program 4: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:47 executing program 2: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x80000) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r0, 0x80045300, &(0x7f0000000100)) r1 = syz_open_dev$dmmidi(&(0x7f0000000340)='/dev/dmmidi#\x00', 0x6, 0x200000) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000004c0)=0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x100, 0x0) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}, 0x60}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(0x0, 0x80, 0x85) ioctl$KVM_DEASSIGN_DEV_IRQ(r5, 0x4040ae75, 0x0) write$P9_RXATTRWALK(r0, &(0x7f0000000240)={0xf, 0x1f, 0x2, 0x5}, 0xf) sendmsg$alg(0xffffffffffffffff, 0x0, 0x4000010) r6 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000380)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) keyctl$update(0x2, r6, &(0x7f0000000500)="d65a1b63eb07c3e71ab81549f530441f681a4a838787687be6ab9afa5afc9b0cb78f3e12a848016919f8f091f197fe1244ffa67f5765eee19646068b98ac83d42f8ff6cbfe4157d68caf0016e5eb3e00818ab44a19e592ada67c0d3f200cd5c52f38aa5c2844bb8ee9e4d08c3971c608cde3226cc27c2aca9f06c8184e43d36075e1699bf38f5a9eb541c79e121623268441d5d5fb92c336d15fb6ddb2dab1d5b0c91dd252d65152c95dd218af8902a1f329deccc5fda9da588b5f32b9889f15e3e532fbc1bba539346505aea2a08963348a25f2e0c8f8356f95a86e5a3002f76d9bbd688fe54eab89b1510a6910c5ee3ea5843721790f", 0xf7) renameat(0xffffffffffffffff, &(0x7f0000000280)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000300)='./file0\x00') r7 = gettid() syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') timer_create(0x7, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid=r2}, &(0x7f0000000080)=0x0) ioprio_get$pid(0x5, r2) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x1c9c380}, {0x0, 0x9}}, 0x0) tkill(r7, 0x16) fgetxattr(0xffffffffffffffff, 0x0, 0x0, 0x0) close(r5) r9 = dup2(r4, 0xffffffffffffffff) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000100), 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_PIT2(0xffffffffffffffff, 0x4070aea0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) timer_delete(r8) 20:15:47 executing program 0: socket$inet_dccp(0x2, 0x6, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(0xffffffffffffffff, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:47 executing program 3: setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:47 executing program 4: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:47 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) shmdt(0x0) r3 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r3, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:47 executing program 0: socket$inet_dccp(0x2, 0x6, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(0xffffffffffffffff, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 272.370265][T12378] binder: 12375:12378 ioctl c018620b 0 returned -14 [ 272.412751][T12384] binder: 12375:12384 unknown command 255 [ 272.434549][T12384] binder: 12375:12384 ioctl c0306201 200001c0 returned -22 20:15:47 executing program 4: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) [ 272.467478][ T2997] binder: release 12375:12384 transaction 368 out, still active [ 272.500947][ T3759] binder: send failed reply for transaction 368, target dead [ 272.540908][T12396] binder: 12395:12396 ioctl c018620b 0 returned -14 [ 272.594263][T12397] binder: 12395:12397 unknown command 255 [ 272.600355][T12397] binder: 12395:12397 ioctl c0306201 200001c0 returned -22 20:15:48 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r4 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r4, &(0x7f0000000540)=""/82, 0x52) 20:15:48 executing program 0: socket$inet_dccp(0x2, 0x6, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(0xffffffffffffffff, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:48 executing program 3: setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r0 = syz_open_dev$video(0x0, 0x3, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:48 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) shmdt(0x0) r3 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r3, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:48 executing program 0: socket$inet_dccp(0x2, 0x6, 0x0) syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(0xffffffffffffffff, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 273.338333][ T3759] binder: release 12395:12396 transaction 372 out, still active [ 273.347121][ T3759] binder: undelivered TRANSACTION_COMPLETE [ 273.357427][ T3759] binder: send failed reply for transaction 372, target dead 20:15:50 executing program 2: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TUNSETVNETLE(0xffffffffffffffff, 0x400454dc, &(0x7f0000000100)) syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x9, 0x0) fchdir(0xffffffffffffffff) write$binfmt_aout(0xffffffffffffffff, 0x0, 0x0) unlink(0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x4a, &(0x7f0000000180)=0x6f7bbbe1, 0x4) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20}, 0x1c) recvmmsg(r0, &(0x7f0000008880), 0x400000000000249, 0x44000102, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) mkdir(0x0, 0x0) ioctl$UI_END_FF_ERASE(0xffffffffffffffff, 0x400c55cb, &(0x7f0000000140)={0x5, 0x9}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(0xffffffffffffffff, 0xc0605345, 0x0) 20:15:50 executing program 3: setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r0 = syz_open_dev$video(0x0, 0x3, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:50 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) r3 = shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmat(r3, &(0x7f0000ffc000/0x4000)=nil, 0x7000) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r4 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r4, &(0x7f0000000540)=""/82, 0x52) 20:15:50 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r3 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r3, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:50 executing program 0: socket$inet_dccp(0x2, 0x6, 0x0) syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(0xffffffffffffffff, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:50 executing program 4: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:50 executing program 3: setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r0 = syz_open_dev$video(0x0, 0x3, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 275.457842][T12429] binder: 12423:12429 ioctl c018620b 0 returned -14 20:15:50 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r3 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r3, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 275.521280][T12433] binder: 12423:12433 unknown command 255 [ 275.560671][T12433] binder: 12423:12433 ioctl c0306201 200001c0 returned -22 20:15:51 executing program 0: socket$inet_dccp(0x2, 0x6, 0x0) syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(0xffffffffffffffff, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:51 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r3 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r3, &(0x7f0000000540)=""/82, 0x52) 20:15:51 executing program 3: setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x0, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:51 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r3 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r3, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:51 executing program 2: r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x145000, 0x0) fcntl$getown(r0, 0x9) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r1, 0x29, 0x4a, &(0x7f0000000180)=0x6f7bbbe1, 0x4) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e20}, 0x1c) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x44000102, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) mkdir(0x0, 0x0) ioctl$UI_END_FF_ERASE(0xffffffffffffffff, 0x400c55cb, &(0x7f0000000140)={0x5, 0x9, 0x7ff}) 20:15:51 executing program 0: socket$inet_dccp(0x2, 0x6, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(0xffffffffffffffff, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, 0x0) 20:15:51 executing program 3: setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x0, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:51 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r3 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r3, &(0x7f0000000540)=""/82, 0x52) 20:15:51 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:51 executing program 4: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:51 executing program 0: socket$inet_dccp(0x2, 0x6, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(0xffffffffffffffff, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, 0x0) 20:15:51 executing program 3: setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x0, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:51 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:51 executing program 2: futex(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(0xffffffffffffffff, 0x0, 0x48b, 0x0, 0x0) fcntl$addseals(0xffffffffffffffff, 0x409, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) futex(&(0x7f000000cffc), 0x8c, 0x0, 0x0, 0x0, 0x0) 20:15:51 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r3 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r3, &(0x7f0000000540)=""/82, 0x52) [ 276.260789][ T3759] binder: release 12423:12429 transaction 376 out, still active [ 276.268668][ T3759] binder: undelivered TRANSACTION_COMPLETE 20:15:51 executing program 3: setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(0xffffffffffffffff, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:51 executing program 0: socket$inet_dccp(0x2, 0x6, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(0xffffffffffffffff, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, 0x0) [ 276.345632][ T3759] binder: send failed reply for transaction 376, target dead 20:15:51 executing program 2: syz_open_dev$sndseq(&(0x7f0000000080)='/dev/snd/seq\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000400)='\xe87y\xd8\x0e\xfaE\xbb\x7fH\xbe\xbc\x95\x87\v\xd0\xcd9\xbd(0\xeeG\xaf\xe7\xb3?\xc7x\xbd\xe2R\xc5\r.', 0x0) r1 = syz_open_dev$sndseq(0x0, 0x0, 0x1) r2 = dup2(r1, r0) poll(&(0x7f0000000180)=[{r2}], 0x1, 0x0) 20:15:51 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 276.419603][T12494] binder: 12492:12494 ioctl c018620b 0 returned -14 20:15:51 executing program 3: setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(0xffffffffffffffff, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:51 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) socket$inet_dccp(0x2, 0x6, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r3 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r3, &(0x7f0000000540)=""/82, 0x52) [ 276.497200][T12505] binder: 12492:12505 unknown command 255 [ 276.508052][T12505] binder: 12492:12505 ioctl c0306201 200001c0 returned -22 20:15:52 executing program 4: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:52 executing program 0: socket$inet_dccp(0x2, 0x6, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(0xffffffffffffffff, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x0, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:52 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:52 executing program 2: bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) syz_genetlink_get_family_id$nbd(0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet(0x2, 0x2, 0x0) futex(0x0, 0x8c, 0x1, 0x0, &(0x7f0000048000), 0x0) 20:15:52 executing program 3: setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(0xffffffffffffffff, &(0x7f0000000540)=""/82, 0x52) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:52 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r3 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r3, &(0x7f0000000540)=""/82, 0x52) [ 277.187826][ T3759] binder: release 12492:12494 transaction 380 out, still active [ 277.195545][ T3759] binder: undelivered TRANSACTION_COMPLETE [ 277.205832][ T3759] binder: send failed reply for transaction 380, target dead 20:15:52 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:52 executing program 3: setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 277.318659][T12534] binder: 12532:12534 ioctl c018620b 0 returned -14 20:15:52 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={r2, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r3 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r3, &(0x7f0000000540)=""/82, 0x52) 20:15:52 executing program 0: socket$inet_dccp(0x2, 0x6, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(0xffffffffffffffff, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x0, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:52 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r1, 0x540f, &(0x7f0000000000)) 20:15:52 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 277.418880][T12543] binder: 12532:12543 unknown command 255 [ 277.452441][T12543] binder: 12532:12543 ioctl c0306201 200001c0 returned -22 20:15:53 executing program 4: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:53 executing program 3: setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:53 executing program 0: socket$inet_dccp(0x2, 0x6, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(0xffffffffffffffff, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x0, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:53 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r1, 0x540f, &(0x7f0000000000)) 20:15:53 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:15:53 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 278.089165][ T3759] binder: release 12532:12534 transaction 384 out, still active [ 278.097024][ T3759] binder: undelivered TRANSACTION_COMPLETE [ 278.110746][ T3759] binder: send failed reply for transaction 384, target dead 20:15:53 executing program 0: socket$inet_dccp(0x2, 0x6, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(0xffffffffffffffff, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], 0x0}) 20:15:53 executing program 3: setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:53 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) [ 278.201671][T12578] binder: 12576:12578 ioctl c018620b 0 returned -14 20:15:53 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r1, 0x540f, &(0x7f0000000000)) 20:15:53 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 278.282278][T12584] binder: 12576:12584 unknown command 255 [ 278.288066][T12584] binder: 12576:12584 ioctl c0306201 200001c0 returned -22 20:15:53 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:54 executing program 4: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:54 executing program 3: setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:54 executing program 0: socket$inet_dccp(0x2, 0x6, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(0xffffffffffffffff, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], 0x0}) 20:15:54 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r1, 0x540f, &(0x7f0000000000)) 20:15:54 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:54 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) [ 278.987537][ T2997] binder: release 12576:12578 transaction 388 out, still active [ 279.005541][ T3759] binder: send failed reply for transaction 388, target dead 20:15:54 executing program 0: socket$inet_dccp(0x2, 0x6, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(0xffffffffffffffff, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], 0x0}) 20:15:54 executing program 3: setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:54 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 279.097619][T12616] binder: 12615:12616 ioctl c018620b 0 returned -14 20:15:54 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$TIOCOUTQ(0xffffffffffffffff, 0x540f, &(0x7f0000000000)) 20:15:54 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 279.189305][T12624] binder: 12615:12624 unknown command 255 [ 279.201130][T12624] binder: 12615:12624 ioctl c0306201 200001c0 returned -22 20:15:54 executing program 3: setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, 0x0) 20:15:55 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:55 executing program 0: socket$inet_dccp(0x2, 0x6, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(0xffffffffffffffff, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0x0, 0x0, [], @p_u8=0x0}}) 20:15:55 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:55 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$TIOCOUTQ(0xffffffffffffffff, 0x540f, &(0x7f0000000000)) 20:15:55 executing program 3: setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, 0x0) 20:15:55 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 279.870246][ T3759] binder: release 12615:12616 transaction 392 out, still active [ 279.878572][ T3759] binder: undelivered TRANSACTION_COMPLETE [ 279.910753][ T3759] binder: send failed reply for transaction 392, target dead 20:15:55 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:55 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$TIOCOUTQ(0xffffffffffffffff, 0x540f, &(0x7f0000000000)) 20:15:55 executing program 3: setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, 0x0) [ 279.960821][T12655] binder: 12654:12655 ioctl c018620b 0 returned -14 20:15:55 executing program 0: socket$inet_dccp(0x2, 0x6, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(0xffffffffffffffff, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0x0, 0x0, [], @p_u8=0x0}}) 20:15:55 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 280.048274][T12662] binder: 12654:12662 unknown command 255 [ 280.080863][T12662] binder: 12654:12662 ioctl c0306201 200001c0 returned -22 20:15:55 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:56 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:56 executing program 2: socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r0, 0x540f, &(0x7f0000000000)) 20:15:56 executing program 3: setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x0, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:56 executing program 0: socket$inet_dccp(0x2, 0x6, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(0xffffffffffffffff, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0x0, 0x0, [], @p_u8=0x0}}) 20:15:56 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:15:56 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 280.751764][ T3759] binder: release 12654:12655 transaction 396 out, still active [ 280.765272][ T2997] binder: send failed reply for transaction 396, target dead 20:15:56 executing program 3: setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x0, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:56 executing program 2: socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r0, 0x540f, &(0x7f0000000000)) [ 280.832523][T12692] binder: 12691:12692 ioctl c018620b 0 returned -14 20:15:56 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sendto$inet(r0, 0x0, 0x0, 0x20000801, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) 20:15:56 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:15:56 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 280.925866][T12697] binder: 12691:12697 unknown command 255 [ 280.959802][T12697] binder: 12691:12697 ioctl c0306201 200001c0 returned -22 20:15:56 executing program 0: pipe(&(0x7f00000003c0)={0xffffffffffffffff}) ioctl$TIOCMSET(r0, 0x5418, &(0x7f0000000140)=0x100000000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) write$FUSE_INIT(r0, &(0x7f0000000600)={0x50, 0x0, 0x4, {0x7, 0x1d, 0x8, 0x800, 0x10001, 0x2, 0x0, 0x80000000}}, 0x50) bind(r1, &(0x7f0000001080)=@un=@abs={0x1}, 0x80) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r2 = socket$inet6(0xa, 0x400000000001, 0x0) r3 = dup(r2) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB='9\x00'], 0x2}}, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000002c0)={{{@in=@broadcast, @in=@local}}, {{@in=@loopback}, 0x0, @in=@dev}}, 0x0) ioctl$TCSBRKP(0xffffffffffffffff, 0x5425, 0x0) delete_module(0x0, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x12, &(0x7f0000000180)=0x83, 0x4) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r2, 0x0, 0x0, 0x20000008, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000080)='syz_tun\x00', 0x10) munlockall() r5 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, 0x0, 0x8000fffffffe) socketpair$unix(0x1, 0x400000001, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) 20:15:57 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:57 executing program 3: setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x0, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:57 executing program 2: socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r0, 0x540f, &(0x7f0000000000)) 20:15:57 executing program 5: openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:57 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) [ 281.620423][ T2997] binder: release 12691:12692 transaction 400 out, still active [ 281.635228][ T2997] binder: undelivered TRANSACTION_COMPLETE 20:15:57 executing program 3: setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], 0x0}) [ 281.670491][ T2997] binder: send failed reply for transaction 400, target dead [ 281.695753][T12735] binder: 12734:12735 ioctl c018620b 0 returned -14 20:15:57 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r0, 0x540f, &(0x7f0000000000)) 20:15:57 executing program 5: socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:57 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 281.755301][T12740] binder: 12734:12740 unknown command 255 [ 281.789213][T12740] binder: 12734:12740 ioctl c0306201 200001c0 returned -22 20:15:57 executing program 3: setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], 0x0}) 20:15:57 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r0, 0x540f, &(0x7f0000000000)) 20:15:57 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x0, 0x0, 0xffffffb8) recvmsg(r0, &(0x7f00000007c0)={&(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, 0x0}, 0x0) r3 = dup3(r1, r2, 0x0) accept4$inet(0xffffffffffffffff, 0x0, 0x0, 0x80800) ioctl$sock_ifreq(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000002a80)={0x0, @local}, &(0x7f0000002ac0)=0xc) setsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000002b00)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1, r4}, 0xc) 20:15:57 executing program 3: setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], 0x0}) 20:15:57 executing program 5: socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:57 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:15:57 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:57 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r0, 0x540f, &(0x7f0000000000)) [ 282.493952][ T3759] binder: release 12734:12735 transaction 404 out, still active [ 282.508249][ T2997] binder: send failed reply for transaction 404, target dead 20:15:57 executing program 3: setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0x0, 0x0, [], @p_u8=0x0}}) 20:15:58 executing program 5: socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 282.565754][T12775] binder: 12774:12775 ioctl c018620b 0 returned -14 20:15:58 executing program 2: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r0, 0x540f, &(0x7f0000000000)) 20:15:58 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:15:58 executing program 3: setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0x0, 0x0, [], @p_u8=0x0}}) [ 282.655331][T12783] binder: 12774:12783 unknown command 255 [ 282.688058][T12783] binder: 12774:12783 ioctl c0306201 200001c0 returned -22 20:15:58 executing program 2: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r0, 0x540f, &(0x7f0000000000)) 20:15:58 executing program 0: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x7, 0x1100082) r1 = memfd_create(&(0x7f0000000440)='\xc8\xf5\xa8ptp', 0x0) pwritev(r1, &(0x7f0000000340), 0x0, 0x1081806) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000040), 0x4) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(0xffffffffffffffff, 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) r3 = dup(r0) write$input_event(r3, &(0x7f00000001c0)={{0x77359400}}, 0x10) write$FUSE_POLL(0xffffffffffffffff, &(0x7f0000000100)={0x18}, 0x18) readv(0xffffffffffffffff, 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r3) 20:15:58 executing program 5: openat$rtc(0xffffffffffffff9c, 0x0, 0x2200, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:58 executing program 3: setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0x0, 0x0, [], @p_u8=0x0}}) 20:15:58 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:15:58 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:58 executing program 2: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r0, 0x540f, &(0x7f0000000000)) 20:15:58 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x7, 0x1100082) r1 = memfd_create(&(0x7f0000000440)='\xc8\xf5\xa8ptp', 0x0) pwritev(r1, &(0x7f0000000340)=[{0x0}], 0x1, 0x1081806) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) r2 = dup(r0) write$input_event(r2, &(0x7f00000001c0)={{0x77359400}, 0x0, 0xfffffffffffffff7}, 0x10) readv(0xffffffffffffffff, 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, 0xffffffffffffffff) 20:15:58 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:15:58 executing program 5: openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:58 executing program 0: syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x7, 0x0) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x1081806) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10000000013, 0x0, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 283.360596][ T2997] binder: release 12774:12775 transaction 408 out, still active [ 283.368251][ T2997] binder: undelivered TRANSACTION_COMPLETE [ 283.375207][ T2997] binder: send failed reply for transaction 408, target dead 20:15:58 executing program 5: openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:58 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r1, 0x540f, &(0x7f0000000000)) 20:15:58 executing program 0: 20:15:58 executing program 3: 20:15:58 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 283.469919][T12833] binder: 12829:12833 ioctl c018620b 0 returned -14 [ 283.547231][T12841] binder: 12829:12841 unknown command 255 20:15:59 executing program 0: [ 283.600366][T12841] binder: 12829:12841 ioctl c0306201 200001c0 returned -22 20:15:59 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:15:59 executing program 5: openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:59 executing program 3: 20:15:59 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r1, 0x540f, &(0x7f0000000000)) 20:15:59 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:15:59 executing program 0: [ 284.232636][ T2997] binder: release 12829:12833 transaction 412 out, still active [ 284.244593][ T3759] binder: send failed reply for transaction 412, target dead 20:15:59 executing program 0: 20:15:59 executing program 3: [ 284.322683][T12871] binder: 12870:12871 ioctl c018620b 0 returned -14 20:15:59 executing program 5: openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, &(0x7f0000000940)) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:15:59 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r1, 0x540f, &(0x7f0000000000)) 20:15:59 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:15:59 executing program 0: [ 284.391213][T12877] binder: 12870:12877 unknown command 255 [ 284.422605][T12877] binder: 12870:12877 ioctl c0306201 200001c0 returned -22 20:16:00 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:00 executing program 3: 20:16:00 executing program 0: 20:16:00 executing program 5: openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:16:00 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCOUTQ(r1, 0x540f, &(0x7f0000000000)) 20:16:00 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:00 executing program 3: [ 285.124757][ T3759] binder: send failed reply for transaction 416 to 12870:12871 [ 285.162132][ T3759] binder: undelivered TRANSACTION_ERROR: 29189 20:16:00 executing program 0: 20:16:00 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCOUTQ(r1, 0x540f, &(0x7f0000000000)) 20:16:00 executing program 5: openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x0, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 285.230095][T12907] binder: 12905:12907 ioctl c018620b 0 returned -14 20:16:00 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 20:16:00 executing program 0: syz_emit_ethernet(0x2a, &(0x7f0000000040)={@broadcast, @empty, [], {@arp={0x806, @ether_ipv4={0x2, 0x800, 0x6, 0x4, 0x0, @link_local, @rand_addr, @local, @broadcast}}}}, 0x0) [ 285.359906][T12918] binder: 12905:12918 unknown command 255 [ 285.405121][T12918] binder: 12905:12918 ioctl c0306201 200001c0 returned -22 [ 285.422274][T12922] binder: 12920:12922 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 285.440663][T12922] binder: 12920:12922 got reply transaction with no transaction stack [ 285.470055][T12922] binder_transaction: 1 callbacks suppressed [ 285.470074][T12922] binder: 12920:12922 transaction failed 29201/-71, size 0-0 line 2900 [ 285.516374][ T2997] binder: undelivered TRANSACTION_ERROR: 29201 20:16:01 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:01 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCOUTQ(r1, 0x540f, &(0x7f0000000000)) 20:16:01 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:01 executing program 5: openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x0, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:16:01 executing program 0: ioctl$KDSKBMETA(0xffffffffffffffff, 0x4b63, 0x0) get_robust_list(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(0xffffffffffffffff, 0xc4c85513, &(0x7f0000000e40)={{0x0, 0x0, 0x0, 0x0, '\x00', 0x5ba78a22}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0xfffffffffffff001, 0x0, 0x0, 0x200, 0x42b3, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x3, 0x3d58, 0x0, 0x9, 0x1ff, 0x800, 0x6, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1000, 0x7ff, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0xe24, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0xb6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x6b, 0x0, 0x0, 0x0, 0xf9dc, 0x0, 0x0, 0x0, 0x400000000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffa, 0x0, 0xe32, 0xc7a, 0x0, 0x0, 0x0, 0x8, 0x8000, 0x0, 0x76, 0x0, 0x0, 0x0, 0x0, 0x0, 0x95, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff00, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x4], {0x0, 0x1c9c380}}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$IPVS_CMD_SET_CONFIG(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x890}, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x1, 0x0) write$sndseq(r0, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @quote}], 0xff33) 20:16:01 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 286.023083][ T2997] binder: release 12905:12907 transaction 420 out, still active [ 286.030869][ T2997] binder: undelivered TRANSACTION_COMPLETE [ 286.037090][ T3759] binder: send failed reply for transaction 420, target dead 20:16:01 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(0xffffffffffffffff, 0x540f, &(0x7f0000000000)) [ 286.111659][T12937] binder: 12936:12937 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 286.119535][T12937] binder: 12936:12937 got reply transaction with no transaction stack 20:16:01 executing program 5: openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x0, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 286.160579][T12937] binder: 12936:12937 transaction failed 29201/-71, size 0-0 line 2900 [ 286.169633][T12944] binder: 12940:12944 ioctl c018620b 0 returned -14 20:16:01 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 286.224228][T12950] binder: 12940:12950 unknown command 255 [ 286.229995][T12950] binder: 12940:12950 ioctl c0306201 200001c0 returned -22 [ 286.250428][ T3759] binder: undelivered TRANSACTION_ERROR: 29201 20:16:01 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 20:16:01 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(0xffffffffffffffff, 0x540f, &(0x7f0000000000)) 20:16:01 executing program 0: sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000280)={&(0x7f0000000440)=ANY=[@ANYBLOB], 0x1}, 0x1, 0x0, 0x0, 0x4040081}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$mice(&(0x7f0000000700)='/dev/input/mice\x00', 0x0, 0x0) socket(0x10, 0x0, 0xfffffffffffff3dd) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='\x05\x02\x00\x00\x00\x00\x00\x8f\x00') ioctl$KVM_TRANSLATE(0xffffffffffffffff, 0xc018ae85, &(0x7f0000000040)={0x6000, 0x6000, 0x8000, 0xffffffffffff7fff}) socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet6_dccp_int(r1, 0x21, 0x11, &(0x7f0000000000)=0x6, 0x4) getsockopt$inet_mreqsrc(r0, 0x0, 0x0, 0x0, 0x0) clone(0x2000020002104, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) [ 286.431877][T12962] binder: 12961:12962 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 286.479351][T12962] binder: 12961:12962 got reply transaction with no transaction stack [ 286.510683][T12962] binder: 12961:12962 transaction failed 29201/-71, size 0-0 line 2900 [ 286.555276][ T2997] binder: undelivered TRANSACTION_ERROR: 29201 20:16:02 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:02 executing program 5: openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r0 = syz_open_dev$video(0x0, 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:16:02 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:02 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(0xffffffffffffffff, 0x540f, &(0x7f0000000000)) 20:16:02 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 20:16:02 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) write$FUSE_NOTIFY_INVAL_INODE(0xffffffffffffffff, 0x0, 0x0) [ 286.903739][ T3759] binder: release 12940:12944 transaction 426 out, still active [ 286.915945][ T2997] binder: send failed reply for transaction 426, target dead [ 286.960889][T12979] binder: 12978:12979 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 20:16:02 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r1, 0x540f, 0x0) [ 287.004880][T12987] binder: 12986:12987 ioctl c018620b 0 returned -14 [ 287.011703][T12979] binder: 12978:12979 got reply transaction with no transaction stack [ 287.021545][T12979] binder: 12978:12979 transaction failed 29201/-71, size 0-0 line 2900 20:16:02 executing program 5: openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r0 = syz_open_dev$video(0x0, 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:16:02 executing program 1: socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(0xffffffffffffffff, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) [ 287.065427][ T3759] binder: undelivered TRANSACTION_ERROR: 29201 [ 287.072849][T12991] binder: 12986:12991 unknown command 255 20:16:02 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 287.127747][T12991] binder: 12986:12991 ioctl c0306201 200001c0 returned -22 20:16:02 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r1, 0x540f, 0x0) 20:16:02 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 20:16:03 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:03 executing program 5: openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r0 = syz_open_dev$video(0x0, 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:16:03 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) write$FUSE_NOTIFY_INVAL_INODE(0xffffffffffffffff, 0x0, 0x0) 20:16:03 executing program 1: socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(0xffffffffffffffff, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:03 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 20:16:03 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r1, 0x540f, 0x0) [ 287.809843][ T3759] binder: send failed reply for transaction 432 to 12986:12987 [ 287.817630][ T3759] binder: undelivered TRANSACTION_COMPLETE [ 287.870507][ T3759] binder: undelivered TRANSACTION_ERROR: 29189 20:16:03 executing program 2: socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(0xffffffffffffffff, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:03 executing program 5: openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 287.914262][T13029] binder: 13027:13029 ioctl c018620b 0 returned -14 20:16:03 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 287.986157][T13034] binder: 13027:13034 unknown command 255 [ 288.023831][T13034] binder: 13027:13034 ioctl c0306201 200001c0 returned -22 20:16:03 executing program 1: socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(0xffffffffffffffff, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:03 executing program 5: openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 288.092456][T13040] binder: 13039:13040 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 20:16:03 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 288.140969][T13040] binder: 13039:13040 got reply transaction with no transaction stack [ 288.150523][T13040] binder: 13039:13040 transaction failed 29201/-71, size 0-0 line 2900 [ 288.190966][ T3759] binder: undelivered TRANSACTION_ERROR: 29201 20:16:04 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:04 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) write$FUSE_NOTIFY_INVAL_INODE(0xffffffffffffffff, 0x0, 0x0) 20:16:04 executing program 5: openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:16:04 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 20:16:04 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, 0x0, 0x2200, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:04 executing program 2: socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(0xffffffffffffffff, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) [ 288.710384][ T3759] binder: release 13027:13029 transaction 436 out, still active [ 288.718063][ T3759] binder: undelivered TRANSACTION_COMPLETE [ 288.725007][ T2997] binder: send failed reply for transaction 436, target dead [ 288.784895][T13070] binder: 13065:13070 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 288.817556][T13069] binder: 13066:13069 ioctl c018620b 0 returned -14 20:16:04 executing program 5: openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 288.832716][T13070] binder: 13065:13070 got reply transaction with no transaction stack [ 288.849551][T13070] binder: 13065:13070 transaction failed 29201/-71, size 0-0 line 2900 20:16:04 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 288.877622][ T2997] binder: undelivered TRANSACTION_ERROR: 29201 [ 288.895189][T13076] binder: 13066:13076 unknown command 255 [ 288.903930][T13076] binder: 13066:13076 ioctl c0306201 200001c0 returned -22 20:16:04 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) write$FUSE_NOTIFY_INVAL_INODE(0xffffffffffffffff, 0x0, 0x0) 20:16:04 executing program 3: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 288.955168][T13079] binder: 13078:13079 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 288.964208][T13079] binder: 13078:13079 got reply transaction with no transaction stack [ 288.980358][T13079] binder: 13078:13079 transaction failed 29201/-71, size 0-0 line 2900 [ 288.993149][ T3759] binder: undelivered TRANSACTION_ERROR: 29201 20:16:04 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:04 executing program 5: openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) [ 289.057585][T13086] binder: 13084:13086 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 289.077605][T13086] binder: 13084:13086 got reply transaction with no transaction stack [ 289.092386][T13086] binder: 13084:13086 transaction failed 29201/-71, size 0-0 line 2900 [ 289.117391][ T3759] binder: undelivered TRANSACTION_ERROR: 29201 20:16:04 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:04 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, 0x0, 0x2200, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:04 executing program 3: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 20:16:04 executing program 5: openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:16:04 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:04 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 289.583779][ T2997] binder: release 13066:13069 transaction 442 out, still active [ 289.596944][ T3759] binder: send failed reply for transaction 442, target dead 20:16:05 executing program 5: openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, 0x0) [ 289.659244][T13107] binder: 13105:13107 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 289.689056][T13107] binder: 13105:13107 got reply transaction with no transaction stack [ 289.700332][T13107] binder: 13105:13107 transaction failed 29201/-71, size 0-0 line 2900 20:16:05 executing program 3: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 289.711552][T13111] binder: 13109:13111 ioctl c018620b 0 returned -14 20:16:05 executing program 5: openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, 0x0) 20:16:05 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, 0x0, 0x2200, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:05 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, 0x0, 0x2200, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 289.780432][T13117] binder: 13109:13117 unknown command 255 [ 289.786223][T13117] binder: 13109:13117 ioctl c0306201 200001c0 returned -22 [ 289.820104][T13119] binder: 13118:13119 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 20:16:05 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 289.909819][T13119] binder: 13118:13119 got reply transaction with no transaction stack [ 289.935525][T13119] binder: 13118:13119 transaction failed 29201/-71, size 0-0 line 2900 20:16:05 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:05 executing program 5: openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, 0x0) 20:16:05 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 20:16:05 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:05 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:05 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, 0x0, 0x2200, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 290.469803][ T3759] binder: release 13109:13111 transaction 449 out, still active [ 290.477539][ T3759] binder: undelivered TRANSACTION_COMPLETE [ 290.486918][ T3759] binder: send failed reply for transaction 449, target dead [ 290.547301][T13146] binder: 13139:13146 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 290.583383][T13146] binder: 13139:13146 got reply transaction with no transaction stack 20:16:06 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:06 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, 0x0, 0x2200, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:06 executing program 5: openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x0, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:16:06 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 290.601411][T13146] binder: 13139:13146 transaction failed 29201/-71, size 0-0 line 2900 [ 290.615967][T13150] binder: 13149:13150 ioctl c018620b 0 returned -14 [ 290.637874][ T3759] binder_release_work: 2 callbacks suppressed [ 290.637881][ T3759] binder: undelivered TRANSACTION_ERROR: 29201 20:16:06 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 290.679296][T13155] binder: 13149:13155 unknown command 255 [ 290.726708][T13155] binder: 13149:13155 ioctl c0306201 200001c0 returned -22 20:16:06 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 290.804795][T13168] binder: 13166:13168 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 290.824863][T13168] binder: 13166:13168 got reply transaction with no transaction stack [ 290.867955][T13168] binder: 13166:13168 transaction failed 29201/-71, size 0-0 line 2900 [ 290.899133][ T3759] binder: undelivered TRANSACTION_ERROR: 29201 20:16:06 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:06 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, 0x0, 0x2200, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:06 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:06 executing program 5: openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x0, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:16:06 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 20:16:06 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 291.397732][ T2997] binder: send failed reply for transaction 455 to 13149:13150 [ 291.405472][ T2997] binder: undelivered TRANSACTION_COMPLETE [ 291.449569][ T2997] binder: undelivered TRANSACTION_ERROR: 29189 [ 291.463672][T13185] binder: 13179:13185 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 291.488896][T13185] binder: 13179:13185 got reply transaction with no transaction stack 20:16:06 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:06 executing program 5: openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x0, 0x0, [], &(0x7f0000000000)={0xf0f046, 0x0, [], @p_u8=0x0}}) 20:16:06 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 291.504005][T13185] binder: 13179:13185 transaction failed 29201/-71, size 0-0 line 2900 [ 291.516516][T13191] binder: 13190:13191 ioctl c018620b 0 returned -14 [ 291.540367][ T3759] binder: undelivered TRANSACTION_ERROR: 29201 20:16:07 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 20:16:07 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:07 executing program 5: openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], 0x0}) [ 291.627890][T13198] binder: 13190:13198 unknown command 255 [ 291.654814][T13198] binder: 13190:13198 ioctl c0306201 200001c0 returned -22 [ 291.698645][T13207] binder: 13205:13207 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 291.717681][T13207] binder: 13205:13207 got reply transaction with no transaction stack [ 291.741817][T13207] binder: 13205:13207 transaction failed 29201/-71, size 0-0 line 2900 [ 291.758113][ T2997] binder: undelivered TRANSACTION_ERROR: 29201 20:16:07 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:07 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:07 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 20:16:07 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:07 executing program 5: openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], 0x0}) 20:16:07 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 292.265372][ T3759] binder: release 13190:13191 transaction 461 out, still active [ 292.279374][ T2997] binder: send failed reply for transaction 461, target dead 20:16:07 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 292.339642][T13228] binder: 13224:13228 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 292.359669][T13230] binder: 13222:13230 ioctl c018620b 0 returned -14 [ 292.370902][T13228] binder: 13224:13228 got reply transaction with no transaction stack 20:16:07 executing program 5: openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], 0x0}) [ 292.385416][T13228] binder: 13224:13228 transaction failed 29201/-71, size 0-0 line 2900 20:16:07 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 20:16:07 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 292.418380][ T2997] binder: undelivered TRANSACTION_ERROR: 29201 [ 292.427266][T13236] binder: 13222:13236 unknown command 255 [ 292.435947][T13236] binder: 13222:13236 ioctl c0306201 200001c0 returned -22 20:16:07 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:07 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 292.534981][T13244] binder: 13243:13244 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 292.544063][T13244] binder: 13243:13244 got reply transaction with no transaction stack [ 292.553154][T13244] binder: 13243:13244 transaction failed 29201/-71, size 0-0 line 2900 [ 292.568315][ T3759] binder: undelivered TRANSACTION_ERROR: 29201 [ 292.696548][T13253] binder: 13251:13253 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 292.708958][T13253] binder: 13251:13253 got reply transaction with no transaction stack [ 292.723062][T13253] binder: 13251:13253 transaction failed 29201/-71, size 0-0 line 2900 [ 292.734132][ T3759] binder: undelivered TRANSACTION_ERROR: 29201 20:16:08 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:08 executing program 5: openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0x0, 0x0, [], @p_u8=0x0}}) 20:16:08 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:08 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:08 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:08 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 293.148841][ T2997] binder: release 13222:13230 transaction 467 out, still active [ 293.160839][ T3759] binder: send failed reply for transaction 467, target dead [ 293.218413][T13263] binder: 13261:13263 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 293.257495][T13269] binder: 13267:13269 ioctl c018620b 0 returned -14 20:16:08 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:08 executing program 5: openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0x0, 0x0, [], @p_u8=0x0}}) 20:16:08 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) read(0xffffffffffffffff, &(0x7f0000000540)=""/82, 0x52) [ 293.260927][T13263] binder: 13261:13263 got reply transaction with no transaction stack [ 293.287448][T13263] binder: 13261:13263 transaction failed 29201/-71, size 0-0 line 2900 [ 293.346838][ T2997] binder: undelivered TRANSACTION_ERROR: 29201 [ 293.366885][T13272] binder: 13267:13272 unknown command 255 [ 293.384392][T13272] binder: 13267:13272 ioctl c0306201 200001c0 returned -22 20:16:08 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 20:16:08 executing program 5: openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) shmget$private(0x0, 0x4000, 0x55000000, &(0x7f0000ffb000/0x4000)=nil) shmdt(0x0) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000040)={0x0, 0x1, 0x0, [], &(0x7f0000000000)={0x0, 0x0, [], @p_u8=0x0}}) 20:16:08 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 293.493314][T13285] binder: 13283:13285 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 293.517573][T13285] binder: 13283:13285 got reply transaction with no transaction stack [ 293.534694][T13285] binder: 13283:13285 transaction failed 29201/-71, size 0-0 line 2900 [ 293.548307][ T3759] binder: undelivered TRANSACTION_ERROR: 29201 20:16:09 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:09 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) read(0xffffffffffffffff, &(0x7f0000000540)=""/82, 0x52) 20:16:09 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 20:16:09 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:09 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:09 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 294.020610][ T2997] binder: release 13267:13269 transaction 474 out, still active [ 294.034879][ T3759] binder: send failed reply for transaction 474, target dead [ 294.091599][T13304] binder: 13295:13304 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 20:16:09 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:09 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) read(0xffffffffffffffff, &(0x7f0000000540)=""/82, 0x52) [ 294.136735][T13304] binder: 13295:13304 got reply transaction with no transaction stack [ 294.144103][T13308] binder: 13306:13308 ioctl c018620b 0 returned -14 [ 294.166277][T13304] binder: 13295:13304 transaction failed 29201/-71, size 0-0 line 2900 20:16:09 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 20:16:09 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:09 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 294.296273][T13310] binder: 13306:13310 unknown command 255 20:16:09 executing program 2: openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) [ 294.340964][T13310] binder: 13306:13310 ioctl c0306201 200001c0 returned -22 20:16:10 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:10 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 20:16:10 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:10 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:10 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:10 executing program 2: openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) [ 294.930788][ T2997] binder: release 13306:13308 transaction 480 out, still active [ 294.945051][ T3759] binder: send failed reply for transaction 480, target dead 20:16:10 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 20:16:10 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:10 executing program 2: openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:10 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 295.078985][T13347] binder: 13346:13347 ioctl c018620b 0 returned -14 20:16:10 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 295.206143][T13351] binder: 13346:13351 unknown command 255 [ 295.244770][T13351] binder: 13346:13351 ioctl c0306201 200001c0 returned -22 20:16:10 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:11 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:11 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:11 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:11 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 20:16:11 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:11 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 295.870291][ T2997] binder: release 13346:13347 transaction 486 out, still active [ 295.915472][T13381] binder_thread_write: 3 callbacks suppressed [ 295.915486][T13381] binder: 13375:13381 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 295.916160][ T2997] binder: undelivered TRANSACTION_COMPLETE [ 295.931266][T13381] binder_transaction: 3 callbacks suppressed [ 295.931278][T13381] binder: 13375:13381 got reply transaction with no transaction stack [ 295.984316][T13381] binder_transaction: 3 callbacks suppressed [ 295.984333][T13381] binder: 13375:13381 transaction failed 29201/-71, size 0-0 line 2900 20:16:11 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:11 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:11 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 20:16:11 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:11 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 296.031663][T13386] binder: 13382:13386 ioctl c018620b 0 returned -14 [ 296.038711][ T2997] binder_release_work: 4 callbacks suppressed [ 296.038718][ T2997] binder: undelivered TRANSACTION_ERROR: 29201 [ 296.055782][ T2997] binder: send failed reply for transaction 486, target dead [ 296.115294][T13394] binder: 13382:13394 unknown command 255 [ 296.150387][T13394] binder: 13382:13394 ioctl c0306201 200001c0 returned -22 20:16:11 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 296.196543][T13401] binder: 13397:13401 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 296.215881][T13401] binder: 13397:13401 got reply transaction with no transaction stack [ 296.249943][T13401] binder: 13397:13401 transaction failed 29201/-71, size 0-0 line 2900 [ 296.282068][ T3759] binder: undelivered TRANSACTION_ERROR: 29201 20:16:12 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b0") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:12 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:12 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 20:16:12 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:12 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:12 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 296.780368][ T3759] binder: release 13382:13386 transaction 492 out, still active [ 296.794483][ T2997] binder: send failed reply for transaction 492, target dead 20:16:12 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 296.863546][T13419] binder: 13414:13419 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 296.882703][T13425] binder: 13415:13425 ioctl c018620b 0 returned -14 [ 296.900352][T13419] binder: 13414:13419 got reply transaction with no transaction stack 20:16:12 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 296.915383][T13419] binder: 13414:13419 transaction failed 29201/-71, size 0-0 line 2900 [ 296.953924][ T2997] binder: undelivered TRANSACTION_ERROR: 29201 20:16:12 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:12 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 296.963829][T13430] binder: 13415:13430 unknown command 255 [ 296.969611][T13430] binder: 13415:13430 ioctl c0306201 200001c0 returned -22 20:16:12 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 297.043839][T13436] binder: 13435:13436 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 297.055989][T13436] binder: 13435:13436 got reply transaction with no transaction stack [ 297.074046][T13436] binder: 13435:13436 transaction failed 29201/-71, size 0-0 line 2900 [ 297.086247][ T2997] binder: undelivered TRANSACTION_ERROR: 29201 20:16:12 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 297.213384][T13446] binder: 13444:13446 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 297.228378][T13446] binder: 13444:13446 got reply transaction with no transaction stack [ 297.249455][T13446] binder: 13444:13446 transaction failed 29201/-71, size 0-0 line 2900 [ 297.259374][ T2997] binder: undelivered TRANSACTION_ERROR: 29201 20:16:13 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b0") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:13 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:13 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:13 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:13 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:13 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b0") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 297.663233][ T3759] binder: release 13415:13425 transaction 498 out, still active [ 297.677722][ T2997] binder: send failed reply for transaction 498, target dead [ 297.701829][T13452] binder: 13451:13452 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 297.757701][T13452] binder: 13451:13452 got reply transaction with no transaction stack [ 297.761404][T13462] binder: 13461:13462 ioctl c018620b 0 returned -14 20:16:13 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:13 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b0") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 297.798662][T13452] binder: 13451:13452 transaction failed 29201/-71, size 0-0 line 2900 [ 297.833353][ T2997] binder: undelivered TRANSACTION_ERROR: 29201 [ 297.839247][T13465] binder: 13461:13465 unknown command 255 20:16:13 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:13 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:13 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 297.898187][T13465] binder: 13461:13465 ioctl c0306201 200001c0 returned -22 [ 297.979626][T13477] binder: 13469:13477 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 297.981480][ T3759] binder: release 13461:13465 transaction 505 out, still active [ 298.030717][T13477] binder: 13469:13477 got reply transaction with no transaction stack [ 298.050857][T13477] binder: 13469:13477 transaction failed 29201/-71, size 0-0 line 2900 20:16:13 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b0") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:13 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:13 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 298.075350][ T3759] binder: send failed reply for transaction 505, target dead 20:16:13 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:13 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 298.158124][ T2997] binder: undelivered TRANSACTION_ERROR: 29201 20:16:13 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b0") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 298.205354][T13491] binder: 13487:13491 ioctl c018620b 0 returned -14 20:16:13 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) [ 298.305889][T13500] binder: 13487:13500 unknown command 255 [ 298.318962][T13502] binder: 13501:13502 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 298.340349][T13500] binder: 13487:13500 ioctl c0306201 200001c0 returned -22 [ 298.352089][T13502] binder: 13501:13502 got reply transaction with no transaction stack 20:16:13 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:13 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:13 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 298.387567][T13502] binder: 13501:13502 transaction failed 29201/-71, size 0-0 line 2900 [ 298.440288][ T3759] binder: undelivered TRANSACTION_ERROR: 29201 20:16:13 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 20:16:13 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:14 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:14 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:14 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 20:16:14 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:14 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:14 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) [ 298.998389][ T3759] binder: send failed reply for transaction 510 to 13487:13491 20:16:14 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 299.050379][ T3759] binder: undelivered TRANSACTION_COMPLETE [ 299.072619][ T3759] binder: undelivered TRANSACTION_ERROR: 29189 20:16:14 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 20:16:14 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:14 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:14 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:14 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:14 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 20:16:14 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, 0x0, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:14 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:14 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:14 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:14 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:14 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 20:16:14 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, 0x0, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:14 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:15 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:15 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:15 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:15 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 20:16:15 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, 0x0, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 299.742251][T13598] binder: 13594:13598 ioctl c018620b 0 returned -14 20:16:15 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:15 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) [ 299.799942][T13598] binder_alloc: 13594: binder_alloc_buf, no vma [ 299.832808][T13598] binder: 13594:13598 transaction failed 29189/-3, size 24-8 line 3148 20:16:15 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 299.911769][T13598] binder: 13594:13598 Release 1 refcount change on invalid ref 1 ret -22 [ 299.950981][T13619] binder: 13614:13619 ioctl c0306201 0 returned -14 20:16:15 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:15 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:15 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) [ 299.969998][T13598] binder: 13594:13598 unknown command 255 [ 300.000556][T13598] binder: 13594:13598 ioctl c0306201 200001c0 returned -22 20:16:15 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 20:16:15 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:15 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:15 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 300.158391][T13637] binder: 13634:13637 ioctl c0306201 0 returned -14 20:16:15 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:15 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:15 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) [ 300.296846][T13650] binder: 13639:13650 ioctl c018620b 0 returned -14 [ 300.322405][T13654] binder: 13648:13654 ioctl c0306201 0 returned -14 [ 300.325085][T13650] binder_alloc: 13639: binder_alloc_buf, no vma 20:16:15 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:15 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:15 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 20:16:15 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:15 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 300.362119][T13650] binder: 13639:13650 transaction failed 29189/-3, size 24-8 line 3148 [ 300.451108][T13662] binder: 13639:13662 Release 1 refcount change on invalid ref 1 ret -22 20:16:15 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) [ 300.492764][T13662] binder: 13639:13662 unknown command 255 [ 300.511960][T13662] binder: 13639:13662 ioctl c0306201 200001c0 returned -22 20:16:16 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 20:16:16 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:16 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:16 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:16 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:16 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 20:16:16 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 300.698075][T13687] binder: 13686:13687 ioctl c018620b 0 returned -14 [ 300.718627][T13687] binder_alloc: 13686: binder_alloc_buf, no vma [ 300.768865][T13687] binder: 13686:13687 Release 1 refcount change on invalid ref 1 ret -22 [ 300.836901][T13687] binder: 13686:13687 unknown command 255 [ 300.874240][T13687] binder: 13686:13687 ioctl c0306201 200001c0 returned -22 20:16:16 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:16 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000f40)=[@request_death], 0x0, 0x0, 0x0}) 20:16:16 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:16 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:16 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:16 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) [ 301.003971][T13704] binder: 13703:13704 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 20:16:16 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000f40)=[@request_death], 0x0, 0x0, 0x0}) 20:16:16 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, 0x0, 0x0, 0x400000000000) 20:16:16 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 301.117074][T13715] binder: 13714:13715 ioctl c018620b 0 returned -14 [ 301.135980][T13721] binder: 13718:13721 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 20:16:16 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, 0x0, 0x0, 0x400000000000) 20:16:16 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000f40)=[@request_death], 0x0, 0x0, 0x0}) [ 301.169189][T13715] binder_alloc: 13714: binder_alloc_buf, no vma [ 301.184274][T13715] binder_transaction: 1 callbacks suppressed [ 301.184292][T13715] binder: 13714:13715 transaction failed 29189/-3, size 24-8 line 3148 [ 301.208133][T13715] binder: 13714:13715 Release 1 refcount change on invalid ref 1 ret -22 20:16:16 executing program 1: openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty}, 0xffc5) ioctl$NBD_DO_IT(0xffffffffffffffff, 0xab03) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) 20:16:16 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:16 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:16 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, 0x0, 0x0, 0x400000000000) [ 301.293859][T13715] binder: 13714:13715 unknown command 255 [ 301.305320][T13731] binder: 13729:13731 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 301.331530][T13715] binder: 13714:13715 ioctl c0306201 200001c0 returned -22 20:16:16 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000f40)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 20:16:16 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:16 executing program 1: openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty}, 0xffc5) ioctl$NBD_DO_IT(0xffffffffffffffff, 0xab03) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) 20:16:16 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:16 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) [ 301.565779][T13752] binder: 13748:13752 ioctl c018620b 0 returned -14 [ 301.579450][T13750] binder: 13747:13750 got reply transaction with no transaction stack [ 301.598383][T13750] binder: 13747:13750 transaction failed 29201/-71, size 0-0 line 2900 [ 301.609494][T13752] binder_alloc: 13748: binder_alloc_buf, no vma 20:16:17 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:17 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000f40)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 301.632477][T13752] binder: 13748:13752 transaction failed 29189/-3, size 24-8 line 3148 [ 301.646924][ T3759] binder: undelivered TRANSACTION_ERROR: 29201 [ 301.665036][T13760] binder: 13748:13760 Release 1 refcount change on invalid ref 1 ret -22 [ 301.709255][T13760] binder: 13748:13760 unknown command 255 20:16:17 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) [ 301.757869][T13760] binder: 13748:13760 ioctl c0306201 200001c0 returned -22 [ 301.767665][T13767] binder: 13765:13767 got reply transaction with no transaction stack 20:16:17 executing program 1: openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty}, 0xffc5) ioctl$NBD_DO_IT(0xffffffffffffffff, 0xab03) r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r0, &(0x7f0000000540)=""/82, 0x52) 20:16:17 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:17 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 301.834940][T13767] binder: 13765:13767 transaction failed 29201/-71, size 0-0 line 2900 20:16:17 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:17 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000f40)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 301.916157][ T3759] binder: undelivered TRANSACTION_ERROR: 29201 20:16:17 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) [ 302.008720][T13784] binder: 13779:13784 ioctl c018620b 0 returned -14 20:16:17 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:17 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(0x0, 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) [ 302.062705][T13784] binder_alloc: 13779: binder_alloc_buf, no vma [ 302.104148][T13792] binder: 13786:13792 got reply transaction with no transaction stack [ 302.107525][T13784] binder: 13779:13784 transaction failed 29189/-3, size 24-8 line 3148 20:16:17 executing program 2: socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(0xffffffffffffffff, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) [ 302.149787][T13792] binder: 13786:13792 transaction failed 29201/-71, size 0-0 line 2900 20:16:17 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:17 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(0x0, 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) [ 302.200271][T13789] binder: 13779:13789 Release 1 refcount change on invalid ref 1 ret -22 [ 302.208742][T13789] binder: 13779:13789 unknown command 255 [ 302.235742][ T3759] binder: undelivered TRANSACTION_ERROR: 29201 20:16:17 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:17 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:17 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(0x0, 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:17 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, 0x0, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 302.440387][T13789] binder: 13779:13789 ioctl c0306201 200001c0 returned -22 20:16:17 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:17 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:17 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x0, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:17 executing program 2: socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(0xffffffffffffffff, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:18 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) [ 302.647870][T13825] binder: 13823:13825 unknown command 255 20:16:18 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, 0x0, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 302.692698][T13825] binder: 13823:13825 ioctl c0306201 200001c0 returned -22 20:16:18 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:18 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x0, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) [ 302.755830][ T3759] binder: release 13823:13825 transaction 530 out, still active 20:16:18 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) [ 302.849620][ T3759] binder: send failed reply for transaction 530, target dead 20:16:18 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, 0x0, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:18 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:18 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x0, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) [ 302.949111][T13849] binder: 13847:13849 unknown command 255 20:16:18 executing program 2: socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(0xffffffffffffffff, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:18 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) [ 303.025189][T13849] binder: 13847:13849 ioctl c0306201 200001c0 returned -22 20:16:18 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 303.075668][ T2997] binder: release 13847:13849 transaction 534 out, still active 20:16:18 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(0xffffffffffffffff, &(0x7f0000000540)=""/82, 0x52) 20:16:18 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) [ 303.180015][ T2997] binder: send failed reply for transaction 534, target dead 20:16:18 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:18 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:18 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:18 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(0xffffffffffffffff, &(0x7f0000000540)=""/82, 0x52) [ 303.301388][T13876] binder: 13870:13876 unknown command 255 [ 303.339037][T13876] binder: 13870:13876 ioctl c0306201 200001c0 returned -22 20:16:18 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 303.371570][ T2997] binder: release 13870:13876 transaction 538 out, still active 20:16:18 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:18 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) [ 303.432301][ T2997] binder: send failed reply for transaction 538, target dead 20:16:18 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:18 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(0xffffffffffffffff, &(0x7f0000000540)=""/82, 0x52) 20:16:18 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 303.544408][T13895] binder: 13892:13895 ioctl c018620b 0 returned -14 [ 303.566656][T13895] binder: 13892:13895 transaction failed 29189/-22, size 24-8 line 2995 20:16:19 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 303.614703][T13904] binder: 13892:13904 Release 1 refcount change on invalid ref 1 ret -22 20:16:19 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x0) [ 303.670882][T13904] binder: 13892:13904 unknown command 255 20:16:19 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, 0x0, 0x0) 20:16:19 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) [ 303.711120][T13904] binder: 13892:13904 ioctl c0306201 200001c0 returned -22 20:16:19 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:19 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:19 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:19 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:19 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, 0x0, 0x0) 20:16:19 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x0) [ 303.914393][T13924] binder: 13922:13924 ioctl c018620b 0 returned -14 [ 303.959122][T13924] binder: 13922:13924 transaction failed 29189/-22, size 24-8 line 2995 20:16:19 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x0) [ 304.001469][T13924] binder: 13922:13924 Release 1 refcount change on invalid ref 1 ret -22 [ 304.032891][T13924] binder: 13922:13924 unknown command 255 20:16:19 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:19 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 304.053408][T13924] binder: 13922:13924 ioctl c0306201 200001c0 returned -22 20:16:19 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:19 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:19 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:19 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x0) [ 304.224191][T13950] binder: 13949:13950 ioctl c018620b 0 returned -14 [ 304.254226][T13950] binder: 13949:13950 transaction failed 29189/-22, size 24-8 line 2995 20:16:19 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:19 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 304.315004][T13959] binder: 13949:13959 Release 1 refcount change on invalid ref 1 ret -22 20:16:19 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) [ 304.363238][T13959] binder: 13949:13959 unknown command 255 [ 304.369026][T13959] binder: 13949:13959 ioctl c0306201 200001c0 returned -22 20:16:19 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:19 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, 0x0, 0x0, 0x400000000000) 20:16:19 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:19 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:20 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:20 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:20 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, 0x0, 0x0, 0x400000000000) [ 304.589446][T13979] binder: 13978:13979 ioctl c018620b 0 returned -14 20:16:20 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:20 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 304.670098][T13979] binder: 13978:13979 Release 1 refcount change on invalid ref 1 ret -22 [ 304.724931][T13979] binder: 13978:13979 unknown command 255 20:16:20 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, 0x0, 0x0, 0x400000000000) 20:16:20 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) [ 304.766824][T13979] binder: 13978:13979 ioctl c0306201 200001c0 returned -22 20:16:20 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:20 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:20 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:20 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:20 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:20 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 305.027202][T14016] binder: 14015:14016 ioctl c018620b 0 returned -14 [ 305.072224][T14016] binder: 14015:14016 Release 1 refcount change on invalid ref 1 ret -22 [ 305.107959][T14016] binder: 14015:14016 unknown command 255 [ 305.149370][T14016] binder: 14015:14016 ioctl c0306201 200001c0 returned -22 20:16:20 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:20 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:20 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:20 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:20 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) [ 305.384130][T14041] binder: 14037:14041 ioctl c018620b 0 returned -14 [ 305.419876][T14041] binder: 14037:14041 Release 1 refcount change on invalid ref 1 ret -22 20:16:20 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:20 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 305.502235][T14041] binder: 14037:14041 unknown command 255 20:16:20 executing program 0: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:20 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) [ 305.545005][T14041] binder: 14037:14041 ioctl c0306201 200001c0 returned -22 20:16:21 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:21 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:21 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:21 executing program 1: socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(0xffffffffffffffff, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) [ 305.712569][T14062] binder: 14059:14062 ioctl c018620b 0 returned -14 [ 305.763114][T14062] binder: 14059:14062 ioctl c0306201 0 returned -14 20:16:21 executing program 0: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:21 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) [ 305.816288][T14068] binder: 14059:14068 Release 1 refcount change on invalid ref 1 ret -22 20:16:21 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) [ 305.888487][T14068] binder: 14059:14068 unknown command 255 [ 305.900839][T14068] binder: 14059:14068 ioctl c0306201 200001c0 returned -22 20:16:21 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:21 executing program 0: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:21 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:21 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:21 executing program 1: socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(0xffffffffffffffff, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) [ 306.050484][T14086] binder: 14082:14086 ioctl c018620b 0 returned -14 [ 306.086580][T14086] binder: 14082:14086 ioctl c0306201 0 returned -14 20:16:21 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) [ 306.128627][T14086] binder: 14082:14086 Release 1 refcount change on invalid ref 1 ret -22 20:16:21 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) [ 306.175854][T14086] binder: 14082:14086 unknown command 255 [ 306.195475][T14086] binder: 14082:14086 ioctl c0306201 200001c0 returned -22 20:16:21 executing program 5: socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(0xffffffffffffffff, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:21 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:21 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:21 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:21 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) [ 306.370938][T14113] binder: 14110:14113 ioctl c018620b 0 returned -14 [ 306.384366][T14113] binder: 14110:14113 ioctl c0306201 0 returned -14 [ 306.398772][T14113] binder: 14110:14113 Release 1 refcount change on invalid ref 1 ret -22 20:16:21 executing program 1: socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(0xffffffffffffffff, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) [ 306.440420][T14113] binder: 14110:14113 unknown command 255 [ 306.448610][T14113] binder: 14110:14113 ioctl c0306201 200001c0 returned -22 20:16:21 executing program 5: socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(0xffffffffffffffff, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:21 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:21 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:21 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:21 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:22 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:22 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) [ 306.685095][T14138] binder: 14134:14138 ioctl c018620b 0 returned -14 [ 306.696894][T14138] binder: 14134:14138 Release 1 refcount change on invalid ref 1 ret -22 [ 306.716952][T14138] binder: 14134:14138 unknown command 255 [ 306.724444][T14138] binder: 14134:14138 ioctl c0306201 200001c0 returned -22 20:16:22 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:22 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:22 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) [ 306.839732][T14149] binder: 14148:14149 ioctl c018620b 0 returned -14 [ 306.866181][T14149] binder: 14148:14149 Release 1 refcount change on invalid ref 1 ret -22 20:16:22 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, 0x0, 0x0, 0x400000000000) 20:16:22 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:22 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 306.916058][T14149] binder: 14148:14149 unknown command 255 20:16:22 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) [ 306.958027][T14149] binder: 14148:14149 ioctl c0306201 200001c0 returned -22 20:16:22 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:22 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:22 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:22 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:22 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) [ 307.170031][T14176] binder: 14172:14176 ioctl c018620b 0 returned -14 [ 307.205156][T14176] binder: 14172:14176 Release 1 refcount change on invalid ref 1 ret -22 20:16:22 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) [ 307.239477][T14176] binder: 14172:14176 unknown command 255 [ 307.255810][T14176] binder: 14172:14176 ioctl c0306201 200001c0 returned -22 20:16:22 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:22 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:22 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:22 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:22 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) [ 307.421927][T14197] binder: 14193:14197 ioctl c018620b 0 returned -14 [ 307.429335][T14197] binder: 14193:14197 Release 1 refcount change on invalid ref 1 ret -22 [ 307.447839][T14197] binder: 14193:14197 unknown command 255 [ 307.469098][T14197] binder: 14193:14197 ioctl c0306201 200001c0 returned -22 20:16:22 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:22 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:22 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:23 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:23 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:23 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) [ 307.736536][T14215] binder: 14207:14215 ioctl c018620b 0 returned -14 20:16:23 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:23 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 307.802068][T14215] binder: 14207:14215 Release 1 refcount change on invalid ref 1 ret -22 20:16:23 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:23 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 307.943777][T14215] binder: 14207:14215 unknown command 255 [ 307.990476][T14215] binder: 14207:14215 ioctl c0306201 200001c0 returned -22 20:16:23 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:23 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:23 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:23 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:23 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:23 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, 0x0, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:23 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:23 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:23 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 308.379773][T14253] binder: 14249:14253 ioctl c018620b 0 returned -14 20:16:23 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:23 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, 0x0, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) [ 308.482820][T14253] binder: 14249:14253 unknown command 255 [ 308.488776][T14253] binder: 14249:14253 ioctl c0306201 200001c0 returned -22 20:16:23 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:24 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:24 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:24 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:24 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, 0x0, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:24 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:24 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, 0x0, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) [ 308.880855][T14290] binder: 14283:14290 ioctl c018620b 0 returned -14 20:16:24 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) [ 308.952181][T14290] binder: 14283:14290 got transaction with invalid offset (0, min 0 max 0) or object. 20:16:24 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, 0x0, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:24 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 308.993764][T14290] binder: 14283:14290 transaction failed 29201/-22, size 0-8 line 3242 20:16:24 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:24 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 309.084309][T14294] binder: 14283:14294 unknown command 255 [ 309.114883][T14294] binder: 14283:14294 ioctl c0306201 200001c0 returned -22 20:16:24 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:24 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, 0x0, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) [ 309.176848][ T2997] binder: undelivered TRANSACTION_ERROR: 29201 20:16:24 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:24 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:24 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:24 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:24 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 309.366317][T14322] binder: 14317:14322 ioctl c018620b 0 returned -14 [ 309.420792][T14322] binder: 14317:14322 got transaction with invalid offset (0, min 0 max 0) or object. 20:16:24 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:24 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:24 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 309.556537][T14330] binder: 14317:14330 unknown command 255 [ 309.582455][T14322] binder: 14317:14322 transaction failed 29201/-22, size 0-8 line 3242 [ 309.589284][T14330] binder: 14317:14330 ioctl c0306201 200001c0 returned -22 20:16:25 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:25 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:25 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x0) [ 309.621995][ T3759] binder: undelivered TRANSACTION_ERROR: 29201 [ 309.702204][T14349] binder: 14346:14349 ioctl c018620b 0 returned -14 [ 309.728086][T14349] binder: 14346:14349 got transaction with invalid offset (0, min 0 max 0) or object. 20:16:25 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:25 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x0) [ 309.755139][T14349] binder: 14346:14349 transaction failed 29201/-22, size 0-8 line 3242 [ 309.775276][T14354] binder: 14346:14354 unknown command 255 20:16:25 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:25 executing program 1: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 20:16:25 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 309.810501][T14354] binder: 14346:14354 ioctl c0306201 200001c0 returned -22 20:16:25 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x0) [ 309.910914][ T3759] binder: undelivered TRANSACTION_ERROR: 29201 20:16:25 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, 0x0, 0x0, 0x0) 20:16:25 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:25 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:25 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:25 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x0) [ 310.094630][T14378] binder: 14376:14378 ioctl c018620b 0 returned -14 20:16:25 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 310.158111][T14378] binder: 14376:14378 got transaction with invalid offset (0, min 0 max 0) or object. 20:16:25 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, 0x0, 0x0, 0x0) [ 310.198570][T14378] binder: 14376:14378 transaction failed 29201/-22, size 0-8 line 3242 20:16:25 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 310.241290][T14386] binder_thread_write: 4 callbacks suppressed [ 310.241306][T14386] binder: 14376:14386 Release 1 refcount change on invalid ref 1 ret -22 20:16:25 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:25 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, 0x0, 0x0, 0x0) [ 310.309636][T14386] binder: 14376:14386 unknown command 255 [ 310.331675][T14386] binder: 14376:14386 ioctl c0306201 200001c0 returned -22 20:16:25 executing program 5: openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) [ 310.382748][ T3759] binder: undelivered TRANSACTION_ERROR: 29201 20:16:25 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:25 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1fe, 0x0) 20:16:25 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:25 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:26 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 310.572111][T14415] binder: 14413:14415 ioctl c018620b 0 returned -14 [ 310.598820][T14415] binder: 14413:14415 got transaction with invalid offset (0, min 0 max 0) or object. [ 310.624944][T14415] binder: 14413:14415 transaction failed 29201/-22, size 0-8 line 3242 20:16:26 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, 0x0, 0x0, 0x0) 20:16:26 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 310.711079][T14427] binder: 14413:14427 Release 1 refcount change on invalid ref 1 ret -22 [ 310.725678][T14427] binder: 14413:14427 unknown command 255 20:16:26 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 310.757212][T14427] binder: 14413:14427 ioctl c0306201 200001c0 returned -22 20:16:26 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 310.800357][ T2997] binder: undelivered TRANSACTION_ERROR: 29201 20:16:26 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f0000000f40)=[@request_death, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 20:16:26 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:26 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:26 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, 0x0, 0x0, 0x0) 20:16:26 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) [ 310.996672][T14449] binder: 14444:14449 ioctl c018620b 0 returned -14 [ 311.032174][T14451] binder: 14446:14451 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 311.049767][T14449] binder: 14444:14449 got transaction with invalid offset (0, min 0 max 0) or object. [ 311.059925][T14451] binder: 14446:14451 got reply transaction with no transaction stack [ 311.069221][T14449] binder: 14444:14449 transaction failed 29201/-22, size 0-8 line 3242 [ 311.078855][T14451] binder: 14446:14451 transaction failed 29201/-71, size 0-0 line 2900 [ 311.088078][T14449] binder: 14444:14449 Release 1 refcount change on invalid ref 1 ret -22 20:16:26 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, 0x0, 0x0, 0x0) [ 311.096798][T14449] binder: 14444:14449 unknown command 255 [ 311.107273][T14449] binder: 14444:14449 ioctl c0306201 200001c0 returned -22 [ 311.132012][ T2997] binder: undelivered TRANSACTION_ERROR: 29201 20:16:26 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) [ 311.153939][ T2997] binder: undelivered TRANSACTION_ERROR: 29201 20:16:26 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:26 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:26 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:26 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:26 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) [ 311.334344][T14472] binder: 14467:14472 ioctl c018620b 0 returned -14 [ 311.392982][T14472] binder: 14467:14472 got transaction with invalid offset (0, min 0 max 24) or object. 20:16:26 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:26 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) read(0xffffffffffffffff, &(0x7f0000000540)=""/82, 0x52) 20:16:26 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) [ 311.484188][T14476] binder: 14467:14476 Release 1 refcount change on invalid ref 1 ret -22 [ 311.515028][T14472] binder: 14467:14472 transaction failed 29201/-22, size 24-8 line 3242 20:16:26 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) read(0xffffffffffffffff, &(0x7f0000000540)=""/82, 0x52) [ 311.550433][T14476] binder: 14467:14476 unknown command 255 [ 311.582465][T14476] binder: 14467:14476 ioctl c0306201 200001c0 returned -22 20:16:27 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:27 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) read(0xffffffffffffffff, &(0x7f0000000540)=""/82, 0x52) 20:16:27 executing program 3: openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) [ 311.714489][T14499] binder: 14496:14499 ioctl c018620b 0 returned -14 [ 311.724960][T14499] binder: 14496:14499 got transaction with invalid offset (0, min 0 max 24) or object. [ 311.739840][T14499] binder: 14496:14499 transaction failed 29201/-22, size 24-8 line 3242 [ 311.754830][T14499] binder: 14496:14499 Release 1 refcount change on invalid ref 1 ret -22 20:16:27 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:27 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 311.764054][T14499] binder: 14496:14499 unknown command 255 [ 311.769921][T14499] binder: 14496:14499 ioctl c0306201 200001c0 returned -22 20:16:27 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:27 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:27 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:27 executing program 3: openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) [ 311.936839][T14515] binder: 14508:14515 ioctl c018620b 0 returned -14 [ 312.001839][T14515] binder: 14508:14515 got transaction with invalid offset (0, min 0 max 24) or object. [ 312.018548][T14515] binder: 14508:14515 transaction failed 29201/-22, size 24-8 line 3242 20:16:27 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:27 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:27 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:27 executing program 3: openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:27 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) [ 312.106678][T14515] binder: 14508:14515 Release 1 refcount change on invalid ref 1 ret -22 [ 312.181190][T14515] binder: 14508:14515 unknown command 255 [ 312.205404][T14515] binder: 14508:14515 ioctl c0306201 200001c0 returned -22 20:16:27 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:27 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:27 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) read(0xffffffffffffffff, &(0x7f0000000540)=""/82, 0x52) 20:16:27 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:27 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:27 executing program 0: openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) [ 312.408552][T14548] binder: 14542:14548 ioctl c018620b 0 returned -14 20:16:27 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) read(0xffffffffffffffff, &(0x7f0000000540)=""/82, 0x52) [ 312.475927][T14548] binder: 14542:14548 Release 1 refcount change on invalid ref 1 ret -22 [ 312.493750][T14548] binder: 14542:14548 unknown command 255 20:16:27 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:27 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:27 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 312.565536][T14548] binder: 14542:14548 ioctl c0306201 200001c0 returned -22 [ 312.588220][ T3759] binder: release 14542:14548 transaction 576 out, still active 20:16:28 executing program 0: openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) [ 312.616603][ T3759] binder: undelivered TRANSACTION_COMPLETE 20:16:28 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) read(0xffffffffffffffff, &(0x7f0000000540)=""/82, 0x52) 20:16:28 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) [ 312.711077][ T3759] binder: send failed reply for transaction 576, target dead [ 312.784659][T14579] binder: 14578:14579 ioctl c018620b 0 returned -14 20:16:28 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) 20:16:28 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000900)={0x0, 0xfa1}, &(0x7f0000000940)=0x8) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:28 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x2200, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0xffffdffffffffffd, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 312.834839][T14579] binder: 14578:14579 Release 1 refcount change on invalid ref 1 ret -22 20:16:28 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x8200, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) shmdt(0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) ioctl$NBD_DO_IT(r0, 0xab03) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) 20:16:28 executing program 0: openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) shmdt(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0xffc5) r1 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r1, &(0x7f0000000540)=""/82, 0x52) [ 312.890810][T14579] binder: 14578:14579 unknown command 255 [ 312.935606][T14579] binder: 14578:14579 ioctl c0306201 200001c0 returned -22 [ 312.996238][ T3759] binder: release 14578:14579 transaction 578 out, still active [ 313.007383][ T3759] binder: undelivered TRANSACTION_COMPLETE 20:16:28 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) [ 313.038956][ T3759] binder: send failed reply for transaction 578, target dead [ 313.054774][T14586] ================================================================== [ 313.063141][T14586] BUG: KASAN: use-after-free in __vb2_perform_fileio+0x1065/0x1140 [ 313.071055][T14586] Read of size 4 at addr ffff8880a3c430dc by task syz-executor.5/14586 [ 313.079292][T14586] [ 313.079328][T14586] CPU: 0 PID: 14586 Comm: syz-executor.5 Not tainted 5.1.0-rc3-next-20190408 #20 [ 313.079338][T14586] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 313.079344][T14586] Call Trace: [ 313.079373][T14586] dump_stack+0x172/0x1f0 [ 313.079395][T14586] ? __vb2_perform_fileio+0x1065/0x1140 [ 313.100904][T14586] print_address_description.cold+0x7c/0x20d [ 313.100922][T14586] ? __vb2_perform_fileio+0x1065/0x1140 [ 313.100937][T14586] ? __vb2_perform_fileio+0x1065/0x1140 [ 313.100949][T14586] kasan_report.cold+0x1b/0x40 [ 313.100965][T14586] ? __vb2_perform_fileio+0x1065/0x1140 [ 313.100980][T14586] __asan_report_load4_noabort+0x14/0x20 [ 313.100994][T14586] __vb2_perform_fileio+0x1065/0x1140 [ 313.101018][T14586] ? vb2_thread_start+0x370/0x370 [ 313.118450][T14600] binder: 14599:14600 ioctl c018620b 0 returned -14 [ 313.120566][T14586] ? fsnotify+0x811/0xbc0 [ 313.120593][T14586] vb2_read+0x3b/0x50 [ 313.120611][T14586] vb2_fop_read+0x212/0x410 [ 313.120631][T14586] ? vb2_fop_write+0x410/0x410 [ 313.120653][T14586] v4l2_read+0x1ce/0x230 [ 313.133547][T14600] binder: 14599:14600 Release 1 refcount change on invalid ref 1 ret -22 [ 313.136511][T14586] __vfs_read+0x8d/0x110 [ 313.136529][T14586] ? v4l2_write+0x230/0x230 [ 313.136549][T14586] vfs_read+0x194/0x3e0 [ 313.152498][T14600] binder: 14599:14600 unknown command 255 [ 313.153189][T14586] ksys_read+0x14f/0x2d0 [ 313.162544][T14600] binder: 14599:14600 ioctl c0306201 200001c0 returned -22 [ 313.164787][T14586] ? kernel_write+0x120/0x120 [ 313.164807][T14586] ? do_syscall_64+0x26/0x610 [ 313.164824][T14586] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 313.164843][T14586] ? do_syscall_64+0x26/0x610 [ 313.171289][ T3759] binder: release 14599:14600 transaction 580 out, still active [ 313.173236][T14586] __x64_sys_read+0x73/0xb0 [ 313.173256][T14586] do_syscall_64+0x103/0x610 [ 313.173277][T14586] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 313.186808][ T3759] binder: undelivered TRANSACTION_COMPLETE [ 313.190315][T14586] RIP: 0033:0x4582b9 20:16:28 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) 20:16:28 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0x5}}, 0x86, 0x0, 0x1007ff}, 0x98) ioctl$NBD_DO_IT(r0, 0xab03) r2 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) read(r2, &(0x7f0000000540)=""/82, 0x52) [ 313.190333][T14586] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 313.190340][T14586] RSP: 002b:00007fb7d5d7bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 313.190353][T14586] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004582b9 [ 313.190361][T14586] RDX: 0000000000000052 RSI: 0000000020000540 RDI: 0000000000000008 [ 313.190368][T14586] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 313.190376][T14586] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb7d5d7c6d4 [ 313.190385][T14586] R13: 00000000004c3db0 R14: 00000000004d8ca8 R15: 00000000ffffffff [ 313.190404][T14586] [ 313.209603][ T3759] binder: send failed reply for transaction 580, target dead [ 313.211652][T14586] Allocated by task 14590: [ 313.211673][T14586] save_stack+0x45/0xd0 [ 313.211687][T14586] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 313.211701][T14586] kasan_kmalloc+0x9/0x10 [ 313.211713][T14586] kmem_cache_alloc_trace+0x151/0x760 [ 313.211728][T14586] __vb2_init_fileio+0x1cb/0xbe0 20:16:28 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0663044001000000ff"], 0x0, 0x0, 0x0}) [ 313.211749][T14586] __vb2_perform_fileio+0xc01/0x1140 [ 313.222964][ T3879] kobject: 'loop4' (000000001ee5e6b3): kobject_uevent_env [ 313.228875][T14586] vb2_read+0x3b/0x50 [ 313.228890][T14586] vb2_fop_read+0x212/0x410 [ 313.228905][T14586] v4l2_read+0x1ce/0x230 [ 313.228920][T14586] __vfs_read+0x8d/0x110 [ 313.228932][T14586] vfs_read+0x194/0x3e0 [ 313.228945][T14586] ksys_read+0x14f/0x2d0 [ 313.228958][T14586] __x64_sys_read+0x73/0xb0 [ 313.228980][T14586] do_syscall_64+0x103/0x610 [ 313.236570][ T3879] kobject: 'loop4' (000000001ee5e6b3): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 313.238334][T14586] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 313.238339][T14586] [ 313.238346][T14586] Freed by task 14584: [ 313.238362][T14586] save_stack+0x45/0xd0 [ 313.238376][T14586] __kasan_slab_free+0x102/0x150 [ 313.238390][T14586] kasan_slab_free+0xe/0x10 [ 313.238403][T14586] kfree+0xcf/0x230 [ 313.238417][T14586] __vb2_cleanup_fileio+0x100/0x170 [ 313.238430][T14586] vb2_core_queue_release+0x20/0x80 [ 313.238450][T14586] _vb2_fop_release+0x1cf/0x2a0 [ 313.318738][T14606] binder: 14603:14606 ioctl c018620b 0 returned -14 [ 313.325528][T14586] vb2_fop_release+0x75/0xc0 [ 313.325541][T14586] vivid_fop_release+0x18e/0x430 [ 313.325552][T14586] v4l2_release+0x224/0x3a0 [ 313.325563][T14586] __fput+0x2e5/0x8d0 [ 313.325572][T14586] ____fput+0x16/0x20 [ 313.325587][T14586] task_work_run+0x14a/0x1c0 [ 313.325604][T14586] exit_to_usermode_loop+0x273/0x2c0 [ 313.325617][T14586] do_syscall_64+0x52d/0x610 [ 313.325631][T14586] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 313.325636][T14586] [ 313.325646][T14586] The buggy address belongs to the object at ffff8880a3c42dc0 [ 313.325646][T14586] which belongs to the cache kmalloc-1k of size 1024 [ 313.325657][T14586] The buggy address is located 796 bytes inside of [ 313.325657][T14586] 1024-byte region [ffff8880a3c42dc0, ffff8880a3c431c0) [ 313.325661][T14586] The buggy address belongs to the page: [ 313.325674][T14586] page:ffffea00028f1080 count:1 mapcount:0 mapping:ffff88812c3f0ac0 index:0xffff8880a3c436c0 compound_mapcount: 0 [ 313.337014][T14606] binder: 14603:14606 Release 1 refcount change on invalid ref 1 ret -22 [ 313.341984][T14586] flags: 0x1fffc0000010200(slab|head) [ 313.342005][T14586] raw: 01fffc0000010200 ffffea00025d6a88 ffffea00028f8608 ffff88812c3f0ac0 [ 313.342022][T14586] raw: ffff8880a3c436c0 ffff8880a3c42040 0000000100000006 0000000000000000 [ 313.342028][T14586] page dumped because: kasan: bad access detected [ 313.342033][T14586] [ 313.342038][T14586] Memory state around the buggy address: [ 313.342051][T14586] ffff8880a3c42f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 313.342062][T14586] ffff8880a3c43000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 313.342074][T14586] >ffff8880a3c43080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 313.342080][T14586] ^ [ 313.342091][T14586] ffff8880a3c43100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 313.342100][T14586] ffff8880a3c43180: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 313.342105][T14586] ================================================================== [ 313.342110][T14586] Disabling lock debugging due to kernel taint [ 313.343351][T14586] Kernel panic - not syncing: panic_on_warn set ... [ 313.361922][T14606] binder: 14603:14606 unknown command 255 [ 313.364242][T14586] CPU: 0 PID: 14586 Comm: syz-executor.5 Tainted: G B 5.1.0-rc3-next-20190408 #20 [ 313.364249][T14586] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 313.364254][T14586] Call Trace: [ 313.364277][T14586] dump_stack+0x172/0x1f0 [ 313.364298][T14586] panic+0x2cb/0x72b [ 313.368631][T14606] binder: 14603:14606 ioctl c0306201 200001c0 returned -22 [ 313.374105][T14586] ? __warn_printk+0xf3/0xf3 [ 313.374122][T14586] ? __vb2_perform_fileio+0x1065/0x1140 [ 313.374138][T14586] ? preempt_schedule+0x4b/0x60 [ 313.374151][T14586] ? ___preempt_schedule+0x16/0x18 [ 313.374173][T14586] ? trace_hardirqs_on+0x5e/0x230 [ 313.374187][T14586] ? __vb2_perform_fileio+0x1065/0x1140 [ 313.374199][T14586] end_report+0x47/0x4f [ 313.374221][T14586] ? __vb2_perform_fileio+0x1065/0x1140 [ 313.380838][ T3759] binder: release 14603:14606 transaction 582 out, still active [ 313.383998][T14586] kasan_report.cold+0xe/0x40 [ 313.384018][T14586] ? __vb2_perform_fileio+0x1065/0x1140 [ 313.384033][T14586] __asan_report_load4_noabort+0x14/0x20 [ 313.384054][T14586] __vb2_perform_fileio+0x1065/0x1140 [ 313.389119][ T3759] binder: undelivered TRANSACTION_COMPLETE [ 313.394280][T14586] ? vb2_thread_start+0x370/0x370 [ 313.394294][T14586] ? fsnotify+0x811/0xbc0 [ 313.394309][T14586] vb2_read+0x3b/0x50 [ 313.394324][T14586] vb2_fop_read+0x212/0x410 [ 313.394341][T14586] ? vb2_fop_write+0x410/0x410 [ 313.394362][T14586] v4l2_read+0x1ce/0x230 [ 313.414558][ T3759] binder: send failed reply for transaction 582, target dead [ 313.418843][T14586] __vfs_read+0x8d/0x110 [ 313.418860][T14586] ? v4l2_write+0x230/0x230 [ 313.418880][T14586] vfs_read+0x194/0x3e0 [ 313.427242][ T3879] kobject: 'loop4' (000000001ee5e6b3): kobject_uevent_env [ 313.427435][T14586] ksys_read+0x14f/0x2d0 [ 313.427459][T14586] ? kernel_write+0x120/0x120 [ 313.433621][ T3879] kobject: 'loop4' (000000001ee5e6b3): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 313.436788][T14586] ? do_syscall_64+0x26/0x610 [ 313.436804][T14586] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 313.436825][T14586] ? do_syscall_64+0x26/0x610 [ 313.475393][T14609] binder: 14607:14609 ioctl c018620b 0 returned -14 [ 313.476736][T14586] __x64_sys_read+0x73/0xb0 [ 313.476754][T14586] do_syscall_64+0x103/0x610 [ 313.476778][T14586] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 313.482824][T14609] binder: 14607:14609 unknown command 255 [ 313.487143][T14586] RIP: 0033:0x4582b9 [ 313.487159][T14586] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 313.487174][T14586] RSP: 002b:00007fb7d5d7bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 313.487187][T14586] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004582b9 [ 313.487203][T14586] RDX: 0000000000000052 RSI: 0000000020000540 RDI: 0000000000000008 [ 313.492603][T14609] binder: 14607:14609 ioctl c0306201 200001c0 returned -22 [ 313.498604][T14586] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 313.498611][T14586] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb7d5d7c6d4 [ 313.498619][T14586] R13: 00000000004c3db0 R14: 00000000004d8ca8 R15: 00000000ffffffff [ 313.499523][T14586] Kernel Offset: disabled [ 314.031097][T14586] Rebooting in 86400 seconds..